  The Sarbanes-Oxley Act of 2002 has finally forced corporations to examine the
validity of their spreadsheets. They are beginning to understand the
spreadsheet error literature, including what it tells them about the need for
comprehensive spreadsheet testing. However, controlling for fraud will require
a completely new set of capabilities, and a great deal of new research will be
needed to develop fraud control capabilities. This paper discusses the
riskiness of spreadsheets, which can now be quantified to a considerable
degree. It then discusses how to use control frameworks to reduce the dangers
created by spreadsheets. It focuses especially on testing, which appears to be
the most crucial element in spreadsheet controls.
