05 · Prior art
Vibecoded software and the EUC precedent
Vibe coding, building software by describing it to a model, has put application development in the hands of anyone who can type, and most of what gets built never passes through IT. The nearest precedent is end-user computing: four decades of business-critical logic living in spreadsheets built by the people who needed them. That era is on the public record: what it cost, and which controls it eventually produced.
2013
The London Whale VaR model
JPMorgan's task force report records that the bank's new value-at-risk model "operated through a series of Excel spreadsheets, which had to be completed manually, by a process of copying and pasting data from one spreadsheet to another," and that a formula error, dividing by a sum instead of an average, "likely had the effect of muting volatility by a factor of two."
JPMorgan task force report (2013), pp. 123 and 128↗2013
The Reinhart-Rogoff growth paper
The replication by Herndon, Ash and Pollin found "coding errors, selective exclusion of available data, and unconventional weighting of summary statistics" behind the finding that high public debt stalls growth. Corrected, average growth for high-debt countries was 2.2 percent, not the published minus 0.1.
Herndon, Ash & Pollin, PERI WP322 (2013)↗2020
England's missing COVID cases
15,841 positive cases were left out of England's reported figures and delayed reaching contact tracers when files of results exceeded "a maximum file size" in Public Health England's data-load process, widely reported as the legacy Excel row limit.
PHE statement, gov.uk (4 Oct 2020)↗since 1999
The running list
EuSpRIG, the European Spreadsheet Risks Interest Group, has maintained a public register of documented spreadsheet incidents for over two decades.
EuSpRIG horror stories↗What the last era wrote down
The spreadsheet era produced a governance literature that is free, mature, and written for exactly the artefact class vibecoding now multiplies: logic that matters, built outside IT.
SR 11-7 Federal Reserve and OCC, 2011
The US supervisory guidance on model risk management: development, validation and governance expectations for models in banking.
federalreserve.gov↗Twenty Principles for Good Spreadsheet Practice ICAEW, 4th edition, 2024
Planning, design and control principles for spreadsheets, maintained by the accountancy body for over a decade.
icaew.com↗SS1/23 UK PRA, in effect May 2024
The UK model-risk framework for banks explicitly brings end-user computing applications and spreadsheet calculations into scope as models.
bankofengland.co.uk↗The analogy, argued both ways
for · Practical Ecommerce, Sept 2025
"Vibe Coding Is Ecommerce's New Excel": spreadsheets gave non-programmers a visual layer over maths and logic; vibe coding does the same for software.
source↗for · RoboCFO, June 2026
"A CFO who lets the team build without a governance framework trades shadow Excel for shadow code."
source↗against · Cloud Security Alliance, June 2026
The counter-view: vibe-coded apps often run on already-sanctioned platforms, so the shadow-IT playbooks the analogy suggests do not transfer.
source↗