Spreadsheet Risk Control

Moraph resells, implements and runs Apparity to bring your critical end-user computing tools (EUCs), mostly Excel models and workbooks, under control. Apparity keeps the inventory, versions, changes, approvals and checks for each registered file; Moraph configures it to your EUC policy, runs discovery and onboarding, and keeps the program moving with alert triage, attestation cycles and service reporting. Your owners and reviewers decide what is critical and approve the changes.

The problem it solves

Regulatory returns, reserves, valuations, capital figures and financial statements still pass through spreadsheets that sit on shared drives. Many institutions have an EUC policy but no reliable inventory, and controls amount to file naming conventions and an annual questionnaire. A formula overwritten with a typed number, a link to last quarter's file, or an unreviewed change to a model can flow straight into a filing. When auditors or examiners ask which spreadsheets matter and how changes to them are controlled, the answer is assembled by hand.

Who it’s for

• Finance, treasury and regulatory reporting teams whose numbers pass through spreadsheets
• Operational risk and EUC program owners who own the EUC policy
• Model risk management teams whose inventory includes spreadsheet models
• SOX and internal control teams who test controls over financial reporting
• Internal and external auditors and examiners

1. DiscoverApparity scans the file locations you choose for spreadsheets and other EUCs. Moraph runs the discovery, filters the results with your teams, and helps owners decide which files are in scope.
2. Assess and registerEach file in scope is registered in Apparity with its owner, purpose and downstream use, and rated for risk under your EUC policy, which sets the controls it needs.
3. Control changesRegistered files are versioned in Apparity. Changes to high-risk files are compared with the previous version and reviewed before the new version is used.
4. Monitor and attestApparity checks registered files and raises alerts on unapproved changes and risk indicators. Moraph triages alerts with owners and runs periodic attestation cycles for the EUC program owner.

EUC discovery

Apparity scans the file locations you approve to find spreadsheets and other EUCs that may need to be in the inventory.

Central inventory

One register of critical EUCs with owner, purpose, risk rating, controls and the reports or processes each one feeds.

Risk assessment

Owners answer the questions in your EUC policy, and Apparity sets the risk rating and the controls that follow from it.

Version control

Apparity keeps each version of a registered file, so you can see what was used for a given report and go back to it.

Change comparison

Changes between versions are shown at formula, value and structure level, so a reviewer sees exactly what moved.

Change approval

Changes to high-risk files are reviewed and approved by someone other than the person who made them.

Spreadsheet checks

Apparity checks registered files for risk indicators such as hard-coded values in formulas, broken links and errors, and raises alerts.

Alert triage

Moraph's team triages Apparity alerts, routes them to owners and follows each one to a recorded outcome.

Attestation cycles

Owners confirm their inventory entries and controls on the schedule your policy sets, with reminders and escalation run by Moraph.

Model inventory link

Spreadsheets that are models are flagged and linked to your model inventory, including Moraph's Model Risk Management (MRM) Validator.

Audit trail

Who registered, changed, approved, checked and attested each file, and when, kept by Apparity for audit and examiners.

Program reporting

Inventory coverage, risk profile, open alerts, overdue attestations and change activity for the EUC program owner and committees.

EUC owner

Registers and maintains their files, makes changes under version control and attests each cycle

Change reviewer

Reviews and approves changes to high-risk files made by others

EUC program owner

Owns the EUC policy, approves risk ratings and reports on the program

Model risk staff

Sees spreadsheet models and their change history for validation

Moraph service team

Runs discovery, configures Apparity, triages alerts and runs attestation cycles

Auditor or examiner (read-only)

Reviews the inventory, changes, approvals and audit trail

File shares and collaboration sites

Apparity reads the network shares and document libraries you approve, for discovery and for controlling registered files.

Microsoft Excel

Owners keep working in Excel; Apparity records versions and changes of registered workbooks.

Model inventory

Files flagged as models are linked to your model inventory, including Moraph's Model Risk Management (MRM) Validator.

GRC and control testing

Inventory, control and attestation results can be shared with your governance, risk and compliance tool for SOX and operational risk reporting.

Single sign-on

Users sign in through your identity provider (SAML or OpenID Connect), with roles following its groups where supported.

HR and directory

Leaver and mover records are used to flag files whose owner has left or changed role.

Moraph service portal

Alerts, change requests, incidents and service reports are tracked in Moraph's service portal and available through the Moraph Work API.

Single sign-on

Your staff and Moraph's engineers sign in through identity providers with multi-factor authentication, so your access policies apply.

Role-based access

Owners and reviewers see their own files; administering the platform is separate from approving changes.

No routine access to content

Moraph staff cannot open file content without your explicit, time-bound authorization, and keys are handled on the same basis.

Complete audit trail

Registrations, changes, approvals, alert outcomes and attestations are logged with the person and time.

Data residency

File content and versions stay in the environment and region agreed for your deployment; Moraph-hosted components run in the United States, United Kingdom or Australia.

Controlled changes

Configuration changes and Apparity updates are tested before they are applied, and Moraph-built connectors pass its security testing gates and carry a software bill of materials.

Apparity cloud, run by Moraph

Apparity's hosted service, licensed through Moraph and configured and operated by Moraph's team.

In your environment

Apparity installed in your data center or cloud account, close to your file shares, with Moraph operating it under agreed remote access.

Co-managed

Your operational risk team keeps some program work, such as attestation cycles, and Moraph runs the platform, discovery and alert triage.

Policy translation

We turn your EUC policy into Apparity's risk assessment questions, rating rules and controls by rating, and agree them with your program owner. If you do not have a policy, we work from your existing standards and your program owner decides.

Installation and access

Apparity is set up in its hosted service or your environment, and connected to the file locations you approve. We need contacts from your file services and identity teams.

Discovery

Scans run on the agreed locations, and the results are filtered with business leads to find candidate files.

Onboarding owners

Owners are trained, register their files and complete assessments, starting with the files that feed regulatory and financial reporting.

Controls and checks

Change approval, checks and alerts are switched on by risk rating, and the first alerts are reviewed with owners to tune them.

Handover to service

Alert triage, attestation cycles, reporting and the monthly service review start under Moraph's managed service.

• Moraph is not the vendor. Apparity owns the platform, and Apparity's own service commitments, roadmap and outages apply.
• Licences are subject to Apparity's terms, which you accept as part of the agreement.
• Discovery finds files only in the locations you approve. Spreadsheets on local drives, personal storage or email are not found unless those locations are included.
• Checks flag risk indicators; they do not prove a spreadsheet is correct. Owners and reviewers remain responsible for the logic and results.
• Moraph does not validate models. Model validation follows your model risk process, though version history and change records support it.
• Deciding which files are critical, and approving ratings and exceptions, is your organization's decision.
• Controls apply to registered files. Copies made outside Apparity's control are not tracked.
• Moraph does not rebuild or redesign your spreadsheets as part of the managed service; that can be scoped separately.

• Pick one reporting process and ask which spreadsheets discovery would find behind it
• Map your EUC policy to risk assessment questions and controls and review the result
• Make a change to a sample workbook and review the comparison a reviewer would see
• Ask how an unapproved change is detected, triaged and closed
• Check the responsibilities table against your own operating model
• Request a sample evidence pack and test it against your SOX or audit requirements