Financial Services · Managed platform (Apparity)

Spreadsheet Risk Control

Find, control and evidence the critical spreadsheets your finance and risk numbers depend on

Overview

What you are buying

Moraph resells, implements and runs Apparity to bring your critical end-user computing tools (EUCs), mostly Excel models and workbooks, under control. Apparity keeps the inventory, versions, changes, approvals and checks for each registered file; Moraph configures it to your EUC policy, runs discovery and onboarding, and keeps the program moving with alert triage, attestation cycles and service reporting. Your owners and reviewers decide what is critical and approve the changes.

The problem it solves

Regulatory returns, reserves, valuations, capital figures and financial statements still pass through spreadsheets that sit on shared drives. Many institutions have an EUC policy but no reliable inventory, and controls amount to file naming conventions and an annual questionnaire. A formula overwritten with a typed number, a link to last quarter's file, or an unreviewed change to a model can flow straight into a filing. When auditors or examiners ask which spreadsheets matter and how changes to them are controlled, the answer is assembled by hand.

  • No complete inventory of the spreadsheets that feed regulatory, financial and risk reporting
  • Changes to critical workbooks are made without review or a record of what changed
  • Formula errors, hard-coded overrides and broken links are found late, if at all
  • Evidence for SOX, model risk and audit testing is gathered by hand each cycle

Who uses it

  • Finance, treasury and regulatory reporting teams whose numbers pass through spreadsheets
  • Operational risk and EUC program owners who own the EUC policy
  • Model risk management teams whose inventory includes spreadsheet models
  • SOX and internal control teams who test controls over financial reporting
  • Internal and external auditors and examiners

Requirements it supports

Sarbanes-Oxley Act Section 404 (internal control over financial reporting)PCAOB Auditing Standard AS 2201 (audit of internal control over financial reporting)Interagency Guidance on Model Risk Management (SR 11-7 / OCC Bulletin 2011-12)BCBS 239 (Principles for effective risk data aggregation and risk reporting)PRA Supervisory Statement SS1/23 (model risk management principles for banks)FDIC Part 363 (annual independent audits and reporting requirements)

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Apparity provides the EUC control platform, Moraph configures and runs it with your teams, and your organization owns the policy, the files and the decisions.

AreaMoraphApparityYour organization
LicensingResells Apparity licences and tracks renewals and usageSets licence terms and provides the software or serviceAgrees the licence scope and accepts Apparity's terms
Platform availabilityMonitors the platform and coordinates recovery with ApparityProvides the platform under its own service commitmentsProvides network access to file locations where it is installed in your environment
EUC policyTranslates the policy into assessments, ratings and controlsProvides the configurable frameworkOwns and approves the EUC policy
Discovery and inventoryRuns scans and prepares candidate listsProvides discovery and inventory featuresDecides which files are in scope and names owners
Identity and accessApplies approved roles and prepares access reviewsProvides the platform's access controlsApproves access and runs your identity provider
Monitoring and alertsTriages alerts and follows them to recorded outcomesGenerates alerts from checks and change detectionOwners resolve or explain alerts on their files
Incident responseLeads platform incidents and keeps you informedResolves product defects and its own service incidentsDecides on business impact and any reporting
Changes to configurationApplies approved configuration changes and tests themPublishes product changes and release notesApproves configuration changes
Updates and patchesTests and applies Apparity updates in agreed windowsProduces updates and security fixesAgrees maintenance windows
User supportSupports owners, reviewers and administratorsSupports Moraph on product questionsMakes owners and reviewers available for onboarding and attestation

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Apparity itself, which belongs to its vendor.

  1. Step 1

    Onboarding tracker

    During implementation, each business area is tracked from discovery to registered and controlled files.

    Business areaFiles foundCandidatesRegisteredControls onStatus
    Regulatory reporting1,240868181On track
    Treasury930544032In progress
    Credit risk2,1151126420Owners not yet assigned for 18
    Financial control1,580737373Complete
    Actuarial6403800Not started
    During implementation, each business area is tracked from discovery to registered and controlled files.
  2. Step 2

    Configuration baseline review

    Your EUC policy, as configured in Apparity, is written down and reviewed with the program owner.

