Spreadsheet risk in audit work concentrates in four specific, repeatable failure modes: a formula range that silently stops including new rows after an insert, a copy-paste that overwrites a live formula with a static value without anyone noticing, a hidden or filtered row that gets excluded from a sum without being flagged, and multiple reviewers editing separate copies of the same file until nobody is certain which version is current.
1. Formula ranges that quietly stop covering new rows
A SUM or VLOOKUP written against a fixed range (say, rows 2 to 150) will not automatically extend when ten new transactions are added below row 150. The formula still returns a number, so nothing looks obviously wrong — it's simply a number that excludes the new rows, and a reviewer scanning for an error message finds none because there isn't one.
2. Copy-paste overwriting a formula with a static value
Pasting a value over a cell that used to hold a formula turns that cell into a dead number that will never update again, even though every surrounding cell still recalculates normally. This is one of the hardest spreadsheet errors to catch visually, because the cell displays a perfectly plausible number right up until the underlying data changes and that one cell doesn't follow.
3. Hidden or filtered rows excluded from a total
- A SUM formula over a visible range includes hidden rows by default, but a SUBTOTAL formula with certain function codes deliberately excludes them — mixing the two inconsistently across a workbook creates totals that silently diverge depending on which formula was used where.
- A filtered view that a reviewer applied temporarily, then forgot to clear, can make a working paper look reconciled when the full population was never actually in view during the check.
4. Version drift across reviewers
The moment a workbook is emailed to a second reviewer rather than edited in one shared, controlled location, two divergent versions exist, and whichever one gets saved last silently becomes 'the' file — regardless of whether it actually contains the more recent or more correct edits.
| Failure mode | How it's usually caught (too late) | Cheaper early check |
|---|---|---|
| Formula range doesn't cover new rows | Total doesn't match an independent control total | Use structured tables (Excel Tables) that auto-expand with formulas, or a tool that recalculates the full population every time |
| Static value overwrote a formula | A later change to the source data doesn't flow through, and the discrepancy surfaces by accident | A formula-integrity check before sign-off, scanning for unexpected constants in formula cells |
| Hidden rows excluded from a total | A later full recount doesn't match the reported figure | Always unhide and clear filters before taking any total as final |
| Version drift between reviewers | Two reviewers' comments reference different numbers for the same line | One shared, access-controlled file with change tracking, not emailed copies |
None of these failure modes trigger an Excel error message. That is precisely what makes them an audit risk rather than a mere inconvenience — a wrong number that looks exactly like a right number will pass a casual review every time.
How we think about this
Lekhya's view is that these four failure modes are specifically why deterministic, rule-based computation inside structured software — where a total always covers the full current population and a formula can't silently become a static value — is a meaningfully different risk profile from free-form spreadsheet work, not just a faster version of the same thing.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Technology, data & AI in auditMigrating from Excel working papers to audit softwareWhat a firm actually gains and loses leaving Excel, the version chaos Excel creates across a review chain, and a realistic first-engagement timeline.
- Audit documentationReviewing and signing off audit working papersWhat a reviewer is responsible for, a defensible review order, writing points that get cleared properly, and why approval must lapse when the paper changes.
- Audit documentationAudit working papers: what they should containThe anatomy of a paper that stands on its own: objective, population, sample basis, procedure, results, exceptions, conclusion and sign-off, and what each must establish.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.