  This paper maintains that archiving has been overlooked as a key spreadsheet
internal control. The case of failed Jamaican commercial banks demonstrates how
poor archiving can lead to weaknesses in spreadsheet control that contribute to
operational risk. In addition, the Sarbanes-0xley Act contains a number of
provisions that require tighter control over the archiving of spreadsheets. To
mitigate operational risks and achieve compliance with the records-related
provisions of Sarbanes-Oxley, the author argues that organisations should
introduce records management programmes that provide control over the archiving
of spreadsheets. At a minimum, spreadsheet archiving controls should identify
and ensure compliance with retention requirements, support document production
in the event of regulatory inquiries or litigation, and prevent unauthorised
destruction of records.
