<disclosure>I work for Microsoft, specifically I am a Program Manager on the Windows Excel team </disclosure>

This is actually something we take very seriously and we have been building tools to improve this. Excel 2013 actually shipped with a compliance add-in. Here is some more info: http://blogs.office.com/b/microsoft-excel/archive/2012/09/13...

Wow, thank you for that. I am honestly fascinated by this.

Agreed. They were doing CDS deals. Every bank I've worked at has their models in COM assemblies that can be consumed by Excel. Excel lets the traders value their instruments using the models. The inputs may have been copy-paste but I'd be hard pressed to believe that the risk numbers were generated by hand in Excel unless this was some very exotic instrument which I don't think it was.

Risk numbers aren't generated by Excel but an automated process that uses the same assemblies.

have you tried reverse engineering someone else's non-trivial spreadsheet? a programmer might build a good spreadsheet but the average person builds a nest of lookups and hacked up nested if/then statements. seriously, i think spreadsheets are un-auditable - the only way to double check something is to write your own version and check the output... now you've got 2 problems...

Lookups and if/then statements, wow. God forbid you ever have to audit a program with a loop.

The problem with auditing excel isn't the kind of individual statements, its the lack of structure.

Excel is effectively an easy-to-write self-obfuscating coding environment.