Business-critical calculations, reports and data feeds run in spreadsheets, desktop databases and macros that no IT control framework can see. End-user computing (EUC) applications are tools that business staff build and run themselves: Excel workbooks with formulas and VBA, Access databases, Power Query transformations, local scripts and desktop reports. They price products, calculate provisions, feed regulatory returns and hold personal data, often with no change control, no backup and no owner who understands them. This guide covers how to find EUCs, tier them by risk, apply proportionate controls for integrity, confidentiality and availability, and decide when to replace them. It is written for risk, audit and security teams and for the IT owners who inherit EUC programmes.
Key takeaways
- Integrity is the main risk, not only confidentiality. A broken formula or truncated import produces wrong numbers that look right, and wrong numbers reach customers, regulators and boards.
- You cannot control what you have not found. Discovery by file scanning and owner attestation comes first, then a materiality and complexity tier for each EUC.
- Controls scale with tier. High-risk EUCs need change control, independent review, versioning, access restriction and backup; low-risk ones need only an owner and a location.
- Spreadsheets leak hidden data. Pivot caches, hidden sheets and metadata travel with the file, which is how a UK police service published details of its entire workforce.
- Replacement is the long-term control. Each high-tier EUC should have a decision: control it, rebuild it in a governed platform, or retire it.
What counts as end-user computing
An EUC is any application where the logic is built and maintained by the business rather than through the IT development life cycle. The common forms and their characteristic weaknesses:
| EUC type | Typical use | Characteristic weakness |
|---|---|---|
| Excel workbook with formulas | Pricing, reconciliations, provisions, forecasts | Inconsistent formulas, hard-coded overrides, no review trail |
| Macro-enabled workbook (.xlsm, .xlam add-in) | Automated report building, data loads | Code nobody can read; macro security exceptions |
| Access database (.accdb, .mdb) | Departmental case or customer tracking | File on a share, no row-level access, no audit |
| Power Query and external data connections | Pulling from SQL, CSV or web sources | Stored credentials, silent source changes |
| Local scripts and notebooks | Python or R analysis, ad hoc automation | Personal device dependency, secrets in code |
| Desktop BI reports and low-code apps | Dashboards, small workflows | Personal connections, sharing outside the team |
Low-code and self-service BI platforms have their own governance tooling; this guide focuses on file-based EUCs and links out for the rest. See the Low-Code and No-Code Application Security Guide and the Power BI Security Guide.
Why spreadsheet risk is a security and resilience problem
- Integrity failures at scale: in October 2020 Public Health England failed to include 15,841 positive COVID-19 cases in its reporting because, as The Register reported citing the BBC, results were loaded into the legacy .XLS format, which caps a sheet at 65,536 rows, so records beyond that point were dropped. The fix was a process change, not a security tool.
- Hidden data disclosure: in August 2023 the Police Service of Northern Ireland published a spreadsheet in response to a freedom of information request that, through a pivot table, exposed the surname, initials, rank and role of all 9,483 officers and staff. In May 2024 the ICO announced it intended to fine the PSNI £750,000 and confirmed the £750,000 penalty in October 2024 (ICO) and, in a September 2023 advisory note, told public authorities to stop disclosing original source spreadsheets and to convert data to open formats such as CSV.
- Code execution: macro-enabled workbooks and add-ins are a long-standing initial access route (MITRE ATT&CK T1204.002 Malicious File) and a persistence route through Office add-ins (T1137.006). See the Macro Malware Guide.
- Credentials in files: connection strings, Access linked tables and scripts often hold database or API credentials in clear text (T1552.001 Credentials In Files).
- Parser risk in automation: systems that ingest spreadsheets automatically inherit parser flaws. CISA's Known Exploited Vulnerabilities catalogue lists CVE-2023-7101 in the Perl Spreadsheet::ParseExcel library, where number format strings from a file were passed to an eval.
- Regulatory reliance: where an EUC feeds financial statements or regulatory returns it becomes part of the control environment. See the SOX IT General Controls (ITGC) Guide and the BCBS 239 Guide. The PRA's model risk statement SS1/23 applies to models used to inform business decisions regardless of the technology they are built in, so a calculation in Excel is not exempt because it is in Excel.
Finding EUCs: discovery and inventory
ICAEW's 20 principles for good spreadsheet practice (2024 edition) opens with "Determine how much your organisation depends on spreadsheets and plan accordingly". Combine technical discovery with owner attestation, because scanning finds files but not which ones matter.
- Scan storage: file shares, SharePoint and OneDrive for .xlsm, .xlsb, .xlam, .accdb, .mdb, .pbix and script files, and for workbooks with external data connections. Record path, owner, last modified date and access count. See the Unstructured Data and File Share Security Guide.
- Follow the data flows: ask system owners which reports and uploads are produced from spreadsheets. Uploads into the general ledger, regulatory reporting tools and payment files are the highest-value finds.
