A Single Unsupervised Spreadsheet Is the New Single Point of Failure

Risk Management & Internal Controls

A Single Unsupervised Spreadsheet Is the New Single Point of Failure

Why the backbone of global tax strategy often rests on a single memory and an Excel file last saved in .

84%

Financial models with >1,400 rows maintained without a manual

The industrial scale of unwritten logic in corporate financial modeling.

Eighty-four percent of all corporate financial models containing more than 1,400 rows are maintained by a person who has no intention of ever reading the manual they never wrote. It is a terrifyingly specific number, one that suggests a level of industrial coordination we usually reserve for things like electrical grids or the logistics of a mid-sized invasion. We tend to believe that the larger an organization becomes, the more it replaces the whims of individuals with the cold, hard certainty of process.

But the reality is that the higher you climb in a corporate tax structure, the more you realize that the multi-billion-dollar transfer pricing position-the very backbone of the group’s global tax strategy-is often held together by little more than the stubborn memory of a single Senior Manager and an Excel workbook that hasn’t been saved under a new version name since .

It is a structure that is both remarkably robust-having survived four major audits and a change in CFO-and fundamentally terrifying, which is to say it is the exact opposite of what the internal audit department thinks it is looking for.

Sociopathic Precision and Unwritten Rules

I spent most of my morning watching a silver sedan slide into a parking spot I had been signaling for over three minutes. It was a clean theft, executed with a level of sociopathic precision that made me realize how much we rely on unwritten rules of decency to keep the world turning.

We assume people will see the blinker; we assume the person who built the intercompany charging model didn’t use a circular reference to “fix” a rounding error in the Hungarian subsidiary’s books. When those assumptions fail, the immediate reaction isn’t usually a fix. It’s a frantic search for the one person who knows how to navigate the wreckage.

Earlier in my career, I was a loud advocate for the “brilliance of the artisan.” I used to believe that documentation was a crutch for the uncreative-a way for mid-tier bureaucrats to shackle the high-performers who actually understood the nuances of the OECD guidelines. I was wrong. I was deeply, embarrassingly wrong, and I realized it the day I had to defend a set of documentation I hadn’t written for a model I didn’t understand. I had mistaken the absence of a paper trail for the presence of mastery, when in fact, it was just a slow-motion collapse of institutional memory.

The Existential Threat at 9:14 AM

The query arrived at on a Tuesday, carrying with it a deadline from a tax authority that doesn’t believe in the concept of a “grace period.” It was a standard request: explain the rationale for the year-end adjustments in the Southeast Asian corridor. It should have been a thirty-minute exercise. You open the file, you look at the “Adjustments” tab, and you read the logic.

Except the “Adjustments” tab in the Group TP Masterfile contains four hard-coded overrides that seem to have been calculated on a different planet. There is no formula. There is no link to a source document. There is only a cell comment, dated , that reads: “ask Rob before changing anything here.”

Rob left the company in March.

The comment remains. The numbers remain. The clock remains. And the “Rob” in this scenario isn’t just a person; he is a symbol of the “Key-Person Risk” that every HR department lists on their risk register under “Retention,” but which actually belongs on the “Controls” register under “Existential Threat.”

The Mobility of Memory

We treat the loss of a specialist as a talent acquisition problem. We talk about how hard it is to find someone with of niche experience in intangible property valuation.

17,966

Live Roles Tracked

4,900

In-House Positions

We look at platforms like taxjobs.ai to see who is currently in the market, tracking the 17,966 live roles and the 4,900 in-house positions to gauge the velocity of the talent pool. But finding a replacement for Rob is only half the battle.

The other half is the realization that Rob didn’t just take his talent with him-he took the “why” behind the numbers. He took the context that turned a spreadsheet from a pile of math into a defensible legal position.

Accumulating the Debt

When a model works for years without failing, we stop questioning it. Success is the greatest enemy of documentation. If the numbers are accepted by the auditors, and the tax return is filed without a hitch, the pressure to write down the logic evaporates. Why spend documenting a process that already works perfectly?

We tell ourselves we are being efficient. In reality, we are just accumulating a “transparency debt” that will eventually be called in with interest. The exposure stays invisible because naming it implies that someone should have fixed it .