    Baseline v3 · Example Community Bank (fictional)

    Risk ratings
    High, medium, low
    Change approval
    Required for high
    Checks enabled
    High and medium
    Attestation cycle
    As set in your EUC policy
    Discovery locations
    6 file shares, 3 sites
    Last checked against live
    Fictional sample date

    Differences found

    • !Change approval switched off on one high-risk file
    • One new file share added by IT, not yet scanned
    • No difference in rating rules
    Your EUC policy, as configured in Apparity, is written down and reviewed with the program owner.
  3. Step 3

    An unapproved change

    When a high-risk file changes without approval, Moraph triages the alert and the owner records the outcome.

    Alert EA-3307 · Liquidity coverage workbook (fictional)

    1. New version detected without approvalApparity
    2. Alert triaged and routed to ownerMoraph service team
    3. Comparison shows 2 formulas replaced by typed valuesApparity
    4. Owner restores formulas and submits for reviewEUC owner
    5. Change approvedChange reviewer
    6. Alert closed with outcome recordedMoraph service team
    When a high-risk file changes without approval, Moraph triages the alert and the owner records the outcome.
  4. Step 4

    Reviewing a change

    The reviewer sees exactly what changed between versions before approving the new version.

    Allowance model workbook (fictional) · Version 14

    Owner
    EUC owner 2210
    Risk rating
    High
    Feeds
    Quarterly allowance reporting
    Formula changes
    3
    Value changes
    12
    Structure changes
    1 sheet added

    Checks on this version

    • No broken links
    • !1 hard-coded value in a formula on sheet Inputs
    • No error values
    The reviewer sees exactly what changed between versions before approving the new version.
  5. Step 5

    Attestation cycle

    Moraph runs each attestation cycle, chasing owners and escalating overdue items to the program owner.

    OwnerBusiness areaFilesAttestedStatus
    EUC owner 2210Credit risk77Complete
    EUC owner 1874Treasury53In progress
    EUC owner 3051Regulatory reporting90Overdue, escalated
    EUC owner 1402Financial control44Complete
    UnassignedCredit risk20Owner left, reassigning
    Moraph runs each attestation cycle, chasing owners and escalating overdue items to the program owner.
  6. Step 6

    Monthly service review

    Each month Moraph reviews the program and the service with your EUC program owner.

    Monthly service review · Example Community Bank (fictional)

    Registered files
    278
    High risk
    61
    Alerts raised
    19, 17 closed
    Unapproved changes
    3
    Configuration changes
    2
    Apparity update
    Planned in agreed window

    Actions agreed

    • !Assign owners for 18 credit risk files
    • Add new file share to discovery
    • Start actuarial onboarding
    Each month Moraph reviews the program and the service with your EUC program owner.

Workflows

The principal workflows

  1. Discover

    Apparity scans the file locations you choose for spreadsheets and other EUCs. Moraph runs the discovery, filters the results with your teams, and helps owners decide which files are in scope.

    • File shares and collaboration sites agreed with your IT team
    • Apparity discovery scans run on the agreed locations
    • Results filtered by use, location and activity to find likely candidates
    • Owners confirm what each candidate is used for
    • Candidate files proposed for registration in the inventory
  2. Assess and register

    Each file in scope is registered in Apparity with its owner, purpose and downstream use, and rated for risk under your EUC policy, which sets the controls it needs.

    • Owner completes the risk assessment questions set by your policy
    • Apparity calculates the risk rating from the answers
    • Rating reviewed by the EUC program owner
    • Controls assigned for the rating, such as change approval and checks
    • Models identified and linked to your model inventory
  3. Control changes

    Registered files are versioned in Apparity. Changes to high-risk files are compared with the previous version and reviewed before the new version is used.

    • Owner works on the file under Apparity's version control
    • Apparity records each version and compares it with the last
    • Formula, value and structure changes shown to the reviewer
    • Reviewer approves or returns the change with comments
    • Approved version becomes the version of record
  4. Monitor and attest

    Apparity checks registered files and raises alerts on unapproved changes and risk indicators. Moraph triages alerts with owners and runs periodic attestation cycles for the EUC program owner.

