The framing of spreadsheets as production decisions is the right one, and I'd push it one step further: a critical workbook is unmanaged production code. It has inputs, logic, and a deployment artifact (the file people actually open), and in most organizations none of the three goes through the controls we'd demand from a Python script doing the same calculation: no review of the formulas, no change log, no named owner. The version problem is the nastiest in practice because the file silently forks every time it gets emailed. One cheap control that helps: keep the logic in a read-only master, distribute only a link to it, and record a hash of the version you audited, so later you can tell whether the workbook that made the decision is the workbook you approved. EUC inventories are also becoming an audit topic under operational-resilience rules, so the spreadsheet register has a second life as compliance evidence.
The framing of spreadsheets as production decisions is the right one, and I'd push it one step further: a critical workbook is unmanaged production code. It has inputs, logic, and a deployment artifact (the file people actually open), and in most organizations none of the three goes through the controls we'd demand from a Python script doing the same calculation: no review of the formulas, no change log, no named owner. The version problem is the nastiest in practice because the file silently forks every time it gets emailed. One cheap control that helps: keep the logic in a read-only master, distribute only a link to it, and record a hash of the version you audited, so later you can tell whether the workbook that made the decision is the workbook you approved. EUC inventories are also becoming an audit topic under operational-resilience rules, so the spreadsheet register has a second life as compliance evidence.