During an audit of a financial reporting process, an IS auditor discovers that the finance department relies on a complex spreadsheet with embedded macros to consolidate quarterly figures fed into the general ledger. The spreadsheet is stored on a shared drive, edited by several analysts, and has no version tracking or formula-lock protection. Which risk should the auditor identify as the MOST significant?