Excel Competency for the Professional Accountant: Advanced Applications, Controls, and Audit Add-ins

An interview by the authors with one of the largest corporate tax departments in the country (over 55 full-time tax professionals at corporate headquarters) discovered that almost all financial statements used for tax compliance were prepared in Excel. This tax department describes themselves as the largest corporate tax department west of General Electric headquarters. Data was regularly moved from Enterprise Resource Planning (ERP) systems and database applications into Excel spreadsheets. Anecdotal evidence suggests this volume of data and transaction analysis appears to be more of the norm than an exception. Accounting spreadsheet applications have evolved into high volume data repositories using complex formulas while the evidence suggests that error rates have not improved (Panko 2008) during a time when regulatory demands on the accounting profession have increased.

Few accounting professionals would disagree that Excel is the default software for financial analysis and journal entry preparation in the United States and perhaps the world. Although no quantitative research is available to substantiate the usage of Excel, Microsoft's extensive changes to Microsoft Office 2007, including the expansion of capacity to over one million rows in Excel 2007, was in response to their evaluation of market demand and evidences corporate reliance on Excel for data analysis.

Research (KPMG 2007) identifies that Excel is used almost twice as often as its nearest competitor for computer assisted audit tools (CAATs), Audit Command Language (ACL), and nearly three times as often as other alternatives, e.g. Microsoft Access and Interactive Data Extraction and Analyses (IDEA). If the goal is to deliver curriculum that conforms to professional accounting practice, we believe an Excel curriculum embedded within an AIS course, as designed and implemented by the authors, provides value to both accounting graduates and employers.

In addition to widespread usage of Excel, research by Panko (2008) has documented high error rates (over 90% in some cases) in Excel accounting applications in large accounting practices, with little evidence of improvement over the last decade. In particular, Panko (2008) documents the following among the larger audit samples of spreadsheets:

• Coopers and Lybrand found an error rate of 91% of all spreadsheets that contained more than 150 rows in 1997.

• KPMG found an error rate of 91% in 1998.

• Lawrence and Lee found an error rate of 100% in 2004.

• Powell, Lawson, and Baker found an error rate of 64% in 2007.

Despite most investigations not documenting the type of errors detected, Powell, Lawson, and Baker noted that among the ten spreadsheets with non-zero impacts for which error size was reported, all ten spreadsheets had errors that exceeded $100,000, six spreadsheets had errors exceeding $10 million, and one spreadsheet had an error exceeding $100 million.

Though no quantitative research is available to identify the scope and nature of failed controls in spreadsheets used for financial reporting in public companies, the Securities and Exchange Commission (SEC) filings frequently describe substantive changes in those same organizations in connection with failed software application controls. Thus, the career implications are very real for companies and accountants producing spreadsheets without appropriate controls to reduce errors and meet compliance standards.

Given the prevalence and usage of Excel by organizations of all sizes, we developed and adopted an AIS curriculum that initiates the topic by teaching a functional competency of Excel to students. However, a detailed understanding of Excel alone is not sufficient for preparing accounting students for the work environment that awaits them. Thus, after functional competency is established, we then use the Excel platform to detail an appropriate internal control implementation that conforms to the requirements of COSO, COBiT, and SOX. Furthermore, the curriculum introduces students to audit add-ins for Excel and requires them to utilize such tools to understand and evaluate application controls that are designed to meet the requirements of SOX compliance. The application of this curriculum resulted in increasing students' selfefficacy and their marketability to potential employers, as the majority of students became certified in Excel in addition to completing the AIS course. Additionally, the redesign of the AIS course to focus on Excel competency, which is detailed below, resulted in significantly better teaching evaluations.

This paper includes several elements and discussions. The first section is a discussion of the course objectives and how to establish functional competency of Excel in our students. Next is a detailed account of how the AIS coursework moves beyond general Excel functions and an overview of the accounting applications covered in conjunction with Excel. The third section includes the authoritative accounting standards that are used to support the presented curriculum. The conclusion then discusses the benefits and limitations of this curriculum.

