EUC Risk Management in Financial Services

This technical report addresses the challenges of End-User Computing (EUC) risk management in financial services, especially in light of recent regulatory changes. It outlines how spreadsheets, often used for critical financial calculations, remain uncontrolled and pose significant risks. The report discusses the implications of SR 26-2 Revised Guidance on Model Risk Management, which excludes simple spreadsheets from formal model scope but does not remove the obligation to govern the data and processes informing models. The report highlights the need for institutions to demonstrate the reliability of their data inputs and calculation logic to regulators. It categorizes various approaches organizations have taken to address EUC risks, including inventory and monitoring platforms, automation tools, and internal technology programs. However, it emphasizes that automation alone does not equate to governance, and organizations must establish a robust governance framework alongside automation to meet regulatory expectations. Finally, the report notes that a comprehensive EUC solution requires a blend of visibility, data integrity, governance infrastructure, ongoing controls, and integration with existing technology.