To admit that the group’s global tax position is dependent on a single person’s memory is to admit a failure of governance. So, we call it “specialized expertise.” We call it “high-impact contribution.” We give Rob a bonus and a nice title, hoping he never looks at his LinkedIn messages, all while the underlying fragility of the system continues to calcify.

Adrian F.T. – Algorithm Auditor

This is where my perspective as an algorithm auditor-Adrian F.T., if you’re keeping track-gets prickly. I look at these models not as financial tools, but as brittle scripts. If a piece of code had a hard-coded override that said “Check with Dave,” no CTO in their right mind would sign off on it.

Yet, in the tax and finance world, we accept this as part of the “judgment” inherent in the profession. There is a specific kind of silence that happens in a boardroom when a director asks a question about a specific figure and the only person who can answer it is currently thirty thousand feet over the Atlantic on their way to a hiking trip in the Andes. It’s not just an awkward silence; it’s the sound of a billion dollars of enterprise value suddenly feeling very light.

Fragility Earned in Peace

The mistake we make is thinking that the “Rob” problem is about Rob. It’s actually about the environment that allowed Rob to become a load-bearing pillar without a backup. We create these silos because they feel safe. It’s comforting to have one person who “knows the answer.” It’s efficient until it isn’t.

Fragility isn’t something that happens to a system; it’s something a system earns through prolonged periods of peace. When things go well, we stop testing the boundaries. We stop asking “what if Rob gets hit by a bus?” or, more realistically, “what if Rob gets a 35% raise from a competitor and a signing bonus that pays off his mortgage?”

Fragile System

Rob + “Memory”

Robust Asset

Process + Documentation

I recall a specific instance where a massive European conglomerate had to restate of earnings because a single Excel macro, written by a summer intern in , had a “minus” sign where a “plus” sign should have been. The intern was gone. The manager who supervised the intern was gone.

The only reason it was discovered was that a new hire-someone who hadn’t been indoctrinated into the “just trust the file” culture-actually tried to recreate the math from scratch. That new hire was me. And I remember the feeling of cold dread when the numbers didn’t tie.

I also remember the reaction of the Head of Tax when I showed him. He didn’t thank me. He looked at me with the weary eyes of a man who had just been told his house was built on a sinkhole. He knew that fixing it meant admitting it had been broken under his watch.

The Black Box Problem

This is the true cost of the “one person, one spreadsheet” model. It’s not just the risk of the person leaving; it’s the psychological barrier it creates against improvement. Once a model becomes too complex or too poorly documented for anyone else to understand, it becomes a “black box.” And humans are biologically programmed to fear looking inside black boxes.

We need to stop framing documentation as a compliance task. It is a risk mitigation strategy. The irony of my parking spot incident this morning is that the guy who stole it probably thinks he won. He’s in the spot, he’s closer to the door, and he saved himself sixty seconds of circling.

But he’s also now the guy whose car I’m staring at while I write this. He’s created a conflict he doesn’t even know exists yet. He’s “efficient,” but he’s also exposed. The same goes for the “Rob” of your organization. He’s efficient. He’s the guy who gets it done. He’s also the single point of failure that could, under the right pressure, turn a routine audit into a corporate catastrophe.

Institutional Knowledge vs. Liability

If you find yourself looking at a cell comment from and realizing the person mentioned is no longer in your building, don’t just hope the tax authority doesn’t ask. Start the excavation. It will be painful, it will be expensive, and it will involve a lot of late nights staring at rows that make no sense.

Institutional knowledge is only valuable if it belongs to the institution. If it belongs to an individual, it’s just a liability in a fancy suit.

And in a market where talent is as mobile as it is today, relying on a single memory is the most expensive “savings” a company will ever make. It is time we treated our spreadsheets with the same level of skepticism we reserve for the people who steal our parking spots.

Both are operating on a set of rules that only they understand, and both are eventually going to cause a collision. But it is the only way to turn a fragile memory back into a robust corporate asset.

AF

Adrian F.T.

Algorithm Auditor & Forensic Specialist

You may also like...