Spreadsheets and Email Are Not Internal Controls: The Risk Your Auditors Will Ask About

Week two of the year-end audit. The auditor samples a VND 2.4 billion payment to a logistics vendor and asks three questions: who approved it, when, and against which version of the contract?

The answer lives in three places. A 38-reply email thread where the approval is a department head writing "Ok, go ahead." A file called PO_Tracking_2026_final_v4 (1).xlsx on the shared drive, last modified by an account nobody recognizes. And the memory of an accountant who left in June.

The payment may be perfectly correct. The problem is that the company cannot prove it.

This is the gap many CFOs only see once they are sitting across the table from the audit team. Spreadsheets and email are working tools. They are not internal controls.

Auditors Don't Test Tools. They Test Evidence

Under Vietnamese Standard on Auditing 315 (VSA 315), auditors must understand an entity's internal control, including its IT environment, to assess the risk of material misstatement. The COSO 2013 framework, which most FDI parent companies follow, divides internal control into five components. Two of them, control activities and information and communication, take a direct hit when a process runs on spreadsheets.

Auditors evaluate two things: whether a control is designed properly, and whether it actually operated consistently through the period. The second is where companies stumble. A policy that says "every payment above VND 500 million requires CFO approval" sounds tight. If nothing stops a VND 520 million payment from going straight to disbursement, the policy exists only on paper.

When auditors can't rely on controls, they expand substantive testing: bigger samples, more manual reconciliation, more questions. Fieldwork runs longer, the finance team loses weeks during the busiest stretch of the year, and the management letter picks up a few lines nobody wants to forward to headquarters.

Five Questions Your Auditors Will Ask, and Why Spreadsheets Can't Answer Them

1. Who approved this, and when? Email records that someone replied. It does not record that they approved the right content within their authority. "Ok" might mean yes. It might also mean "read it." Emails can be forwarded, quoted text can be edited, and messages can be deleted.

2. Who changed this number? Excel has no change log reliable enough for audit purposes. Anyone who can open the file can edit a cell, rewrite a formula, or paste a value over it. In plenty of companies, exactly one person understands the month-end reconciliation macro, and that person tends to book leave the week the books close. 

3. Is segregation of duties enforced? The person who raises a payment request should never approve it. In a spreadsheet, nothing stops that from happening. Segregation of duties becomes an honor system.

4. Which version is final? A contract has the draft sent to the counterparty, their markup, legal's comments, and a scanned signed copy. When the auditor asks which clause the payment was based on, the answer usually starts with "let me find it."

5. Will the evidence still exist in ten years? Article 41 of Vietnam's Law on Accounting 2015 requires accounting vouchers used directly for bookkeeping to be kept for at least ten years. Mailboxes of departed staff are often deleted within months. Shared drives get cleaned up with every infrastructure change. The evidence goes with them.

The Cost Goes Beyond a Broken Formula

Spreadsheet errors are more common than most leaders assume. Professor Raymond Panko of the University of Hawaii, summarizing field audits of real spreadsheets, found errors in close to nine out of ten. In 2012, JPMorgan lost more than USD 6 billion in the "London Whale" trades. Its internal review later found that a key risk model ran on a chain of manually copied spreadsheets, with one formula dividing by a sum instead of an average.

Still, our view is blunt: for most companies, the biggest risk isn't a bad formula. It's that even when everything is right, the company can't prove it. A control that leaves no evidence barely exists from an auditor's point of view.

What a Real Control Looks Like

You don't need to ban Excel. Spreadsheets remain excellent for analysis, modeling, and planning. What has to move out of spreadsheets and inboxes is the part of the process that performs a control function:

• Rules the system enforces: a payment above a threshold routes to the right approver automatically, whether or not the requester remembers to send it.

• Role-based permissions: requesters cannot approve their own requests, and approvers see only what falls within their authority.

• A tamper-evident log: every create, edit, approve, and reject action is recorded with the user and a timestamp.

• One repository: contracts, amendments, and supporting documents are linked to each transaction, with clear versions, kept for the full statutory period.

With these four in place, an auditor's question gets answered with a log export instead of three days of digging through inboxes.

Where Kyta Platform Fits

Kyta Platform by FPT IS is built for exactly this gap: turning approval and contracting processes that run on email and spreadsheets into controlled, traceable workflows.

• Kyta eFlow and Kyta eRequest let you configure multi-level approvals, value thresholds, and branching conditions on a no-code/low-code platform. When internal policy changes, the operations team updates the flow without opening a new development project.

• Kyta eCLM is a central contract repository that tracks progress in real time, from drafting and negotiation through post-signature storage.

• Kyta Signature provides remote digital signatures with timestamping (TSA) and long-term validation (LTV), certified with the CeCA green tick from Vietnam's Ministry of Industry and Trade. Approval evidence becomes legally valid, not a one-line email reply.

The goal isn't one more piece of software for the finance team. It's making sure every control rule is enforced by the system and leaves its own evidence.

Where to Start

Don't open with a company-wide transformation program. Pick the process your auditors questioned most last year, usually vendor payment approval or contract approval.

1. List the controls that currently live in a few people's heads: approval thresholds, who can approve what, which exceptions are accepted.

2. Configure them as system rules, with roles and permissions.

3. Run in parallel for at least one month-end close before audit season, so you have real data when the auditors arrive.

One process done properly this quarter is worth more than ten processes sitting in next year's plan.

Conclusion

Spreadsheets and email will stay in your business, and they should. But when they carry the weight of internal control, the company is betting on individual memory and good behavior. Auditors don't grade good behavior. They grade evidence.

Talk to Kyta Platform about reviewing your current approval processes: kyta.fpt.com | Hotline: 1900 636 121 (ext. 2) | Email: support.kyta@fpt.com