Spreadsheet Risk Control

Principal workflows

• Discover: Apparity scans the file locations you choose for spreadsheets and other EUCs. Moraph runs the discovery, filters the results with your teams, and helps owners decide which files are in scope.
• Assess and register: Each file in scope is registered in Apparity with its owner, purpose and downstream use, and rated for risk under your EUC policy, which sets the controls it needs.
• Control changes: Registered files are versioned in Apparity. Changes to high-risk files are compared with the previous version and reviewed before the new version is used.
• Monitor and attest: Apparity checks registered files and raises alerts on unapproved changes and risk indicators. Moraph triages alerts with owners and runs periodic attestation cycles for the EUC program owner.

Who uses it

• Finance, treasury and regulatory reporting teams whose numbers pass through spreadsheets
• Operational risk and EUC program owners who own the EUC policy
• Model risk management teams whose inventory includes spreadsheet models
• SOX and internal control teams who test controls over financial reporting
• Internal and external auditors and examiners

Reporting

• EUC inventory by risk rating and owner
• Discovery results and registration progress
• Change activity and unapproved changes
• Alerts and their outcomes
• Attestation status by cycle
• File evidence packs for audit and SOX testing

Features

• EUC discovery: Apparity scans the file locations you approve to find spreadsheets and other EUCs that may need to be in the inventory.
• Central inventory: One register of critical EUCs with owner, purpose, risk rating, controls and the reports or processes each one feeds.
• Risk assessment: Owners answer the questions in your EUC policy, and Apparity sets the risk rating and the controls that follow from it.
• Version control: Apparity keeps each version of a registered file, so you can see what was used for a given report and go back to it.
• Change comparison: Changes between versions are shown at formula, value and structure level, so a reviewer sees exactly what moved.
• Change approval: Changes to high-risk files are reviewed and approved by someone other than the person who made them.
• Spreadsheet checks: Apparity checks registered files for risk indicators such as hard-coded values in formulas, broken links and errors, and raises alerts.
• Alert triage: Moraph's team triages Apparity alerts, routes them to owners and follows each one to a recorded outcome.
• Attestation cycles: Owners confirm their inventory entries and controls on the schedule your policy sets, with reminders and escalation run by Moraph.
• Model inventory link: Spreadsheets that are models are flagged and linked to your model inventory, including Moraph's Model Risk Management (MRM) Validator.
• Audit trail: Who registered, changed, approved, checked and attested each file, and when, kept by Apparity for audit and examiners.
• Program reporting: Inventory coverage, risk profile, open alerts, overdue attestations and change activity for the EUC program owner and committees.

Integrations

• File shares and collaboration sites: Apparity reads the network shares and document libraries you approve, for discovery and for controlling registered files.
• Microsoft Excel: Owners keep working in Excel; Apparity records versions and changes of registered workbooks.
• Model inventory: Files flagged as models are linked to your model inventory, including Moraph's Model Risk Management (MRM) Validator.
• GRC and control testing: Inventory, control and attestation results can be shared with your governance, risk and compliance tool for SOX and operational risk reporting.
• Single sign-on: Users sign in through your identity provider (SAML or OpenID Connect), with roles following its groups where supported.
• HR and directory: Leaver and mover records are used to flag files whose owner has left or changed role.
• Moraph service portal: Alerts, change requests, incidents and service reports are tracked in Moraph's service portal and available through the Moraph Work API.

Deployment

• Apparity cloud, run by Moraph: Apparity's hosted service, licensed through Moraph and configured and operated by Moraph's team.
• In your environment: Apparity installed in your data center or cloud account, close to your file shares, with Moraph operating it under agreed remote access.
• Co-managed: Your operational risk team keeps some program work, such as attestation cycles, and Moraph runs the platform, discovery and alert triage.

Security and privacy

• Single sign-on: Your staff and Moraph's engineers sign in through identity providers with multi-factor authentication, so your access policies apply.
• Role-based access: Owners and reviewers see their own files; administering the platform is separate from approving changes.
• No routine access to content: Moraph staff cannot open file content without your explicit, time-bound authorization, and keys are handled on the same basis.
• Complete audit trail: Registrations, changes, approvals, alert outcomes and attestations are logged with the person and time.
• Data residency: File content and versions stay in the environment and region agreed for your deployment; Moraph-hosted components run in the United States, United Kingdom or Australia.
• Controlled changes: Configuration changes and Apparity updates are tested before they are applied, and Moraph-built connectors pass its security testing gates and carry a software bill of materials.

Limitations

• Moraph is not the vendor. Apparity owns the platform, and Apparity's own service commitments, roadmap and outages apply.
• Licences are subject to Apparity's terms, which you accept as part of the agreement.
• Discovery finds files only in the locations you approve. Spreadsheets on local drives, personal storage or email are not found unless those locations are included.
• Checks flag risk indicators; they do not prove a spreadsheet is correct. Owners and reviewers remain responsible for the logic and results.
• Moraph does not validate models. Model validation follows your model risk process, though version history and change records support it.
• Deciding which files are critical, and approving ratings and exceptions, is your organization's decision.
• Controls apply to registered files. Copies made outside Apparity's control are not tracked.
• Moraph does not rebuild or redesign your spreadsheets as part of the managed service; that can be scoped separately.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/spreadsheet-risk-control. Purchasing routes and company information: www.moraph.com/how-to-buy.