Insights

Executive Briefs on EUC risk, internal audit exposure, and regulatory compliance for Financial Services.

EUC Dependency Map and Risk Assessment documents
Excel Models Executive Brief 001

The Hidden Cost of Legacy Excel Models

Undocumented spreadsheets don't just carry operational risk — they carry regulatory and migration risk that compounds silently over years.

Read the Brief →
Audit meeting with EUC assessment documents and risk registers
Internal Audit Executive Brief 002

What Your Auditors Will Find — Before They Find It

Internal audit teams are finding EUC governance gaps with increasing frequency. The eight questions they ask — and the answers most organisations cannot give.

Read the Brief →
Regulatory reporting and compliance documents
Regulatory Reporting Executive Brief 003

The SS1/23 Gap Most Banks Haven't Closed

Most banks addressed their formal model inventory. Far fewer addressed the EUC estate sitting beneath it — the gap that remains and what it means for regulated firms.

Read the Brief →
Data lineage diagram and risk reporting documents
Data Lineage Executive Brief 004

The Data Lineage Gap BCBS 239 Was Supposed to Close

More than a decade after BCBS 239, most banks still can't trace a number in a risk report back to its source. Here's where the chain actually breaks — and why it's usually a spreadsheet.

Read the Brief →
Executive reviewing a financial spreadsheet model on a laptop
Decision Risk Executive Brief 005

The £6 Billion Formula Error: Why Nobody Checks the Spreadsheet

No regulation is needed for an unvalidated spreadsheet to drive a catastrophic decision. Three real, documented cases — and why the same conditions exist in most organisations today.

Read the Brief →
An old legacy laptop still running quietly in a modern server room
Migration Risk Executive Brief 006

The EUC Nobody Migrated

A migration programme closes with a status of "complete." Somewhere behind it, a handful of spreadsheets are still quietly running — orphaned, unowned, and invisible to every framework that assumes the migration finished.

Read the Brief →