Spreadsheet Audit Skill
Spreadsheets fail silently: the SUM that stops at row 40 while data runs to 60, the hardcoded 1.1 someone typed over a formula in March, the column that's monthly in one section and annual in another. The sheet still displays numbers — wrong ones, confidently. This skill audits the way inherited models deserve: hunt the classic error classes, map what breaks when the sheet grows, and rank findings by damage-if-wrong — because the audit's job is protecting the decision the sheet feeds, not achieving cosmetic tidiness.
What This Skill Produces
- The findings, ranked by damage — each: location, what's wrong, what it's currently mis-stating
- The fragility map — the formulas that break on the next added row/column, before they do
- The verified/suspect ledger — which outputs were traced clean and which remain unverified (unverified ≠ wrong; the label is the honesty)
- The fix list — ordered, with the make-it-robust upgrades (structured ranges, input isolation) where they matter
Required Inputs
Ask for these if not provided:
- The sheet — the file, or its formulas/structure described; audits work on the actual formulas, not the values screenshot
- The stakes — what decisions this sheet feeds (a budget approval? pricing? a board number?) — depth and ranking follow the damage potential
- The lineage — author available? Inherited from a departed colleague? Known past incidents? Inherited orphans get the deeper hardcode-hunt
- The growth pattern — does data get appended? The fragility map keys on how the sheet evolves
Framework: The Hunt Rules
- Hardcode hunt first: values typed over formulas are the deadliest class — invisible, intentional-once, wrong-forever. Scan for constants where columns are otherwise formulaic (inconsistent-formula warnings, or eyeball the pattern breaks). Every hardcode found gets asked: override or accident?
- Range-edge check on every aggregate: SUMs/AVERAGEs/LOOKUPs vs. the data's actual extent — the stops-at-row-40 error. The robust fix where growth is real: full-column ranges or tables/structured references, so appended rows join automatically.
- Unit and time-grain consistency: monthly-vs-annual mixes, currencies, thousands-vs-units — checked at every junction where sections meet. The tell is a ratio that's ~12× or ~1000× off; the fix is a stated grain per section, labeled in headers.
- Trace the load-bearing outputs: the 3–5 numbers the sheet exists to produce get full precedent-traces (follow every input to its source). Everything else gets the class-level checks — tracing everything is how audits never finish; tracing nothing is how meetings get corrected from the floor.
- Rank by damage, report honestly: a $2 rounding artifact and a double-counted revenue line are different findings; the report leads with what changes decisions. The verified/suspect ledger states what the audit did not cover — an audit that implies total coverage it didn't do is itself an error class.
Output Format
Spreadsheet Audit: [sheet] — feeds: [the decision]
Findings (damage-ranked)
| # |
Location |
Issue |
Currently mis-stating |
Fix |
Fragility Map
[What breaks on the next row/column · the structured-range upgrades worth making]
Verified / Suspect Ledger
[Outputs traced clean: … · checked at class level: … · not covered: … — labeled, not implied]
Fix Order
[Damage-first, with the two structural upgrades (input isolation, structured ranges) if the sheet has a future]
Quality Checks
Anti-Patterns
1---2name: spreadsheet-audit3description: Audit a spreadsheet before trusting it — the error hunt (hardcoded overrides, broken ranges, silent unit mixes), the fragility map (what breaks when rows are added), and the load-bearing-formula review that catches the mistake before the meeting does. Use when asked check this spreadsheet before we present it, why don't these numbers add up, audit this model someone left behind, or is this sheet safe to build on. Produces the findings ranked by damage, the fragility map, the verified-vs-suspect ledger, and the fix list.4---5
6# Spreadsheet Audit Skill
7
8Spreadsheets fail silently: the SUM that stops at row 40 while data runs to 60, the hardcoded 1.1 someone typed over a formula in March, the column that's monthly in one section and annual in another. The sheet still displays numbers — wrong ones, confidently. This skill audits the way inherited models deserve: hunt the classic error classes, map what breaks when the sheet grows, and rank findings by damage-if-wrong — because the audit's job is protecting the decision the sheet feeds, not achieving cosmetic tidiness.