    • Alerts raised for unapproved changes and failed checks
    • Moraph triages each alert and routes it to the owner
    • Owner resolves or explains the alert, and the outcome is recorded
    • Owners attest to the inventory and controls each cycle
    • Program results reported to risk committees and audit

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

EUC owner

Financial reporting analyst, treasury analyst, actuary, regulatory reporting manager

Owns one or more critical spreadsheets and keeps them registered, controlled and accurate.

Sees

  • Their own registered files, versions and risk ratings
  • Alerts and check results on their files
  • Attestations due and their history

Does

  • Registers files and completes risk assessments
  • Makes changes under version control
  • Submits changes for review on high-risk files
  • Resolves or explains alerts on their files
  • Attests to their inventory entries each cycle

Cannot

  • Approve their own changes
  • Change their file's risk rating without program owner approval
  • Remove a file from the inventory without approval
Approvals
Changes to high-risk files need a change reviewer's approval; rating changes and removals need the EUC program owner.
Notified about
Alerts on their files, changes returned with comments, and attestations coming due or overdue.

Change reviewer

Finance manager, reporting controller, senior analyst

Checks changes to high-risk files before the new version is used.

Sees

  • Changes submitted for their review with the version comparison
  • The file's risk rating, purpose and downstream use
  • Their own review history

Does

  • Reviews formula, value and structure changes
  • Approves or returns the change with comments
  • Escalates concerns to the EUC program owner

Cannot

  • Approve changes they made themselves
  • Edit the file as part of approving it
  • Change risk ratings or controls
Approvals
Their approvals are recorded and can be sampled by the EUC program owner or audit.
Notified about
Changes waiting for their review and changes waiting longer than your policy allows.

EUC program owner

Head of operational risk, EUC program manager, finance controls lead

Owns the EUC policy and answers for the completeness and control of the inventory.

Sees

  • The whole inventory, risk profile and controls
  • Open alerts, overdue attestations and unreviewed changes
  • Program reports and the audit trail

Does

  • Sets risk assessment questions and controls by rating, with Moraph configuring them
  • Approves risk ratings, exceptions and removals
  • Approves the scope of discovery scans
  • Reviews alert outcomes and escalations
  • Reports to risk committees and audit

Cannot

  • Edit or delete entries in the audit trail
  • Approve a change they made themselves
  • Delete version history of a registered file
Approvals
Approves ratings, exceptions, removals and policy configuration changes.
Notified about
Escalated alerts, overdue attestations, exception requests and configuration changes awaiting approval.

Model risk staff

Model validator, model risk analyst

Uses the version history and change records of spreadsheet models in model inventory and validation work.

Sees

  • Files flagged as models, their versions and changes
  • Risk ratings and check results for those files
  • Approvals of changes to models

Does

  • Confirms which files are models
  • Reviews change history before and after validation
  • Links files to entries in the model inventory

Cannot

  • Change files or approve changes on behalf of owners
  • Change risk ratings
  • See files that are not flagged as models unless granted
Approvals
None in Apparity; model approvals follow your model risk process.
Notified about
Material changes to files flagged as models.

IT administrator

End-user computing engineer, file services administrator, application administrator

Provides access to file locations and manages users and roles under the program owner's direction.

Sees

  • Users, roles and group mappings
  • Discovery scan locations and their status
  • The record of permission changes

Does

  • Grants Apparity access to approved file locations
  • Maps users and roles from your identity provider
  • Supports Moraph on connectivity and agent issues

Cannot

  • Open or change registered files through Apparity
  • Change risk ratings or approve changes
  • Grant themselves an owner or reviewer role
Approvals
Role changes are approved by the EUC program owner.
Notified about
Scan failures on locations they manage and access reviews coming due.

Moraph service team

Moraph managed platform engineer, Moraph service delivery manager

Configures and runs Apparity and the program's routine work on your behalf.

