Share

The Governance Gap

The Two Channels

By Sevda Polat— August 13, 2026

Feature image for article: The Two Channels

In 1990, two studies independently found the same thing: spreadsheets spread through organizations colleague to colleague, while information-systems departments barely registered it. Governance showed up later, through audit findings and regulatory guidance — a separate organizational channel entirely. A Census Bureau working paper from this April, covering more than 117,000 firms, finds AI adoption splitting the same way: workers experimenting task by task, formal adoption moving through business functions, the two paths barely touching. What accumulates in the interval between adoption and oversight is the part that's hard to see and harder to undo.

The Governance Gap

The Two Channels

By Sevda Polat— August 13, 2026

In 1990, two studies independently found the same thing: spreadsheets spread through organizations colleague to colleague, while information-systems departments barely registered it. Governance showed up later, through audit findings and regulatory guidance — a separate organizational channel entirely. A Census Bureau working paper from this April, covering more than 117,000 firms, finds AI adoption splitting the same way: workers experimenting task by task, formal adoption moving through business functions, the two paths barely touching. What accumulates in the interval between adoption and oversight is the part that's hard to see and harder to undo.

One Error's Anatomy

The $110 Million Cell

In 2009, researchers audited 25 operational spreadsheets across five organizations. One workbook at a large firm contained a cell wrong by $110,543,305, a 137.5% distortion. Built within the previous year and in active use, the error had survived normal operations undetected.

What struck the researchers wasn't the scale of the mistake. It was the culture around it. Most spreadsheet developers did no formal testing. Several acknowledged that certain formulas "weren't quite right" but accepted outputs that looked reasonable. Models had been inherited from predecessors or grown organically, accumulating logic nobody fully owned.

This is a thirty-year echo of a specific organizational choice. When VisiCalc arrived in 1979, it let business users encode decisions without waiting for programmers. Organizations gained speed. What they never built were the review structures that programmers would have brought with them. Independent formula audit is straightforward. In most organizations, it has always been nobody's job.

One Error's Anatomy

The $110 Million Cell

In 2009, researchers audited 25 operational spreadsheets across five organizations. One workbook at a large firm contained a cell wrong by $110,543,305, a 137.5% distortion. Built within the previous year and in active use, the error had survived normal operations undetected.

What struck the researchers wasn't the scale of the mistake. It was the culture around it. Most spreadsheet developers did no formal testing. Several acknowledged that certain formulas "weren't quite right" but accepted outputs that looked reasonable. Models had been inherited from predecessors or grown organically, accumulating logic nobody fully owned.

This is a thirty-year echo of a specific organizational choice. When VisiCalc arrived in 1979, it let business users encode decisions without waiting for programmers. Organizations gained speed. What they never built were the review structures that programmers would have brought with them. Independent formula audit is straightforward. In most organizations, it has always been nobody's job.

TAKE NOTE

Study: Powell, Baker, Lawson (2009) — 25 operational spreadsheets, 5 organizations, independently audited

Errors found: 117 confirmed; 70 with quantitative impact; 7 exceeding $10M

Testing practices: "Very few used any formal approach; most did no testing at all"

Developer awareness: Several knew formulas were wrong but saw outputs as acceptable

Complexity vs. controls: Tax-liability models at a major financial firm — calculating billions in obligations — were "astonishingly complex, difficult to understand, and error-prone"

Inheritance problem: Developers cited organic growth and inherited designs as primary reasons for poor structure

One counterexample: A small firm produced five error-free spreadsheets, described as "thoughtfully designed, well documented, easy to understand"

Applicable standard: Independent formula review — described in PCAOB auditing guidance, rarely implemented outside formal audits

The Losing Side

An Auditor Watches the Same Mistake Happen Twice

The Losing Side

An Auditor Watches the Same Mistake Happen Twice

Machinery and Mirror

What Broke Before the Spreadsheet Rules Arrived

Read the compliance checklist for spreadsheets in financial services as a record of what has already gone wrong, and each requirement resolves into a specific incident. A fabricated input that cost $691 million produced today's reconciliation mandates. A formula error that shifted $1.1 billion in reported equity produced the inventory and review requirements. Roughly twenty years separated widespread adoption from specific governance, and the governance arrived only after the failures did.

Machinery and Mirror

AI Diffusion Through Two Channels

Census data covering 117,000 firms shows 6.8% reporting that workers use AI for tasks while the firm itself doesn't register as an adopter. The spreadsheet precedent tells you what tends to happen when individual use outruns institutional oversight, and roughly how long governance takes to catch up. But agents call external tools and change records in systems their firm doesn't own, which is where the comparison stops being useful.

Machinery and Mirror

What Broke Before the Spreadsheet Rules Arrived

Read the compliance checklist for spreadsheets in financial services as a record of what has already gone wrong, and each requirement resolves into a specific incident. A fabricated input that cost $691 million produced today's reconciliation mandates. A formula error that shifted $1.1 billion in reported equity produced the inventory and review requirements. Roughly twenty years separated widespread adoption from specific governance, and the governance arrived only after the failures did.

Machinery and Mirror

AI Diffusion Through Two Channels

Census data covering 117,000 firms shows 6.8% reporting that workers use AI for tasks while the firm itself doesn't register as an adopter. The spreadsheet precedent tells you what tends to happen when individual use outruns institutional oversight, and roughly how long governance takes to catch up. But agents call external tools and change records in systems their firm doesn't own, which is where the comparison stops being useful.

Machinery and Mirror

What Broke Before the Spreadsheet Rules Arrived

Read the compliance checklist for spreadsheets in financial services as a record of what has already gone wrong, and each requirement resolves into a specific incident. A fabricated input that cost $691 million produced today's reconciliation mandates. A formula error that shifted $1.1 billion in reported equity produced the inventory and review requirements. Roughly twenty years separated widespread adoption from specific governance, and the governance arrived only after the failures did.

Machinery and Mirror

AI Diffusion Through Two Channels

Census data covering 117,000 firms shows 6.8% reporting that workers use AI for tasks while the firm itself doesn't register as an adopter. The spreadsheet precedent tells you what tends to happen when individual use outruns institutional oversight, and roughly how long governance takes to catch up. But agents call external tools and change records in systems their firm doesn't own, which is where the comparison stops being useful.

Further Threads