In April 2012, a JPMorgan risk report understated the firm's exposure because it ignored a $400 million loss that had happened that same day. Nobody faked the number. A spreadsheet formula referenced the wrong cells, the loss dropped out of the calculation, and the report went out looking exactly like every other day's report.
The error was caught and fixed within days. But because it looked like an isolated glitch, nobody went looking for what else in that model might be wrong. Months later, a task force reviewing the incident found a second defect: a formula that divided a change in value by the sum of two numbers instead of their average, which had been quietly muting the bank's reported volatility by roughly half. A model built to flag rising risk had spent months understating it.
A dashboard is the last mile of a trust problem
By the time a number reaches a chart, whatever produced it, the joins, the manual overrides, the unit conversions, is invisible. The chart can look internally consistent and still be answering the wrong question, because consistency is a property of formatting, not of correctness. JPMorgan's risk dashboards stayed internally consistent for months. That consistency is exactly what let the errors survive long enough to matter.
This is also why counting errors is close to useless as a risk signal. A widely cited 2009 audit of 25 real operational spreadsheets from five companies confirmed 117 errors, and 40% of them changed nothing, zero measurable effect on the output. The one that mattered wasn't the 47th harmless error. It was a single mistake that shifted an output by more than $110 million. Frequency and consequence turned out to be almost unrelated.
The record that changes the conversation
JPMorgan's case has a second lesson buried in the aftermath: regulators later found the bank's Audit Committee hadn't been told, before a quarterly filing, that the pricing process behind those numbers had been compromised. That's not a spreadsheet problem. Nobody had written down what had been checked, what hadn't, and what was still an open question, so there was nothing to hand to the people whose job was to ask.
A decision record closes that gap without becoming a compliance exercise. It doesn't need to be long: what was checked, what was fixed, what was deliberately left alone and why, and who owns the parts nobody's verified yet. When that record exists and someone's actually read it, the question in the room stops being "are you sure?" and starts being "what's still open?", which is a faster conversation and a more honest one.
A dashboard that's internally consistent isn't the same as a dashboard that's been checked. JPMorgan's was consistent for months.