9
10## What This Skill Produces
11
12- **The findings, ranked by damage** — each: location, what's wrong, what it's currently mis-stating
13- **The fragility map** — the formulas that break on the next added row/column, before they do
14- **The verified/suspect ledger** — which outputs were traced clean and which remain unverified (unverified ≠ wrong; the label is the honesty)
15- **The fix list** — ordered, with the make-it-robust upgrades (structured ranges, input isolation) where they matter
16
17## Required Inputs
18
19Ask for these if not provided:
20- **The sheet** — the file, or its formulas/structure described; audits work on the actual formulas, not the values screenshot
21- **The stakes** — what decisions this sheet feeds (a budget approval? pricing? a board number?) — depth and ranking follow the damage potential
22- **The lineage** — author available? Inherited from a departed colleague? Known past incidents? Inherited orphans get the deeper hardcode-hunt
23- **The growth pattern** — does data get appended? The fragility map keys on how the sheet evolves
24
25## Framework: The Hunt Rules
26
271. **Hardcode hunt first:** values typed over formulas are the deadliest class — invisible, intentional-once, wrong-forever. Scan for constants where columns are otherwise formulaic (inconsistent-formula warnings, or eyeball the pattern breaks). Every hardcode found gets asked: override or accident?
282. **Range-edge check on every aggregate:** SUMs/AVERAGEs/LOOKUPs vs. the data's actual extent — the stops-at-row-40 error. The robust fix where growth is real: full-column ranges or tables/structured references, so appended rows join automatically.
293. **Unit and time-grain consistency:** monthly-vs-annual mixes, currencies, thousands-vs-units — checked at every junction where sections meet. The tell is a ratio that's ~12× or ~1000× off; the fix is a stated grain per section, labeled in headers.
304. **Trace the load-bearing outputs:** the 3–5 numbers the sheet exists to produce get full precedent-traces (follow every input to its source). Everything else gets the class-level checks — tracing everything is how audits never finish; tracing nothing is how meetings get corrected from the floor.
315. **Rank by damage, report honestly:** a $2 rounding artifact and a double-counted revenue line are different findings; the report leads with what changes decisions. The verified/suspect ledger states what the audit did *not* cover — an audit that implies total coverage it didn't do is itself an error class.
32
33## Output Format
34
35# Spreadsheet Audit: [sheet] — feeds: [the decision]
36
37## Findings (damage-ranked)
38| # | Location | Issue | Currently mis-stating | Fix |
39|---|---|---|---|---|
40
41## Fragility Map
42[What breaks on the next row/column · the structured-range upgrades worth making]
43
44## Verified / Suspect Ledger
45[Outputs traced clean: … · checked at class level: … · not covered: … — labeled, not implied]
46
47## Fix Order
48[Damage-first, with the two structural upgrades (input isolation, structured ranges) if the sheet has a future]
49
50## Quality Checks
51
52- [ ] The hardcode hunt ran across all formulaic columns
53- [ ] Every aggregate was checked against the data's true extent
54- [ ] Load-bearing outputs got full traces; the ledger says which
55- [ ] Findings are ranked by decision-damage, not discovery order
56- [ ] Coverage limits are stated — no implied total audit
57
58## Anti-Patterns
59
60- [ ] Do not audit the displayed values — the formulas are the sheet; the display is its costume
61- [ ] Do not fix silently while auditing — findings first, fixes as their own reviewed pass
62- [ ] Do not treat every finding as a crisis — the $2 artifact and the double-count get different fonts
63- [ ] Do not imply coverage you didn't do — the suspect ledger is the audit's integrity
64- [ ] Do not leave growth-fragile ranges unflagged in a sheet that grows — today's clean audit is next month's row-41 error
gabrielmoreira