The Committee of Sponsoring Organizations (COSO) of the Treadway Commission recommended the Enterprise Risk Management – Integrated Framework (ERM) to manage and reduce risks, to be applicable to all industries, and to encompass all types of risk including spreadsheet risk (COSO 2010). COBiT 4.1 is a set of best practices that comply with SOX and applies to the design, development, and maintenance of software applications including enterprise spreadsheets. The standards described by COSO and COBiT serve as examples for other applications in the enterprise and directly apply to Excel spreadsheets. Without applying these standards, an Excel curriculum for this course becomes a curriculum useful for all disciplines, including marketing, human resources, operations, and other applications in the enterprise.

Among the requirements for IFRS implementation, there are frequent mandates for more detailed disclosures, with the requirements of finer granularity in the data, and increased demands on the retrieval and reconciliation of older financial data (Steele 2010). More importantly, IFRS implementation increases the need for application controls to ensure that the security, authentication, and access control mechanisms remain sufficiently robust to meet regulatory requirements. Experience indicates that information technology costs are generally over 50 percent of the costs of IFRS conversion and will affect all industries (Fisher 2010). With European conversions, IFRS information systems implications were often underestimated with the outcome of reliance on manual changes and spreadsheets, which led to errors, costly rework, and other unintended consequences (Difazio and Gannon 2010). It is likely that spreadsheets will become a tool during the course of implementation and may be overused, e.g. hundreds of thousands of rows of data in one spreadsheet, to respond to IFRS reconciliation and implementation requirements.

Accounting graduates from this large four-year accounting program enter the Big Four as well as several mid-sized and regional accounting practices. In the recent past, alumni and accounting firms have complained to the accounting department about accounting graduates not being prepared in two specific areas. One of the two specific areas was the inability of accountants to effectively implement, manage, and maintain Excel spreadsheets to a professional accounting standard. A second complaint was the lack professional writing skills by some graduates and is beyond the scope of this paper and the Excel curriculum. As part of an ongoing effort to improve the accounting program this Excel curriculum was adopted in 2007 and has since evolved to its current status as described in this paper.

In the course of designing the content for this Excel curriculum, several objectives were identified:

1. Functional competency in Excel 2007 including intermediate and advanced topics

2. An introduction to risk assessment and controls for Excel applications

3. An introduction to audit applications using an Excel add-in, ActiveData

4. An introduction to XML and how Microsoft Office 2007 has integrated XML compatibility.

The first segment of the curriculum, Excel skills, uses the text, Microsoft Excel 2007, Exam 77-602, (ISBN: 13 978-0-47006949-3) published by John Wiley & Sons (2008). This text supports a broad audience that may include learners in marketing, operations, finance, accounting, and other disciplines. This John Wiley text has a dual purpose in that it also prepares the students for Microsoft Certification for Excel 2007, if they chose to pursue that credential. (A new text will be released by Wiley in 2011 to provide equivalent content for Excel 2010.)

The complete title for this particular Microsoft certification is Microsoft Certified Application Specialist: Using Microsoft Office Excel 2007 (Microsoft Learning 2008). This certification uses an exam entitled Microsoft Excel 2007, Exam 77-602. Extensive support is available for this text including high quality PowerPoint slides, Excel exercises with solutions, and test bank questions in several formats. PowerPoint slides and other material used in the class is posted online and available for student access. The John Wiley text is also supported by Wiley-Plus (2009), which offers online exercises to prepare for the Microsoft Certification exam. The online offerings include videos of more complex Excel offerings, e.g. pivot tables, and are particularly useful for students who have low familiarities with Excel.

It is not unusual to find three to five students in a class of thirty-five students who have almost no experience in Excel. On the other end of the spectrum, three to five students will either be “power users” or perceive themselves to be “power users.” The challenges from a teaching perspective are not to overwhelm those students with almost no experience and to keep advanced students engaged while elementary material is covered in class.