- Map dependencies: Excel's Inquire add-in produces a Workbook Relationship Diagram showing links to other workbooks, Access databases, text files and SQL Server sources, and Workbook Analysis reports formulas, hidden content and warnings.
- Attest: each business area confirms its EUCs, names an owner and a deputy, and states what the EUC is used for.
- Record: an inventory entry holds name, owner, purpose, location, inputs and outputs, users, tier, last review date and replacement plan.
Tiering EUCs by risk
Tier on two axes: the impact of a wrong or unavailable result, and the complexity that makes errors likely. The thresholds below are NHI Mgmt Group recommendations; set your own against your materiality levels.
| Factor | Low | Medium | High |
|---|---|---|---|
| Use of output | Personal or team analysis | Management reporting, operational decisions | Financial statements, regulatory returns, customer pricing, payments |
| Financial or customer impact of error | Negligible | Below materiality threshold | At or above materiality, or affects customers directly |
| Data held | Public or internal | Confidential business data | Personal, special category or market-sensitive data |
| Complexity | Simple lists and sums | Lookups, multiple sheets | Macros, external connections, chained workbooks, manual overrides |
| Frequency and reliance | Ad hoc | Monthly | Daily or in a critical close or settlement process |
The highest score on any factor sets the tier, except where a risk committee formally accepts a lower tier with a reason.
Controls by tier
| Control | Low | Medium | High |
|---|---|---|---|
| Named owner and inventory entry | Yes | Yes | Yes |
| Stored on a backed-up, access-controlled location (not local disk) | Recommended | Yes | Yes, restricted to named users |
| Version control (versioned library or check-in) | No | Yes | Yes, with change log |
| Change control with independent review of logic | No | Significant changes | Every change, reviewed and approved before use |
| Input validation and reconciliation checks in the workbook | No | Key totals | Control totals, row counts and exception flags |
| Separation of preparer and reviewer | No | Recommended | Yes |
| Macro signing and trusted publisher | n/a | If macros used | Yes |
| Periodic access and design review | No | Annual | Quarterly or each cycle |
| Documented recovery and replacement plan | No | No | Yes |
- Integrity checks: ICAEW principle 17 is to build in checks, controls and alerts from the outset. In practice: row counts of imported data against the source, control totals that must reconcile, and a visible check cell that turns red. The PHE failure would have been caught by a row count comparison.
- Protection features are not security: Microsoft's own documentation says worksheet-level protection is not intended as a security feature. Use file location permissions, sensitivity labels and encryption for confidentiality, and use sheet protection only to prevent accidental edits. See the Microsoft Purview Information Protection Guide.
- Macros: keep the Microsoft 365 policy "Block macros from running in Office files from the Internet" enabled. For EUCs that need macros, sign the code and deploy the signing certificate as a trusted publisher, or use a tightly controlled trusted location; Microsoft notes that files in trusted locations bypass the Mark of the Web check, so control who can write there. See the Office Macro Blocking Guide.
- Data connections: connect with the user's own identity through integrated authentication rather than stored passwords, and give EUC data sources read-only, view-level database access.
- Safe publishing: before a spreadsheet leaves the organisation, export the needed data to CSV or PDF from a fresh sheet rather than sending the working file, as the ICO advises for disclosures. Run the Office Document Inspector to remove hidden sheets, rows, comments and metadata where the file format must be kept.
Where identity fits
EUCs often run under identities nobody reviews. A scheduled macro on a desktop runs as whoever is logged on, so it stops when that person leaves. An Access front end may connect to SQL Server through a shared SQL login whose password is embedded in linked tables. A script that pushes data to a SaaS API carries a personal API token. Inventory these as non-human access: replace shared logins with named or managed service accounts, move secrets out of files, and add EUC credentials to leaver processing. See the Service Account Security Guide and How to find secrets in Jupyter notebooks.
Remediate, rebuild or retire
ICAEW principle 4 asks whether a spreadsheet is a suitable tool at all. For each high-tier EUC record a decision:
| Option | Choose when | Trade-off |
|---|---|---|
| Control in place | Logic changes often, small user group, cost of rebuild outweighs risk | Ongoing review effort; risk never fully removed |
| Move to a governed self-service platform (BI dataset, low-code app) | Reporting or simple workflow, data already in central systems | Platform governance needed; skills shift to IT-supported tools |
| Rebuild as a strategic application or system feature | High volume, regulatory reliance, many users | Longest lead time and highest cost |
| Retire | Output no longer used or duplicated elsewhere | Need to confirm no hidden downstream consumer |
Small organisations can run a lightweight version: a single register, owners, storage on a versioned library and a second-person check on anything that reaches customers or the accounts. Large and regulated organisations usually need an EUC policy, a central EUC risk owner, tooling for discovery and change tracking, and reporting of high-tier EUC counts to a risk committee.
