Spreadsheet copilots have an audit trail problem

Assistants embedded in spreadsheet and consolidation tools have crossed from suggestion into action. They will now rewrite a formula, restructure a range, or apply a mapping across a workbook on request. This is genuinely useful and it is being adopted enthusiastically by people who do not think of themselves as making a control decision when they accept a suggestion.

The gap is logging. In our review of the mainstream finance tooling, provenance capture is inconsistent. Some products record the prompt, the suggested change and the accepting user in an immutable log. Others record that a cell changed, as they always did, with no indication that the change originated from a model. From a controls perspective those two situations are not remotely equivalent, and the second one is the more common.

The practical exposure is not fraud. It is unexplained variance. A mapping applied across a workbook by an assistant, accepted in a hurry during close, is very difficult to unwind three weeks later when the number looks wrong and nobody can reconstruct what happened. Finance teams have spent two decades building spreadsheet controls precisely because this failure mode is expensive.

There is a straightforward test to apply to every vendor in your stack. Ask them to show you the log. Not the roadmap, the log. Where it does not exist, the assistant should be restricted to read-only analysis until it does. That is a defensible position with an auditor and an easy one to relax later.