The eleven chapters in Microsoft Excel 2007, Exam 77-602 (2008) are organized into “labs”. Each lab can be completed in one class sitting, ranging in time from one hour to one-and-a-half hours. The labs and their respective topics and chapters are:

• Lab 1: 1.5 hours

  • Chapter 1: Excel Essentials

  • Chapter 2: Creating and Editing a Workbook

  • Chapter 3: Formatting Cells and Ranges

• Lab 2: 1.5 hours

  • Chapter 4: Worksheet Formatting

  • Chapter 5: Managing Worksheets

  • Chapter 6: Working with Data

• Lab 3: 1.5 hours

  • Chapter 7: Using Basic Formulas and Functions

  • Chapter 8: Using More Advanced Functions

• Lab 4: 1.5 hours

  • Chapter 8: Using More Advanced Functions

  • Chapter 9: Creating Charts from Your Data

• Lab 5: 1.5 hours

  • Chapter 10: Adding Pictures and Shapes to a Worksheet

  • Chapter 11: Securing and Sharing Documents

The steps for each chapter include "hear, see, do, and feedback" involvement by the students:

1. A walk through in the classroom of Excel functionality

2. A completion of one or two Excel exercises at the end each chapter

3. An in-class review of 20 to 40 test questions on each chapter

The in-class review of 20 to 40 test questions for each chapter accomplishes several objectives including (1) immediate feedback on what the students learned, (2) preparation for two inclass quizzes worth 50 points each, and (3) preparation for the Microsoft Certification test. The two in-class quizzes include fill in the blank questions and worksheet exercises (see Exhibit 1). The two in-class quizzes have up to forty questions and include four to five exercises designed to press the students for time in a 1.5 hour lab. Approximately 50% of the students are able to complete the quizzes within the 1.5 hour lab. Students have complete on-line access to all material through Microsoft, their Wiley text, and the help function on Excel.

The first four chapters are covered in two labs as this material can be covered rapidly by intermediate and “power users.” Working with Data, Using Basic Formulas and Functions, Using More Advanced Functions, and Securing and Sharing Documents are particularly relevant to accounting majors and require more class time.

In addition to the John Wiley text, exercises from the Journal of Accountancy (AICPA 2010) are integrated to customize the course content to accounting. Exercises from the Journal of Accountancy shift the course emphasis to accounting from the broader audiences of marketing, operations, finance, or another audience addressed by the Wiley text. Each Journal of Accountancy article presents an accounting-related issue and a mechanism or control within Excel that either mitigates risk or enhances productivity. Many of these articles are supported at the Journal of Accountancy website with Excel spreadsheets that can be downloaded. That is, each article provides examples of how to use Excel to strengthen controls and increase productivity and provides detailed instructions that can be rehearsed by students in the lab. A detailed list of the Journal of Accountancy articles that are used to strengthen controls is presented in Table 1, and Table 2 provides the list of articles that address mechanisms to increase productivity.

The exercises from the Journal of Accountancy that have real world accounting applications that can impact productivity and controls for the professional accountant include the following:

• Using Vlookup tables for bank reconciliations

• Using Cell Names for calculations in arrays and other applications

• Breaking large Excel formulas into smaller formulas for assurance of outcomes

• Suppressing a cell display whose formula calculates a zero

• Using data validation tools in Excel for data entry

• Importing delimited files into Excel

• Finding comments and other attributes in an Excel spreadsheet

A third quiz (see Exhibit 2) worth 40 to 50 points requires the completion of 10 to 12 Excel spreadsheet exercises that include both advanced Excel applications and Journal of Accountancy exercises that require students to apply the articles described in Table 1 and Table 2. Similar to the first and second quizzes, the third quiz is designed to limit available time. And similar to the first and second quizzes, students have full access to on-line resources to simulate a work environment. Before the students are given the third quiz, the instructor should walk through all advanced Excel exercises and the Journal of Accountancy exercises to be included in the third quiz. The worksheets are prepared in advance with specific directions included on the worksheet themselves. The quiz uses worksheets that have been assigned from previous material from the Wiley text or from exercises covered in the Journal of Accountancy. When the class period starts, the students download the workbook from the class server, enter a password, and begin the quiz. At the end of the quiz, students submit the completed workbook to an email address or a website that enables uploads to a drop box. Students who have not been keeping pace with the curriculum will typically do very poorly on this quiz.

