It’s time for Financial Services to escape spreadsheet chaos
By Avocado Consulting and Clear Dynamics
Across Australia’s financial services sector, organisations are confronting a reality they can no longer ignore: too many critical business processes still run on spreadsheets. With APRA’s CPS 230 Operational Risk Management standard now in effect, attention is shifting to how organisations sustain compliance in practice. As expectations tighten, reliance on unmanaged spreadsheets within critical processes is coming under increased scrutiny – exposing operational, data and governance risks that can no longer be ignored.
In a whitepaper released by Clear Dynamics and Avocado Consulting, it finds that 90% of organisations continue to rely on spreadsheets for critical business processes, despite the operational, security and compliance risks this creates.
In an era defined by automation, intelligence, security risks and cloud scalability, it’s astonishing how many core functions – pricing models, reconciliations, risk calculations, customer workflows, unit pricing, actuarial assumptions, regulatory reporting and lending decisions – still depend on tools never designed for enterprise resilience.
This is not a minor productivity issue. Under CPS 230, it is a direct compliance exposure.
Spreadsheets were built for flexibility, not governance. They are brilliant for prototyping but brittle at scale. Once embedded into critical operations, they become what we call the spreadsheet trap – easy to start, almost impossible to unwind, and ultimately a barrier to accuracy, compliance and growth.
APRA has long highlighted the risk of end-user developed/configured tools (EUCs). CPG 234 (Information Security) explicitly states that regulated entities must identify, classify and assess risks arising from EUCs, particularly where they influence business decisions or support critical operations.
Yet, organisations don’t need a regulator to tell them spreadsheets are failing. When spreadsheets underpin material processes, they introduce a well-known pattern of weaknesses, each silently driving revenue, risk or regulatory outcomes without any formal oversight, including:
- No structured testing or lifecycle management, meaning errors can persist unnoticed for months or years.
- Poor version control, with multiple conflicting copies circulated across teams and no clarity around which file is the current source of truth.
- Limited access control, audit trails or change history, preventing organisations from evidencing who made changes or why decisions were made.
- Key-person dependency, where critical business logic sits in one workbook understood by a single individual.
- Hidden logic and undocumented assumptions, embedded in formulas, macros and manual overrides that bypass standard governance.
- Data integrity issues caused by manual inputs or re-keying, leading to stale, inconsistent or contradictory datasets across departments.
- Cross-department inconsistencies, where different teams work from different versions of data extracted at different times.
- The “human API” problem, where staff manually move data between systems because spreadsheets cannot integrate or automate workflows.
- Sensitive data exposure, as spreadsheets are copied, emailed, downloaded and stored without proper access controls or encryption.
For financial services organisations, these weaknesses sit directly at the intersection of operational risk (CPG 230), information security (CPG 234) and data risk (CPG 235) and they undermine the organisation’s ability to meet both the intent and the practical expectations of CPS 230.
With Australia’s regulatory environment tightening – from CPS 230 to the Privacy and Other Legislation Amendment Act 2024 – transparency, control and auditability are no longer optional. Regulators expect organisations to demonstrate resilience across their critical operations, and spreadsheets simply cannot meet those expectations at scale.
While APRA is not banning spreadsheets outright, under CPS 230 and CPG 230, the use of uncontrolled EUCs in critical operations is increasingly indefensible.
Under CPS 230, APRA requires regulated entities to demonstrate:
- Resilience of critical operations
- Documented processes, controls and audit trails
- Clear accountability for operational risks
- Technology and data governance that withstands scrutiny
- Evidence that material control weaknesses are remediated
None of these requirements can be met where spreadsheets underpin key operations.
With CPS 230 already in effect, APRA expects entities to be operating in alignment with the standard now. However, the next major milestone is imminent:
By 1 January 2026, entities must:
APRA also expects regulated entities to:
Identify critical processes and associated spreadsheet/EUC dependencies as part of their operational risk profile.
Assess and remediate material control weaknesses on an ongoing basis, not at a single deadline.
Progressively transition high-risk, spreadsheet-based workflows into governed, resilient systems as part of BAU risk management.
Spreadsheets simply cannot provide the level of confidence regulators now expect.
But the risk story is only half of the picture.
The opportunity cost is equally profound. Teams spend up to 40% of their time fixing errors, reconciling conflicting data, or rebuilding logic that should live in a system, not a spreadsheet cell. Organisations routinely find themselves hiring people to “feed the spreadsheet machine” instead of investing in actual business growth or customer innovation.
Why organisations delay action – even when the risks are clear
Despite the rising regulatory pressure, many financial services organisations struggle to move away from spreadsheets because they are so deeply embedded in day-to-day operations. Over years, entire processes have been built around them, with interlinked formulas, undocumented rules, and workarounds understood by only a few individuals. Leaders often fear that replacing these spreadsheets will require significant time, budget and organisational change – and that the change management burden will outweigh the benefits.
This perceived disruption frequently drives inaction. Organisations continue to “make do,” even as operational risk compounds, because the task of untangling spreadsheet dependencies feels overwhelming. Yet the long-term cost of maintaining this status quo – in errors, missed reporting obligations, risk incidents, and regulatory exposure – is far higher than the investment required to modernise.
This is where Avocado Consulting and Clear Dynamics see a transformative opportunity for the sector.
Clear Dynamics’ AI-powered platform, aieos, ingests the business logic trapped in spreadsheets and rapidly converts it into secure, scalable enterprise applications – digitising the process, preserving institutional knowledge, and integrating seamlessly with existing systems. It means organisations can keep the intelligence they’ve built over years while eliminating the fragility that holds them back. Because the transformation leverages existing business logic rather than replacing it, organisations benefit from rapid uplift with minimal disruption and low change-management overhead, allowing teams to modernise without disrupting familiar workflows.
Avocado complements the implementation with deep experience in operational resilience, quality engineering and secure delivery. Together, both organisations can help financial services leaders break free from spreadsheet chaos using a clear blueprint: identify high-risk spreadsheet processes, uplift them into governed systems, and embed modern controls that support compliance, scalability, and innovation.
The question is not whether spreadsheet processes should be transformed, but when. Every day an organisation waits is another day of unnecessary exposure – another opportunity for error, breach, delay, or customer impact. The cost of inaction is already far greater than the cost of modernisation. To explore more about Spreadsheet risk, read our Escape Spreadsheet Chaos Whitepaper
The future belongs to organisations that build intelligent, integrated, audit-ready systems – not those that continue to run mission-critical operations on fragile files.
With Avocado and Clear Dynamics now partnering to help the sector take this step, financial services leaders have a clear path forward: unlock the logic inside your spreadsheets, modernise with confidence, and build a data foundation ready for AI, automation and the next decade of growth. Read more about this partnership announcement. To explore how we can help, read our partner page.