Sees

  • Platform configuration, discovery results and alert queues
  • Attestation status and program reports
  • Administrative logs

Does

  • Runs discovery scans and prepares candidate lists
  • Configures assessment questions, ratings, controls and workflows to your policy
  • Triages alerts and routes them to owners
  • Runs attestation cycles with reminders and escalation
  • Applies Apparity updates after testing and raises cases with Apparity support
  • Runs the monthly service review

Cannot

  • Approve changes, ratings or exceptions
  • Open file content without your explicit, time-bound authorization
  • Close an alert without an owner's recorded outcome
Approvals
Configuration changes follow change requests approved by the EUC program owner.
Notified about
New alerts, scan failures, overdue attestations and Apparity advisories.

Auditor or examiner (read-only)

Internal auditor, external auditor, SOX tester, regulatory examiner (under temporary access)

Tests the EUC program and the controls over specific files without changing anything.

Sees

  • The inventory and risk ratings within scope
  • Versions, changes and approvals
  • Alerts, attestations and the audit trail

Does

  • Selects samples of files and changes for testing
  • Reviews evidence of approval and checks
  • Exports reports within scope, with each export logged

Cannot

  • Change, approve or delete anything
  • See files outside the scope granted
  • Keep access after it expires
Approvals
Their access is approved by the EUC program owner, with a scope and an end date.
Notified about
Nothing by default; access granted and expiring is confirmed to the person who approved it.

Permissions at a glance

ActionEUC ownerReviewerProgram ownerModel riskIT adminMoraph teamAuditor
Register files and assess riskOwn work onlyNo accessFullNo accessNo accessView onlyView only
Approve risk ratings and exceptionsNo accessNo accessApprovesNo accessNo accessNo accessView only
Change a registered fileOwn work onlyNo accessNo accessNo accessNo accessNo accessNo access
Approve changes to high-risk filesNo accessApprovesApprovesNo accessNo accessNo accessView only
View versions and change comparisonsOwn work onlyOwn work onlyFullOwn work onlyNo accessView onlyView only
Run discovery scansNo accessNo accessApprovesNo accessView onlyFullNo access
Triage alertsOwn work onlyNo accessView onlyNo accessNo accessFullView only
Attest to inventory and controlsOwn work onlyNo accessApprovesNo accessNo accessView onlyView only
Configure assessments, ratings and workflowsNo accessNo accessApprovesNo accessNo accessFullNo access
View program reportsOwn work onlyNo accessFullView onlyNo accessView onlyView only
View audit trailNo accessNo accessView onlyNo accessNo accessView onlyView only
Manage users and rolesNo accessNo accessApprovesNo accessFullOwn work onlyNo access
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Nobody approves their own change: Apparity routes changes to high-risk files to a reviewer other than the person who made them.
  • Moraph runs discovery, configuration, alert triage and attestation cycles, but decisions on ratings, exceptions and changes stay with your owners, reviewers and program owner.
  • Roles can be limited by business line, legal entity or file location, so owners and reviewers see only their own files.
  • Access reviews list each person's role for certification by the EUC program owner, and auditors get temporary read-only access with a scope and an end date.

Features

What it does

EUC discovery

Apparity scans the file locations you approve to find spreadsheets and other EUCs that may need to be in the inventory.

Central inventory

One register of critical EUCs with owner, purpose, risk rating, controls and the reports or processes each one feeds.

Risk assessment

Owners answer the questions in your EUC policy, and Apparity sets the risk rating and the controls that follow from it.

Version control

Apparity keeps each version of a registered file, so you can see what was used for a given report and go back to it.

Change comparison

Changes between versions are shown at formula, value and structure level, so a reviewer sees exactly what moved.

Change approval

Changes to high-risk files are reviewed and approved by someone other than the person who made them.

Spreadsheet checks

Apparity checks registered files for risk indicators such as hard-coded values in formulas, broken links and errors, and raises alerts.

Alert triage

Moraph's team triages Apparity alerts, routes them to owners and follows each one to a recorded outcome.

Attestation cycles

Owners confirm their inventory entries and controls on the schedule your policy sets, with reminders and escalation run by Moraph.

Model inventory link

Spreadsheets that are models are flagged and linked to your model inventory, including Moraph's Model Risk Management (MRM) Validator.

Audit trail

Who registered, changed, approved, checked and attested each file, and when, kept by Apparity for audit and examiners.

Program reporting

Inventory coverage, risk profile, open alerts, overdue attestations and change activity for the EUC program owner and committees.