Extra credit is available to students as an incentive to successfully complete the Microsoft Certification test. As an added incentive, the students are partially reimbursed ($50) for their expenses incurred in connection with Microsoft Excel Certification. The total cost for each Microsoft Certification test is $75, which includes one test retake. A lower price of $65 is available without a retake. In the spring semester of 2010, with 57 students in AIS in two separate sections, 50 (or 88%) students passed Microsoft Excel Certification, and 12 (or 21%) students passed Microsoft Access Certification. Additional reimbursement with similar terms was made for students who wished to take the Microsoft Access Certification test. Since the Excel Certification was supported by practitioners and the accounting department, the instructor of the course utilized demanding quizzes and tests that typically yielded lower scores. As such, the Excel Certification incentive provided a sometimes necessary mechanism for students to achieve an acceptable grade.

The most challenging aspect of the Microsoft Certification exam is the rapid pace, which challenges those students who perceive themselves as “power users”. The certification test requires the completion of 18 exercises in approximately 50 minutes. Most students are not prepared for the pace of the exam, as approximately only half the students pass on the first attempt. Assuming the certification test considers the speed of Excel execution as a desirable attribute, the takeaway message for the students is that the pace of Excel execution in career situations must be substantially faster than what is typically expected in the classroom.

In addition to the assignment of the Journal of Accountancy articles, the course emphasizes the accounting aspects and implications of Excel through a case assignment on controls. The case study on controls uses:

• a whitepaper, “The Use of Spreadsheets: Considerations for Section 404 of the Sarbanes-Oxley Act” (PwC 2004);

• a second whitepaper, “Spreadsheet Compliance in the 2007 Microsoft Office System,” Microsoft Office (2009);

• a paperback text, Spreadsheet Check and Control by Patrick R. O'Beirne (2005).

The PwC whitepaper has been used by auditing and consulting firms to evaluate SOX controls. It identifies a body of practices that includes both application and general information technology controls. Microsoft addressed regulatory compliance in Excel 2007 with enhanced control features and published this whitepaper before the release of Office 2007. Patrick R. O'Beirne (2005) describes Spreadsheet Check and Control as forty-seven practices to prevent errors, detect fraud, and save your job. Some of the material overlaps from each of the three sources, but each source adds its own perspective to accounting controls for Excel spreadsheets.

Integral to an assigned case study, students are required to run an assessment based on an article from the Journal of Accountancy, "Ferret Out Spreadsheet Errors, Use Excel's Tools to Uncover and Correct Formula Problems" (Simkin 2004). The students are required to (a) complete a risk assessment; (b) identify five to six specific controls within the twelve categories of controls described in The Use of Spreadsheets: Considerations for Section 404 of the Sarbanes-Oxley Act (PwC 2004); and (c) identify the top three and bottom three controls that the students would recommend for this particular case. Those twelve categories of controls that the students must consider include:

1. Access Control

2. Input Control

3. Security and Integrity of Data

4. Documentation

5. Back-up

6. Archiving

7. Segregation of Duties

8. Development Life Cycle

9. Change Control

10. Version Control of the Excel Workbooks

11. Logic Inspection of the Excel Workbooks

12. Overall Analytics in the Excel Workbooks

As part of the case study, a SOX presentation by an audit director from a local or regional accounting practice is recommended, but not required, to develop this curriculum, as actual field experience significantly reinforces the authoritative literature and brings the content to life. For this course, a project director with a national consulting organization, who completed a SOX compliance evaluation of over 1,200 Excel spreadsheets with Fortune 100 clients during the SOX compliance testing process, presented his risk assessment and evaluation of SOX controls in the class (see Exhibit 3). The entire group of 1,200 worksheets was being used in the course of financial reporting for one quarter. The significant comments offered by the project director include those relating to

