Spreadsheets, and their associates documents and emails, are the most prevalent GRC tool used by organizations. Their use comes at a significant cost if not controlled, monitored, and used properly.

In my research, organizations utilize spreadsheets for a variety of purposes. They are used to:

• Conduct risk, compliance, and control surveys, questionnaires, and assessments
• Inventory policies and manage related tasks
• Conduct investigations and remediate issues
• Document and assess controls
• Model and assess risk and finance
• Report on finance or GRC
• Manage the financial close process