Integrations

How it connects to your systems

Connects toHowWhat flows
File shares and collaboration sitesApparity reads the network shares and document libraries you approve, for discovery and for controlling registered files.In: file metadata and, for registered files, file content and versions.
Microsoft ExcelOwners keep working in Excel; Apparity records versions and changes of registered workbooks.In: workbook versions, formulas and structure.
Model inventoryFiles flagged as models are linked to your model inventory, including Moraph's Model Risk Management (MRM) Validator.Out: model flags, versions and change history.
GRC and control testingInventory, control and attestation results can be shared with your governance, risk and compliance tool for SOX and operational risk reporting.Out: inventory, control status and attestation results.
Single sign-onUsers sign in through your identity provider (SAML or OpenID Connect), with roles following its groups where supported.In: user identity and group membership.
HR and directoryLeaver and mover records are used to flag files whose owner has left or changed role.In: staff status and role changes.
Moraph service portalAlerts, change requests, incidents and service reports are tracked in Moraph's service portal and available through the Moraph Work API.Out: tickets, alerts, changes and service reports.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Your staff and Moraph's engineers sign in through identity providers with multi-factor authentication, so your access policies apply.

Role-based access

Owners and reviewers see their own files; administering the platform is separate from approving changes.

No routine access to content

Moraph staff cannot open file content without your explicit, time-bound authorization, and keys are handled on the same basis.

Complete audit trail

Registrations, changes, approvals, alert outcomes and attestations are logged with the person and time.

Data residency

File content and versions stay in the environment and region agreed for your deployment; Moraph-hosted components run in the United States, United Kingdom or Australia.

Controlled changes

Configuration changes and Apparity updates are tested before they are applied, and Moraph-built connectors pass its security testing gates and carry a software bill of materials.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Inventory

EUC inventory

For eUC program owner, risk committees, audit

Every registered file with owner, purpose, risk rating, controls and the reports it feeds.

Break down by
Business line, Risk rating, Owner, Downstream use, Model or non-model
Delivered as
Live view; CSV and PDF export
Used for
Knowing which spreadsheets matter and who owns them.

Discovery results

For eUC program owner and Moraph

Files found by discovery scans, those registered, those excluded with a reason, and those still to be decided.

Break down by
Location, Status, Scan date
Delivered as
Live view; CSV export
Used for
Showing how the inventory was built and that nothing found was ignored.

Orphaned files

For eUC program owner

Registered files whose owner has left or changed role, and their reassignment status.

Break down by
Business line, Risk rating, Status
Delivered as
Live view; scheduled email
Used for
Keeping every critical file with an accountable owner.

Controls

Change activity

For eUC program owner, reviewers, audit

Changes made to registered files, whether each was reviewed and approved, and by whom.

Break down by
File, Risk rating, Reviewer, Outcome, Period
Delivered as
Live view; CSV export
Used for
Showing that changes to critical files were reviewed.

Unapproved changes

For eUC program owner

Changes to high-risk files detected without an approval, and how each was resolved.

Break down by
File, Owner, Resolution, Period
Delivered as
Live dashboard; scheduled email
Used for
Finding control breaks and following them up.

Alerts and outcomes

For eUC program owner and Moraph

Alerts from checks and change detection, their age, the owner's response and the outcome.

Break down by
Alert type, Business line, Status, Age band
Delivered as
Live dashboard; CSV export
Used for
Making sure every alert is resolved or explained.

Attestation status

For eUC program owner

Attestations requested, completed and overdue for the current cycle, by owner.

Break down by
Cycle, Owner, Business line, Status
Delivered as
Live view; scheduled email
Used for
Completing each attestation cycle and evidencing it.

Governance and audit

Program summary

For risk committees and senior management

Inventory size and risk profile, open alerts, overdue attestations and control breaks in the period.

Break down by
Period, Business line, Risk rating
Delivered as
PDF; scheduled email
Used for
Committee oversight of the EUC program.

File evidence pack

For auditors, SOX testers and examiners

For a selected file and period, its versions, changes, approvals, check results and attestations.

Break down by
File, Date range
Delivered as
On request; PDF and CSV export
Used for
Answering control testing requests without gathering evidence by hand.