• the necessary grouping of 1,200 spreadsheets into low, medium, and high risk to make the compliance evaluation manageable;

• the misuse of Excel, as spreadsheets were in some cases data repositories for large mainframe downloads whose data should have been manipulated in mainframe queries;

• inconsistent end user knowledge of Excel, which added an overlay of compliance risk for the organization;

• inconsistent organizational use of large complex worksheets that were exceedingly difficult to assess for accurate content and output;

• absence of even basic controls such as passwords;

• an eventual attainment of organizational standards that set up worksheets with input and output formats;

• the importance of change management controls in Excel applications including formal sign-off of approved changes.

Perhaps the most significant message from the project director was that very substantive (and material) financial analyses and journal entries are being formulated on Excel spreadsheets and that material financial statement errors can be traced to spreadsheets. The comments from the project director were consistent with the findings of Panko's (2008) research that documented widespread errors in accounting practices.

The final exam or final Excel quiz includes content that integrates questions on Excel regulatory compliance (see Exhibit 4). After completing and submitting Part 1 of the final exam, students go on-line to access Part 2. Students download a worksheet from a class server, are administered a password, and receive access to the spreadsheet. The test content can also be administered as a quiz that is separate from the final exam. Like other Excel quizzes in this class, all content is available on-line. The Microsoft paper that is the subject of this quiz is also available on-line. It is unlikely the students will do well on this quiz if they have not reviewed the paper prior to the final exam or quiz.

CAATs for data extraction and analyses include Microsoft Excel, Microsoft Access, ACL, and IDEA (KPMG 2007). Types of computer assisted audit tools include word processing, spreadsheets, database queries, integrated audit software, custom reporting software, and real time testing programs. Historically, problems with accessing data have been major barriers to using CAATs. As software and technology have evolved, several issues have been addressed including

• technology advancements to reduce technical problems and issues regarding data access;

• the reduced requirements for specialized technology personnel;

• audit software that can read and analyze most data formats;

• personal computers that can handle large volumes of data and run analyses at very fast speeds;

• reduced access to data as primarily one of reluctance by management, not a technology issue.

Research identified that Excel was used almost twice as often as its nearest competitor, ACL, and nearly three times as often as other alternatives, e.g. Microsoft Access and IDEA 9KPMG 2007). Excel 2003 has the capacity for 65,536 rows, 256 columns, and easy to use built-in analytical functions. Substantive improvements have been made during the last several years for all software tools, including Excel, with the release of Microsoft Office 2007.

Excel 2007 has the capacity for over one million rows and 16,000 columns, along with many other limit increases; it substantially increases the sizes of worksheets that can be built compared to earlier versions of Excel (Williams 2006). A single worksheet in Excel 2007 can contain over 1,000 times as many cells as earlier versions. Excel 2007 introduced a number of features to handle the capacity increase, such as the ability to use more than one processor at a time for calculations. This can substantially reduce worksheet calculation time. However, the most important factor that influences Excel calculation speed is still the way the worksheet is designed and built.

An Excel add-in, ActiveData, was used to demonstrate the audit capabilities of Excel. The functionality of ActiveData (a 30 day free copy is available at www.informationactive.dom) resembles ACL and IDEA including tools to summarize or group data, identify gaps, age data, perform strata-type analysis and provide descriptive statistics. Similar to ACL and IDEA, Benford's Law is supported in ActiveData. ActiveData has enhanced worksheet commands to merge sheets, match sheets, compare sheets, query sheets, split sheets, and sort sheets. An ActiveData lab uses large accounting files in excess of 10,000 rows to support the audit analysis and queries. ActiveData provides not only an audit application, but a real sense of data manipulation using larger files which would be more typical of a real world setting.

