Domain E · Area E-CA3 · Data quality, comparability, lineage and system controls

E.10Design and operate spreadsheet, system and data-quality controls

Working Draft version 1.1

Purpose and scope

This unit covers the capability to identify reporting risks and design, operate and evaluate proportionate controls over spreadsheets, databases, reporting platforms, interfaces, automated workflows and data-quality monitoring used in sustainability reporting. It includes access, input, formula, configuration, master-data, interface, change, override, backup, incident, monitoring and remediation controls, while recognising dependencies on enterprise IT general controls.

Applied competency statement

Can design, operate and evaluate proportionate spreadsheet, system, interface and data-quality controls that protect sustainability reporting information from unauthorised access, error, incomplete processing, uncontrolled change and loss of integrity.

Boundary and escalation

This unit owns reporting application, interface, spreadsheet and data-quality control design and operation. I.1 owns tool selection and lifecycle, I.2 owns automated workflow design and I.9 owns digital and AI governance; F.1 and F.2 own the wider reporting risk and control architecture. The unit does not constitute cyber-security assessment, IT audit or software assurance.

Key quality risks

Uncontrolled spreadsheet versions; hidden or inconsistent formulas; unlocked input and calculation cells; broken links; manual overrides without approval; macros or scripts without testing; excessive access; shared accounts; unapproved configuration or taxonomy changes; failed or incomplete interfaces; master-data inconsistency; automated workflows that suppress exceptions; inadequate backup and recovery; control evidence not retained; dashboards that report activity rather than quality; and reliance on enterprise IT controls that have not been confirmed.

Required knowledge · 6

E.10-K01

Understands input, formula, link, version, access, override, macro, script, hidden cell, copy-paste, protection, documentation and key-person risks in spreadsheets and other end-user tools.

Knowledge Type: Spreadsheet and end-user risks · Normative Weight: Core

E.10-K02

Understands validation, required fields, calculations, approvals, exception routing, status, configuration, role, logging and automated workflow controls in reporting platforms and applications.

Knowledge Type: Application and workflow controls · Normative Weight: Core

E.10-K03

Understands completeness and accuracy of data transfers, interface totals, failed records, duplicate prevention, mapping, reference data, taxonomy and master-data governance.

Knowledge Type: Interface and master data · Normative Weight: Core

E.10-K04

Understands user provisioning, privileged access, segregation, periodic access review, configuration and code change, testing, migration, approval, emergency change and manual override controls.

Knowledge Type: Access and change · Normative Weight: Core

E.10-K05

Understands backup, recovery, business continuity, retention, incident detection, error correction, audit logs, vendor dependence and the relationship to enterprise IT controls.

Knowledge Type: Resilience and incidents · Normative Weight: Core

E.10-K06

Understands control design, operating evidence, data-quality rules, dashboards, thresholds, exceptions, control deficiencies, remediation, testing and the boundary with IT audit and assurance.

Knowledge Type: Monitoring and evaluation · Normative Weight: Core

Applied skills · 5

E.10-S01

Map spreadsheets, systems, interfaces and automated workflows used in reporting and identify risks to completeness, accuracy, access, change and integrity.

Skill Type: Core applied capability · Observable Output or Result: Reporting technology and control inventory

E.10-S02

Design proportionate preventive, detective and corrective controls over inputs, formulas, access, interfaces, master data, configuration, changes, overrides, exceptions and retention.

Skill Type: Control design · Observable Output or Result: Reporting system, interface and data-flow control design

E.10-S03

Operate or coordinate controls, retain evidence, investigate exceptions and confirm completion and approval.

Skill Type: Operation and evidence · Observable Output or Result: Access, change, override and incident control record

E.10-S04

Assess whether controls are suitably designed and evidenced, identify gaps and define owners, priority, compensating controls and remediation.

Skill Type: Evaluation and remediation · Observable Output or Result: Spreadsheet and end-user computing control standard and review

E.10-S05

Develop data-quality and control monitoring, thresholds, dashboards, incident reporting and governance escalation while confirming reliance on IT and vendor controls.

Skill Type: Monitoring and governance · Observable Output or Result: Data-quality monitoring dashboard and remediation plan

Professional behaviours · 3

E.10-B01

Does not rely on password protection, system status or automation as proof that data and calculations are controlled.

Behaviour Type: Control discipline · Non-compensable Requirement: No

E.10-B02

Does not permit unauthorised access, untested change or undocumented override to remain because the reporting deadline is near.

Behaviour Type: Change and access integrity · Non-compensable Requirement: No

E.10-B03

Identifies dependencies on IT, security, privacy, vendor and general controls and escalates them rather than presenting a reporting review as an IT audit.

Behaviour Type: Boundary and escalation · Non-compensable Requirement: No

Typical tasks · 4

E.10-T01

Inventory material spreadsheets, systems, interfaces, workflows, users, vendors and data-quality rules and map reporting risks and dependencies.

Primary Output Link: E.10-O02

E.10-T02

Design or update spreadsheet, application, interface, master-data, access, change, override, backup and exception controls and define owners and evidence.

Primary Output Link: E.10-O02

E.10-T03

Operate or inspect controls, access and change records, logs, interface checks, exceptions, incidents and retained evidence.