Monthly service review pack

For eUC program owner

Discovery progress, alerts, incidents, configuration changes, upcoming Apparity updates and open actions.

Break down by
Period, Topic
Delivered as
PDF
Used for
Overseeing Moraph's service and agreeing actions.

Exports, access and evidence

  • Inventory, change and attestation reports come from Apparity's records; service reports come from Moraph's service record.
  • Reports can be exported to CSV, and summary and evidence reports to PDF, and scheduled to arrive by email for the people entitled to see them.
  • Reports respect each viewer's role: owners see their own files, the program owner sees the whole inventory, and auditors get read-only access within their scope.
  • Inventory and control data can be shared with your GRC tool or data warehouse, and tickets and service reports are available through the Moraph Work API.
  • Evidence packs can be produced for a past period and give the same result each time.

Deployment

Where and how it runs

Apparity cloud, run by Moraph

Apparity's hosted service, licensed through Moraph and configured and operated by Moraph's team.

In your environment

Apparity installed in your data center or cloud account, close to your file shares, with Moraph operating it under agreed remote access.

Co-managed

Your operational risk team keeps some program work, such as attestation cycles, and Moraph runs the platform, discovery and alert triage.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Policy translation

We turn your EUC policy into Apparity's risk assessment questions, rating rules and controls by rating, and agree them with your program owner. If you do not have a policy, we work from your existing standards and your program owner decides.

Installation and access

Apparity is set up in its hosted service or your environment, and connected to the file locations you approve. We need contacts from your file services and identity teams.

Discovery

Scans run on the agreed locations, and the results are filtered with business leads to find candidate files.

Onboarding owners

Owners are trained, register their files and complete assessments, starting with the files that feed regulatory and financial reporting.

Controls and checks

Change approval, checks and alerts are switched on by risk rating, and the first alerts are reviewed with owners to tune them.

Handover to service

Alert triage, attestation cycles, reporting and the monthly service review start under Moraph's managed service.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not the vendor. Apparity owns the platform, and Apparity's own service commitments, roadmap and outages apply.
  • Licences are subject to Apparity's terms, which you accept as part of the agreement.
  • Discovery finds files only in the locations you approve. Spreadsheets on local drives, personal storage or email are not found unless those locations are included.
  • Checks flag risk indicators; they do not prove a spreadsheet is correct. Owners and reviewers remain responsible for the logic and results.
  • Moraph does not validate models. Model validation follows your model risk process, though version history and change records support it.
  • Deciding which files are critical, and approving ratings and exceptions, is your organization's decision.
  • Controls apply to registered files. Copies made outside Apparity's control are not tracked.
  • Moraph does not rebuild or redesign your spreadsheets as part of the managed service; that can be scoped separately.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Pick one reporting process and ask which spreadsheets discovery would find behind it
  2. Map your EUC policy to risk assessment questions and controls and review the result
  3. Make a change to a sample workbook and review the comparison a reviewer would see
  4. Ask how an unapproved change is detected, triaged and closed
  5. Check the responsibilities table against your own operating model
  6. Request a sample evidence pack and test it against your SOX or audit requirements

Questions

Frequently asked questions

Do our analysts have to stop using Excel?

No. Owners keep working in Excel. Apparity records versions and changes of registered files and adds review where your policy requires it.

Who owns the inventory and the files?

Your organization does. How the inventory and history are returned to you at the end of the agreement is set out in the contract.

We already have Apparity. Can Moraph run it for us?

Yes. We review your configuration against your EUC policy, agree a baseline, and take over discovery, alert triage, attestation cycles and reporting.

How is it priced?

Apparity licences are priced under Apparity's terms, and Moraph's implementation and managed service are quoted separately, usually by the number of registered files and users. See Working with Moraph for what drives a quotation.

Does this cover files other than Excel?

Apparity can control some EUC types besides Excel workbooks. Which types are supported for your files, and which are in scope, is confirmed during implementation.

Is there an accessibility conformance report?

Ask for one through the procurement request form at /how-to-buy/request, naming the service you are evaluating.

Next steps

Evaluate Spreadsheet Risk Control

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Spreadsheet Risk Control guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Spreadsheet Risk Control support guide.