Since XBRL is an application of XML, students must understand the core concepts of XML before a meaningful discussion of XBRL can occur. Microsoft Office 2007 has robust support for XML throughout all its applications, including Excel, Word, Access, and PowerPoint. The concept of XML tagging is demonstrated in class using paper and pencil with a simple exercise to create tags for a student resume. The naming flexibility separates XML from Hypertext Markup Language (HTML) and sets the stage for XBRL. Once the concept of tagging and the associated rules for XML have been reviewed using paper and pencil, an XML file that contains all of the statistics for all major league teams for the 1998 season in professional baseball is imported into Excel. With the import of this XML file into Excel, a table can be created with over 1,200 rows of major league baseball data from the 1998 baseball season that can be easily manipulated and analyzed. Students are frequently impressed with the portability and small size of XML files that can be used to store and transfer complex and voluminous data. XML is an easy concept to test; a final exam question is included on XML requiring students to identify key concepts associated with tagging for their XML resumes (see Exhibit 5).

The Interactive Disclosure staff at Securities Exchange and Commission (SEC) has completed an initial evaluation of the eXtensible Business Reporting Language (XBRL) submissions under the Commission's new rules relating to interactive data for financial reporting (SEC 2010). This review was completed after a review of Interactive Data Files from the initial phase-in group of filers. The overall filings indicate that filers devoted significant efforts to consider their responsibilities under this program, comply with the new rules, and provide high-quality submissions. Students should be exposed to the core concepts of XBRL as part of the Accounting Information Systems curriculum.

Microsoft Office 2007 including Word, Access, and PowerPoint has robust support for XML. Microsoft adopted Office Open XML Formats, which according to Microsoft (Rice 2006), improved file and data management, data recovery, and interoperability with line-of-business systems. Using XML for CAATs is a logical extension, as extremely large files can be imported and manipulated in a timely and relatively effortless manner By contrast, moving XML and XBRL into the classroom can be challenging and may take different approaches.

A teaching case such as “A Method of Teaching the Underlying Theory of XBRL: An Application of Information Modeling and XML Programming with a Microsoft Excel Implementation” (Tribunella and Tribunella 2006) walks through an XBRL implementation step-by-step. The authors opted for a manual and extremely simple step-by-step implementation of XBRL using Microsoft Notepad, utilizing the teaching case ““Introducing XBRL Using an Instance Document Shell”” (White 2006). Manual manipulation of XML and XBRL tags used in the teaching case is not typically used in practice, as the complexity of tags becomes almost overwhelming with even relatively simple financial statements. While it is important that students understand the core concepts of XBRL tags, a variety of easily accessible tools are available to automate the production of XBRL tags.

Assuming lab time and funds for software licensing are available, one of the most popular tools for producing XBRL financial statements is an add-in to Excel, Dragon Tag XBRL (Rivet Software 2009). Students can learn how to produce XBRL tags using a software application that is an add-in to a familiar application such as Excel. During the XBRL Voluntary Program on EDGAR at the SEC, as of September 2007, 38% of the filers in the program used Dragon Tag (Phillips, Bahmanziari, and Colvard 2008). Dragon Tag exceeded the next highest tool by almost 40% and will likely be one of the dominant tools used by corporate accountants for SEC compliance. Dragon Tag leverages Microsoft Office to provide a familiar and friendly application to XBRL taxonomies and XBRL documents.

Teaching the functional understanding of Excel and the demonstration of Excel to accounting related applications, in and of itself, is not an adequate takeaway from an AIS course. As a result, the authoritative literature on risk assessment, control design and effectiveness, and best practices must be integrated into the discussion of Excel. Moreover, this authoritative guidance needs to be presented in conjunction with the students' reading of Journal of Accountancy articles, the case study on risk assessment and controls, and demonstration of audit applications. The authoritative guidance for this class includes SOX, COSO, and COBiT. Below is a brief description of the authoritative guidance and a stepping stone for integrating such content into an Excel competency AIS curriculum.

