According to 11A guidance on IT, which of the following spreadsheets is most likely to be considered a high-risk user-developed application?

A high-risk user-developed application (UDA) refers to spreadsheets or other tools created and

maintained by end-users (not IT) that are critical to financial reporting, decision-making, or

regulatory compliance. The IIA guidance on IT risk management emphasizes evaluating the

complexity, significance, and control environment of such applications.

Analysis of Each Option:

(A) Revenue Calculation Spreadsheet

Uses price and volume reports from production, meaning it relies on structured, external sources,

reducing the risk of significant undetected errors.

Less complexity and external verification reduce its risk level.

(B) Asset Retirement Calculation Spreadsheet (Correct Answer)

Contains multiple formulas and assumptions, making it complex and prone to errors.

Assumptions introduce subjectivity and risk of incorrect calculations, affecting financial statements

and compliance.

No automated controls or independent validations, making it a high-risk UDA.

IIA Standard 2110 – Governance and GTAG 14 (Auditing User-Developed Applications) emphasize

assessing high-risk spreadsheets that impact financial decision-making.

(C) Ad-Hoc Inventory Listing Spreadsheet

Used for written-off inventory, which is historical data and not a key financial driver.

Limited impact on financial reporting, making it a low-risk UDA.

(D) Accounts Receivable Reconciliation Spreadsheet

Used by the accounting manager to verify balances, likely cross-checked with ERP or other financial

systems.

Since external reconciliation exists, the spreadsheet does not pose a high inherent risk.

IIA Reference Supporting the Answer:

GTAG 14 (Auditing User-Developed Applications) – Identifies UDAs with complex formulas, financial

impact, and lack of controls as high-risk.

IIA Standard 2110 (Governance) – Internal auditors must assess governance around financial and

operational risk management, including IT risks.

IIA Standard 2120 (Risk Management) – Emphasizes identifying and mitigating risks from user-

developed applications.

Thus, the correct answer is (B) Asset Retirement Calculation Spreadsheet, as it aligns with IIA

guidance on high-risk spreadsheets due to complex formulas, assumptions, and potential financial

misstatements.