An enormous amount of legislation has either recently come into force or will come into force over the next few years.

All these include sections on operational risk relevant to spreadsheet systems.

None of this legislation explicitly talks about spreadsheets. It is all principles based and talks about general requirements on 'systems'.

For most companies, however, spreadsheets form part of these systems and must therefore meet certain minimum requirements.

These requirements generally come under one of the following headings:-

Access Control and Security

Version Control and Audit Trails

Model Robustness and Testing

Back-Ups and Archiving

Appropriate Business Processes

You could address the requirements of each piece of legislation separately. But this would be expensive.

It is much more cost-effective to address the underlying business issue - namely spreadsheet risk.

As a fringe benefit, you should also comply with both current and foreseeable legislation.