It is important to note that even straightforward controls, e.g., password controls on spreadsheets, were not being executed during the course of SOX compliance testing in the past testing periods. The author's review of Securities and Exchange Commission (SEC) filings that failed SOX compliance, i.e., a material control weakness in internal controls, in 2005, 2006, and 2007 noted control failures that were relatively easy to remediate. The disclosures in the SEC filings could not create a complete and an accurate picture, but the anecdotal evidence suggests that simple controls were not implemented or were non-existent even when the companies knew that they had to be SOX compliant. An example of a spreadsheet control deficiency is the 10-K filing for Federal Home Loan Bank of Des Moines for December 31, 2006.

A material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected in a timely basis (Ramos 2008). For this curriculum, the emphasis will be on the risk of an Excel control failure. If a combination of risk factors is high, then the risk of control failure increases. Correspondingly, if a combination of risk factors is low, then the risk of control failure decreases.

The stated purpose of SOX is to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws (Public Law 2002, 107–204). Sections that directly involve information technology (including Excel) are Sections 302, 404, 409, and 802. Section 302 requires the officers of the company to make representations related to the disclosure of internal controls, procedures, and assurance from fraud. Section 404 requires an annual assessment of the effectiveness of internal controls and is the most significant consideration of an Excel implementation. Section 409 requires disclosures to the public on a rapid and current basis of material changes to the firm's financial condition. Section 802 requires authentic and immutable record retention.

Section 404, in conjunction with the related SEC rules and Auditing Standard No. 2 established by the Public Company Accounting Oversight Board (PCAOB), requires the management of a public company and the company's independent auditor to issue two new reports at the end of every fiscal year. Under Section 404, management must also disclose any material weaknesses in internal control (including an Excel implementation with material weaknesses). If a material weakness exists involving financial reporting, including statements prepared with Excel, management may not be able to conclude that the company's internal control over financial reporting is effective (Public Law 2002, 107–204).

COSO creates a framework that divides information technology controls into two types: (1) general computer controls and (2) application-specific controls. Application controls are particularly applicable to Excel implementations. Applications controls are designed to:

• control data processing;

• ensure the integrity of transactions, authorization, and validity;

• encompass how different applications interface and exchange data.

The ERM framework, a cornerstone of Section 404 and COSO, requires ongoing feedback of information from throughout the company, including internal control weaknesses associated with Excel implementations. This monitoring information must be current and accurate and must be sufficiently robust to support the analysis of different risk responses (COSO 2009). Financial reporting and the systems that provide the data to financial reporting, including reporting that originates from Excel implementations, must have the highest levels of integrity and controls.

COBiT 4.1 (2009) includes 34 IT processes organized into four domains: (1) Plan and Organize, (2) Acquire and Implement, (3) Deliver and Support, and (4) Monitor and Evaluate.

Within Monitor and Evaluate, the COBiT guidelines contain the maturity model (MM), process description, information criteria and IT resources, critical success factors, key indicators, and key performance indicators for each process sustaining performance. Consistent with the categories of general computer controls and application-specific controls as defined by COSO of the Treadway Commission (COSO 2009), Excel implementations must consider network operations, application development and maintenance, and access controls. Similar to Microsoft Excel or other applications in the financial reporting process, application controls relevant to Excel should address input, error correction, and output. In this case, substantial security risks exist if the security of the operating system, application, and database is inadequately configured. Such misconstructions could allow unauthorized changes or destruction of data.

To complete the risk assessment for an Excel implementation, it is appropriate to ensure SOX, COSO, and COBiT provide practices for consistent and high quality software (and spreadsheet) implementations. These practices benchmark the requirements for effective change management that are necessary for a SOX compliant implementation.

