When Excel becomes a business-critical application: EUC/UDA audit and remediation
In many enterprises, critical processes live partly outside ERP and official application portfolios: in Excel, VBA, Access, SharePoint lists or rapidly built Power Apps. These are often described as EUC or UDA assets. The problem is not that business users created them; the problem is when critical operations depend on them without clear ownership, controls, documentation or support.
1. Find what is actually critical
Not every spreadsheet is a risk. Prioritise by business impact, user population, data sensitivity, reporting dependency and the consequence of failure.
- business impact
- user population
- data sensitivity
- financial or regulatory dependency
- single point of failure
2. Build more than a file inventory
A useful EUC/UDA register records business and technical owners, data sources, downstream use, permissions, version, critical code or formulas, backup approach and expected lifecycle.
- business owner
- technical owner
- input/output lineage
- access
- backup/recovery
- lifecycle
3. Match controls to risk
A personal calculator and a macro-enabled workbook producing a monthly financial report do not need the same control level. Use risk tiers to determine review, access and recertification requirements.
- low / medium / high criticality
- peer review
- change log
- access review
- periodic recertification
4. Do not rebuild everything
Some tools only need documentation and controls; some need stabilisation; others should move to Power Apps, Dataverse, Power Automate, SQL or custom software. Prioritise the remediation backlog by risk and value.
- retain with controls
- refactor
- replace
- retire
- prioritised remediation backlog
5. Orphaned low-code apps are an EUC risk too
For Power Apps and Power Automate, ownership, connections, service accounts and solution lifecycle matter just as much as formulas and logic.
- orphaned app/flow
- personal connection
- service account / service principal
- solution ownership
- support model
6. Turn the assessment into a governance cycle
The initial inventory can be a project, but registration, risk scoring, review, remediation and recertification should continue as an operating process.
- intake
- risk scoring
- review
- remediation
- recertification