According to 11A guidance on IT, which of the following spreadsheets is most likely to be considered a high-risk user-developed application?

According to IIA guidance, the risk of a user-developed application (UDA), such as a spreadsheet, is determined by its complexity, the materiality of its output, and its use in decision-making. An asset retirement calculation spreadsheet with multiple formulas and, critically, assumptions, presents a high risk. The complexity of formulas increases the chance of error, while the use of assumptions introduces subjectivity and estimation risk. Asset retirement obligations are often material financial statement items, meaning any errors could have a significant impact. This combination of complexity, judgment, and materiality makes it the highest-risk option.

A. While revenue is material, this spreadsheet is supported by official reports, suggesting it is used for verification or simple calculation, reducing its inherent risk.
C. An ad-hoc listing of already written-off inventory is likely informational and has a low financial impact, as the accounting event has already occurred.
D. A reconciliation spreadsheet is a detective control. While important, its purpose is to verify data from other systems, not to originate a complex, assumption-based calculation.

1. The Institute of Internal Auditors (IIA). (2018). GTAG 14: Auditing User-Developed Applications. pp. 4-5. (This guide explicitly lists factors for assessing UDA risk, including complexity of calculations, extent of assumptions, and financial or operational impact of errors).

2. The Institute of Internal Auditors (IIA). (2017). GTAG 1: Information Technology Controls (2nd ed.). p. 31. (Discusses risks associated with end-user computing, highlighting that complex spreadsheets used for critical financial calculations require stronger controls).