Anatomy of a Spreadsheet Failure, Analysing the EuSpRIG Horror Story Corpus

2026-09-25

AI Summary

This study addresses the evolution of spreadsheet risks from traditional computational errors into a broader crisis of data visibility and governance. Drawing on the European Spreadsheet Risks Interest Group (EuSpRIG) case repository, this work applies data cleaning techniques and a twelve-category fault taxonomy to conduct mechanism, context, and consequence analyses of 121 incidents. It proposes a novel perspective demonstrating that spreadsheet risks extend beyond numerical inaccuracies to encompass deeper issues of visibility, information disclosure, and trust. Quantitative findings reveal a significant increase in errors caused by hidden data and embedded objects, which have emerged as new threat vectors leading to public harm and organizational authorization risks. These insights provide a critical theoretical foundation for advancing spreadsheet governance frameworks.

Abstract

Spreadsheet disasters have been documented for more than thirty years, but they have not gone away. This paper examines the EuSpRIG horror stories archive as evidence of how ordinary spreadsheets fail and the consequences that follow. After cleaning and deduplication, 121 incidents from 1995 to 2026 were classified into twelve failure categories and analysed by mechanism, context and consequence. Formula errors, data-entry slips and data-handling mistakes account for 71 cases and recur across the whole period, from Fidelity's missing minus sign in 1995 to a mistyped date that cost Norway's sovereign wealth fund about $92 million in 2024. A second pattern concerns information present in a workbook but not visible to the recipient: hidden rows, hidden sheets, pivot-table caches, embedded objects and retained source layers can cause harm even when no calculation is wrong. The clearest rise in reported cases is in this hidden or embedded data category, whose most serious example is the 2022 Ministry of Defence spreadsheet that exposed details of roughly 18,700 Afghan applicants through hidden rows. The paper argues that spreadsheet risk is no longer only a problem of wrong numbers. It also involves visibility, disclosure, governance and trust. Existing taxonomies remain useful for formula, entry and handling errors, but do not fully capture the public harm caused by spreadsheets used as uncontrolled operational infrastructure. The same mistakes have persisted for three decades, what has changed is the authority organisations give to the spreadsheets that contain them.

Problem

• spreadsheet failures
• risk taxonomy
• hidden data
• information disclosure
• spreadsheet governance

Innovation

• Spreadsheet failure taxonomy
• Hidden data risk
• EuSpRIG corpus analysis
• Information disclosure
• Operational infrastructure governance