Resources

How to track changes between spreadsheet versions for audit

4 min read

When an auditor, controller or reviewer opens a workbook, the first question is rarely about the numbers. It is: what changed since the last review? A file's modified date does not answer that. It records when someone saved the file, not which formulas were rewritten, which calculated cells were typed over, or whether an inserted row moved a range that feeds a summary.

Why reviewers ask “what changed?”

A model can give a different answer for reasons unrelated to its inputs. A formula is rewritten to handle one special case and never reverted. A calculated cell is pasted over with its current value. A row is inserted above a range: the totals still add up, but they now cover different cells. Each of these is a change, and each needs an explanation that someone other than the author can check.

What counts as a material change

Not every edit needs a formal review. Focus on changes that can alter a result or the evidence behind it:

• Formula edits. A formula is rewritten, even when today's result looks the same. The new logic may behave differently on the next set of inputs.
• Hardcoded values that replaced formulas. A calculated cell becomes a typed number. This is the change most likely to pass unnoticed, because the cell still shows a plausible figure.
• Structural changes. Rows or columns are inserted or deleted, or a sheet is renamed. References elsewhere may now point at different cells.
• Changed inputs. Inputs are expected to change, but the new value, its source and the date of the change should be recorded.

Compare each version with the one before it

A useful comparison runs at cell level, against the previous version of the same file rather than against whichever copy someone has on hand. For each change it should show the sheet, the cell or range, what it was before, and what it is now.

SheetSift's version change reports work this way. Each scan is compared with the previous version and lists formulas edited, hardcoded values that replaced formulas, values changed, and rows, columns and sheets inserted, deleted or renamed. Reports can be exported to Excel or CSV, and they are included in the evidence pack, so the record sits next to the scan it describes.

Version history is on by default. It keeps each scan's formulas, sheet structure and keyed hashes of constant values until the scan is deleted. An organization can turn it off, or keep full values instead of hashes.

Keep accepted-risk decisions attached when rows move

Review decisions often attach to a specific cell. A reviewer may accept that a hardcoded tax rate is intentional, for example. If that decision is tied to a cell address, it goes wrong as soon as the layout changes: insert a row above the cell and the address now holds a different number, while the approved cell has moved down.

The decision should follow the original cell. The cell that slides into the old address should not inherit it, because nobody has reviewed that value. SheetSift's accepted-risk waivers follow cells that move for this reason, so an approval stays with the value it was given for.

A monthly change-review checklist

Run this review once a month for each workbook in scope, and before any close or submission that relies on it:

1. Scan the current version and compare it with the version from the previous review.
2. Review every hardcoded value that replaced a formula. Confirm its source, or restore the formula.
3. Check formula edits in summary and output sheets first, then in the sheets that feed them.
4. Confirm that inserted or deleted rows and columns, and any renamed sheets, have not broken links from other sheets or workbooks.
5. Check that each accepted risk still applies to the cell it was approved for, and re-review any that do not.
6. Record who made each material change, when, why, and whether it was approved.
7. Export the change report and file it with the working papers for the period.

The goal is not to stop people from changing spreadsheets. It is to make each change visible and explainable, so the next review starts from a record rather than from memory.