Spreadsheet risk does not disappear with agents

Putting an agent on top of a spreadsheet does not remove the spreadsheet's risks; the agent inherits them. Broken formulas, hard-coded numbers, stale copies and unclear ownership all flow into whatever the agent reads or writes. Unless controls are added around the files themselves, an agent can spread spreadsheet errors faster and present them more confidently than any person would.

What makes spreadsheets risky in finance?

Spreadsheets sit at the heart of most finance teams because they are flexible. That flexibility is also the risk. A spreadsheet has no built-in separation between data and logic, no enforced version control, and no record of who changed what unless someone sets one up.

The familiar failures are worth listing because each one affects agents differently:

• Formula errors: a range that stops one row short, a reference that shifted when a row was inserted.
• Hard-coded overrides: a number typed over a formula to "fix" a result, never removed.
• Stale copies: last month's version emailed around and edited in parallel with the real one.
• Hidden logic: hidden rows, columns or sheets that change totals without anyone seeing why.
• Unclear ownership: nobody knows who maintains the file or whether it is still used.
• Manual links: values pasted in from other systems, with no record of when or from where.

None of these is new. What is new is how agents interact with them.

How do agents inherit these risks?

In four ways.

They read what is there. An agent asked to prepare an accrual from a schedule reads the schedule's values. If a formula is broken or a hard-coded number is wrong, the agent uses the wrong number. It has no way to know the cell should have contained a formula.

They pick the wrong file. Given access to a shared folder, an agent may read "Accruals_v3_final" when the real file is "Accruals_v3_final_revised". A person might ask a colleague. An agent proceeds.

They write back. An agent permitted to update a spreadsheet can introduce its own errors: overwriting a formula with a value, writing to the wrong row, breaking a link. Unlike a ledger, the spreadsheet usually has no control that stops this.

They add confidence. A person who builds a figure from a messy spreadsheet usually knows it is messy and says so. An agent may present the same figure in clean prose with a precise number, and the reader has no reason to doubt it.

Can agents reduce spreadsheet risk instead?

Yes, if pointed at the right task. The same ability to read every cell makes agents useful reviewers of spreadsheets. An agent can scan a workbook for hard-coded numbers in formula ranges, inconsistent formulas across a row, references to external files, hidden sheets, and cells that changed since the last version. It can compare two versions and list every difference.

That is depth 1 work: reading and reporting. It turns the agent from a consumer of spreadsheet risk into a control over it. The findings go to the file's owner, who decides what to fix.

Agents can also help in a related way: spotting anomalies that might indicate deliberate manipulation, such as invoice amounts in a schedule that do not match source documents. Whether an AI agent can spot invoice fraud depends partly on whether it can see both the spreadsheet and the source.

What controls should be added?

The general principle is to treat each spreadsheet the agent relies on as a source with a provenance class. A spreadsheet maintained by a named person, with versions and a recent refresh, is declared at best. It is not a sealed system of record, and figures drawn from it should be treated with matching caution.

Should agents ever write to spreadsheets?

Sometimes, with care. Writing a prepared schedule to a new sheet, for a person to review, is low risk: it is depth 2, drafting. Updating an existing working file that other people and processes rely on is higher risk, because errors spread silently.

Where possible, move the agent's output into a controlled system instead: a draft journal in the ledger, a record in the reconciliation tool. Where spreadsheets remain unavoidable, restrict the agent to designated output areas and keep a log of every write.

How should spreadsheet-dependent agents be classified?

By what the spreadsheet feeds. An agent that reads a spreadsheet to answer an internal question is low risk. One whose spreadsheet-derived figures go into reported financial statements, regulatory returns or payment runs is high risk, and should get the controls above plus closer certification.

The method for this kind of classification is covered in how to classify AI agents by risk, and the wider discipline in what AI risk management is. The point specific to spreadsheets is that the agent's risk rating should reflect the fragility of its sources, not just the sensitivity of its outputs.

What should you do differently?

Before an agent touches a spreadsheet, register the file: owner, purpose, status, refresh cadence. Have the agent scan it for structural problems before using it, and record the version it read. Keep the agent out of formula cells. And where a spreadsheet feeds something that matters, plan to replace it with a controlled source. Agents can make the old spreadsheet problem more visible, which is an opportunity to fix it. That is part of AI agents for finance: books you can audit.