Implementation roadmap
- Policy and scope (month 1): agree the EUC definition, tier criteria, minimum controls and the risk owner. Pilot the definitions on one finance and one operations team.
- Discovery (months 1 to 3): scan storage, collect attestations, build the inventory. Expect the first scan to find far more files than matter; owner attestation narrows them.
- Tier and fix the critical few (months 2 to 4): tier every attested EUC, then apply high-tier controls first: move files to a versioned location, add reconciliation checks, name reviewers.
- Technical guardrails (months 3 to 6): confirm macro blocking policy, signing for approved macros, removal of stored passwords in connections, and sensitivity labels on high-tier files. Test macro changes with a pilot group before broad rollout and keep the previous policy settings documented for rollback.
- Change and review cycle (month 4 onwards): operate change control, quarterly reviews and replacement decisions for high-tier EUCs.
- Reduce (ongoing): track replacements and retirements so the high-tier count falls over time.
Detection and measurement
- New high-risk files: regular scans for new macro-enabled workbooks and Access databases on shares that are not in the inventory.
- Changes outside change control: version history or audit logs showing edits to high-tier EUCs without a linked change record. Spreadsheet Compare shows cell, formula and VBA differences between versions.
- Macro policy exceptions: growth in trusted locations, publishers or unblocked files.
- Outbound sharing: data loss prevention rules for high-tier EUCs sent externally or uploaded to personal storage. See the Data Loss Prevention (DLP) Guide.
| Metric | What it shows |
|---|---|
| Percentage of high-tier EUCs with owner, reviewer and current review date | Basic governance coverage |
| High-tier EUCs stored on local disk or personal storage | Availability and leaver exposure; target zero |
| Changes to high-tier EUCs without an approved change record | Change control effectiveness |
| EUC-related errors or incidents per quarter | Whether controls catch errors before they cause harm |
| High-tier EUC count trend and replacements completed | Whether dependency is falling |
| EUCs with credentials stored in the file | Secret hygiene; target zero |
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ATT&CK |
|---|---|---|---|
| EUC inventory and data mapping | ID.AM-02, ID.AM-07 | CM-8 | n/a |
| Risk tiering and ownership | GV.RM-01 | RA-3 | n/a |
| Change control and version history | PR.PS-02 | CM-3 | T1565.001 |
| Input checks and integrity of results | PR.DS-01 | SI-7, SI-10 | T1565.001 |
| Access to files and data sources | PR.AA-05 | AC-3 | T1552.001 |
| Macro and add-in control | PR.PS-01 | CM-3 | T1204.002, T1137.006 |
| Backup and recovery | PR.DS-11 | CP-9 | n/a |
Common failure patterns
- Silent truncation: an import or file format limit drops rows and nothing compares the count with the source, as in the Public Health England case.
- Sending the working file: a spreadsheet with pivot caches, hidden sheets or source data is shared externally instead of a clean extract, as in the PSNI disclosure.
- Key-person dependency: one analyst built and understands a critical workbook; when they leave, nobody can change it or explain its outputs.
- Trusted location sprawl: to make one macro work, a whole network share is made a trusted location, so every file there runs macros without checks.
- Hard-coded overrides: values typed over formulas to make a reconciliation balance, with no record of who did it or why.
- Shared database logins: Access or Excel connections use a shared SQL login with write rights, embedded in the file and never rotated.
Practitioner checklist
- Publish an EUC definition, tier criteria and minimum controls per tier, with a named risk owner.
- Scan storage for macro-enabled workbooks, Access databases and files with external connections, and reconcile against owner attestation.
- Give every high-tier EUC an owner, a deputy, an independent reviewer and a versioned, backed-up location.
- Add row counts, control totals and visible check cells to high-tier workbooks.
- Keep internet macro blocking enabled; sign approved macros and restrict trusted locations.
- Remove stored passwords and shared logins from EUC data connections.
- Share clean extracts (CSV or PDF) externally, never working spreadsheets.
- Record a control, rebuild or retire decision for each high-tier EUC and track it.
- Report high-tier EUC counts, changes without approval and EUC incidents to the risk committee quarterly.
Standards and references
- ICAEW: 20 principles for good spreadsheet practice (2024 edition)
- Bank of England PRA: SS1/23 Model risk management principles for banks
- ICO: Advisory note to public authorities on disclosing spreadsheets
- Microsoft Learn: Macros from the internet are blocked by default in Office
- Microsoft Support: What you can do with Spreadsheet Inquire
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- Infosecurity Magazine: PSNI faces £750,000 data breach fine
- ICO: What price privacy? Poor PSNI procedures culminate in £750k fine (October 2024)
- The Register: Excel error behind missing COVID-19 cases in England
Related NHI Mgmt Group resources: Low-Code and No-Code Application Security Guide · Office Macro Blocking Guide · SOX IT General Controls (ITGC) Guide · Data lineage, data quality and data contracts as security controls