Primary Output Link: E.10-O03

E.10-T04

Evaluate gaps and incidents, establish compensating controls and remediation and report data-quality and control status to management.

Primary Output Link: E.10-O04

Expected outputs · 4

E.10-O01

Spreadsheet and end-user computing control standard and review

Output Type: Professional work product

E.10-O02

Reporting system, interface and data-flow control design

Output Type: Professional work product

E.10-O03

Access, change, override and incident control record

Output Type: Professional work product

E.10-O04

Data-quality monitoring dashboard and remediation plan

Output Type: Professional work product

Proficiency indicators

Level 1 · Foundation

E.10-L1-01

Can operate established spreadsheet and system controls, retain specified evidence and identify missing access, formula, version, interface or change records.

Indicator Dimension: Task execution

E.10-L1-02

Can recognise obvious uncontrolled spreadsheets, failed interfaces, unauthorised changes or unresolved exceptions and escalate them to the appropriate owner.

Indicator Dimension: Quality, judgement and accountability

Level 2 · Practitioner

E.10-L2-01

Can independently design and operate proportionate controls for a moderately complex reporting process using spreadsheets, systems and automated workflows.

Indicator Dimension: Task execution

E.10-L2-02

Can assess routine control gaps, implement compensating controls and explain data-quality, access, change and vendor dependencies to management and reviewers.

Indicator Dimension: Quality, judgement and accountability

Level 3 · Advanced Practitioner

E.10-L3-01

Can design or critically review enterprise reporting-technology and data-quality control governance across complex systems, interfaces, end-user tools and vendors.

Indicator Dimension: Method design and review

E.10-L3-02

Can challenge false reliance on automation or IT controls, resolve significant access, change and interface failures and advise governance bodies on residual technology and data risk.

Indicator Dimension: Leadership and governance

Illustrative evidence · 7

E.10-E01

Spreadsheet and end-user computing control standard and review covering formulas, links, versions, access and overrides.

Evidence Type: Work product

E.10-E02

Reporting system, interface and data-flow control design with owners, evidence and IT dependencies.

Evidence Type: Work product

E.10-E03

Access, change, override and incident control record.

Evidence Type: Work product

E.10-E04

Data-quality monitoring dashboard and remediation plan with meaningful thresholds and ownership.

Evidence Type: Work product

E.10-E05

Control-operation, access-review, interface, change-test, exception and backup evidence.

Evidence Type: Process evidence

E.10-E06

Documented IT, security, privacy, vendor, internal-control, quality or management review and the practitioner's response.

Evidence Type: Review evidence

E.10-E07

Observed evaluation and escalation of an uncontrolled spreadsheet, failed interface or unapproved system change.

Evidence Type: Observed performance

Assessment · 3

E.10-A-L1

Spreadsheet-control review, access and change scenario and situational judgement

Risk identification; control evidence; access and change awareness; recognition of IT and escalation boundaries.

E.10-A-L2

Integrated reporting-technology case and professional memorandum

Control design and proportionality; interface and access controls; change and exception governance; dashboard and communication.

E.10-A-L3

Complex systems-and-vendor case, portfolio and oral defence

Method design; dependency on IT and vendors; access, change and interface judgement; governance challenge and oral defence.

Relationships · 10

From	To	Type	Rationale
E.9	E.10	Risk and control linkage	Access, change, interface and record controls protect lineage and record integrity.
E.10	F.1	Risk and control linkage	Reporting technology and data risks should be reflected in control objectives and risk-control matrices.
E.10	F.2	Risk and control linkage	Spreadsheet, application and interface controls are part of the reporting control environment.
E.10	F.6	Risk and control linkage	Control failures and incidents require severity assessment, remediation and closure.
E.10	I.1	Digital and technology linkage	Reporting tool selection and implementation should incorporate defined control requirements.
F.1	E.10	Risk and control linkage	Spreadsheet, system, interface and data-quality risks are inputs to reporting control objectives.
F.2	E.10	Risk and control linkage	Spreadsheet and application controls form part of the reporting control environment.
F.6	E.10	Risk and control linkage	Spreadsheet, system and data-quality control failures may require deficiency assessment and remediation.
I.1	E.10	Risk and control linkage	Tool selection and operation should incorporate spreadsheet, system, interface and data-quality control requirements.
I.2	E.10	Risk and control linkage	Application, interface, access and change controls support reliable workflow automation.

Role profiles for this unit

Role	Target level	Relevance	Evidence expectation
Corporate Sustainability Reporting Practitioner	Foundation	Supporting?	A supervised or defined work sample showing correct application, traceability and recognition of escalation needs.
Sustainability Reporting Manager or Lead	Practitioner	Required?	A case or work sample demonstrating independent performance, documented judgement and a reviewable professional output.
Sustainability Reporting Adviser or Consultant	Practitioner	Required?	A case or work sample demonstrating independent performance, documented judgement and a reviewable professional output.
Sustainability Data, Systems and Controls Specialist	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.
Assurance Readiness and Reporting Quality Specialist	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.
Investor, Capital Markets and Ratings Disclosure Specialist	Foundation	Supporting?	A supervised or defined work sample showing correct application, traceability and recognition of escalation needs.