This paper articulates the need for accounting graduates to be competent in Microsoft Excel prior to joining the professional workforce in any capacity. Currently, all evidence indicates that Excel is a primary, if not dominate, application software used by most accounting organizations. In fact, in many instances, accounting personnel extract data from sophisticated ERP systems and perform detailed and vital analysis within Excel. Given the prevalence of Excel, the documentation of widespread errors within Excel spreadsheets is of concern to all accountants. The more demanding reporting requirements of SOX and IFRS compliance requires accountants to not only understand Excel, but also know how to implement appropriate controls that reduce risk and errors, and comply with authoritative professional standards, e.g. COSO and COBiT. This landscape, along with the desire to deliver curriculum that conforms to professional accounting practice, motivated us to design and implement an AIS curriculum that emphasizes the importance of Excel.

The primary purpose of this paper is to detail our implementation of an AIS curriculum that focuses on Excel competency. This curriculum can be used or adapted by all instructors who are interested in increasing the competency and desirability of their accounting graduates. Our curriculum commences with implementing a functional competency of Excel in all of our students. Students are encouraged to demonstrate this competency and increase their marketability to future employers by becoming certified in Excel. Following the generic competency in Excel, the course shifts towards using Excel to teach the core concepts covered in most AIS courses. This includes the use of Journal of Accountancy articles to emphasize control and productivity implementations in Excel, the demonstration of CAAT using Excel, an Excel-based case study that is used to solidify the requirements of COSO, COBiT, and SOX, and the basics of XML with a transition to XBRL that uses Microsoft Notepad.

As previously discussed, the objectives of this redesigned AIS course are to increase students' functional competency in Excel, introduce students to risk assessment and controls in Excel, present the audit applications of Excel, and introduce students to the function and power of XML/XBRL. The authors believe that all of these objectives are met based on implementing the course described in this paper. The most concrete evidence of the students' competency in Excel is the number of individuals who become certified in Excel by the end of the semester, which is an overwhelming majority of the class. The other objectives are more difficult to quantitatively assess. From a curriculum perspective, students are exposed to and tested on risk assessment, controls, audit applications, and XML/XBRL. However, this does not provide a clear determination of whether the objectives are met. Nevertheless, anecdotal evidence from employers of the students in this curriculum suggests that the external stakeholders are pleased with the quality of students and their knowledge content upon graduation.

An unexpected result from this new curriculum was a significant increase in the instructor's teaching evaluations. On a measurement scale with 1.0 for a “perfect score” to 5.0 at the bottom of the range, student assessments for AIS that includes this curriculum have moved from approximately 2.3 to 2.4 three years ago to approximately 1.7 to 1.8 in the current AIS offering. A range of 1.7 to 1.8 is consistent with the overall Accounting Department assessment performance. Any assessment scores greater than 3.0 are considered unacceptable. The authors believe that this Excel curriculum has directly contributed to assessment scores in the 1.7 to 1.8 range. In particular, student feedback for Microsoft Excel Certification has been very positive and will be an ongoing part of the curriculum. Future curriculum may include expanded training for Access Microsoft Certification.

The implication of including Excel functional competency in AIS coursework may limit the time instructors can allocate to other topics in the AIS curriculum. Thus, some topics could be excluded from the curriculum due to time constraints. If this is a concern, the Excel competency component can be broken out into a separate course. The lead author of this paper left the institution where this curriculum was initially developed and now teaches the course described in this paper at a peer institution. However, the previous institution developed a one-credit Excel Boot Camp course as an elective to upper-class accounting students following the lead author's departure. The accounting department at this institution believed that an in-depth course offering in Excel appropriately prepared accounting majors following feedback from employers and students. This course is administered by an information technology teaching professional and excludes exercises in the Journal of Accountancy and related accounting topics. The goal of this Excel Boot Camp course is to both enhance Excel skills and to certify students in Excel. Without Excel competency as a significant component, the AIS course can devote more time to other AIS topics.