Skip to content
Request Demo

R010 — High Fan-In Hardcodes

Rule-Reference • — • 4 min read

Audience
Technical Reviewers • Auditors • Model Developers
Last Reviewed
July 2026
Updated
Version 1.0

Executive Summary

R010 (High Fan-In Hardcodes) targets a specific, higher-stakes case of a hardcoded value — one whose downstream reach is unusually wide. Rather than a fixed severity, R010 classifies the worksheet the cell sits on, the cell's local context (is it more likely an intended input, a lookup value, an interface control, or an embedded calculation constant), and how many downstream cells and worksheets the value's influence reaches, and derives severity and remediation guidance from that combined picture.

Key Takeaways

  • R010 targets hardcoded cells whose downstream reach is unusually wide — feeding an above-threshold number of dependent formula cells.
  • Severity is not fixed. It is derived from the worksheet's classification, the cell's local context, and how many downstream cells and sheets the value's influence actually reaches.
  • A hardcoded value context-classified as a likely intentional input carries markedly lower severity than the same hardcoded value sitting inside a calculation-heavy worksheet.
  • R010 is distinct from R001 — R001 targets a hardcode breaking a row's formula pattern; R010 targets any hardcode (in or out of a consistent row) whose downstream fan-in is unusually high.

Purpose

R010 flags a hardcoded cell whose downstream reach is unusually wide — one feeding more dependent formula cells than a fan-in threshold. It is a distinct check from R001 (Hardcoded Cells): R001 flags a hardcode because it breaks a row's consistent formula pattern; R010 flags a hardcode because of how far its influence reaches, independent of whether it sits in a consistent row at all.

Detection Logic

Every hardcoded cell whose direct dependent count exceeds a fan-in threshold is examined further along three dimensions: the structural classification of the worksheet it sits on (an Input or Interface sheet suggests the value is an intentional, managed assumption; a Calculation sheet suggests it is more likely an embedded constant that should have been an input reference); the cell's immediate local context (how formula-dense its neighborhood is); and the scale of its downstream influence (how many cells and worksheets are transitively affected). Severity and remediation guidance are derived from the combination of these signals rather than fixed — the same hardcoded value can be flagged as a low-severity, likely intentional input in one context and a high-severity embedded constant in another.

Why It Matters

A hardcoded value that feeds only one or two formulas is a contained risk. A hardcoded value that feeds dozens of downstream cells across multiple worksheets means that if the value should have been a controlled, changeable input — and is not — every one of those downstream cells is silently locked to a value that cannot be updated except by finding and editing this one specific cell directly, with no visible indication elsewhere in the model of how far its influence spreads.

Evidence Produced

A triggered R010 finding's evidence identifies the specific cell, states its direct and transitive downstream dependent counts, the number of worksheets its influence reaches, the worksheet's structural classification, the cell's classified local context, and the specific signals that informed that classification — so a reviewer can see not just that the cell is high fan-in, but why it was, or was not, judged likely to be an intentional input.

Severity

High (class-level default; per-finding severity is context-derived, ranging from an informational note for a confidently classified intentional input up to high for an embedded constant reaching a wide, cross-sheet audience). Weight 7.0. R010 is not one of the five critical-override rules.

Example

Trigger. A cell on a worksheet classified as Calculation contains a hardcoded discount rate that feeds 40 downstream formula cells across 4 separate worksheets, including a valuation summary sheet. R010 flags this cell at high severity: the worksheet context and wide, cross-sheet downstream reach both point away from an intentional, well-placed input.

Non-trigger context (still evaluated, lower severity). The same fan-in count, but the cell sits on a worksheet classified as Input, alongside data validation and named ranges consistent with a managed assumption register. R010 still evaluates the cell but assigns a markedly lower severity, since the surrounding context strongly suggests this is an intentional, properly located input rather than an embedded constant.

Where the context suggests an embedded constant rather than an intentional input, extract the value into a named, controlled input cell and update every downstream formula to reference it, following the same remediation pattern as R001. Where the context already suggests an intentional, well-placed input, confirm that classification is correct rather than treating the finding as an automatic defect.

R010 shares the Structural taxonomy category with the other Structural-category rules published in the Rule Reference, and is closely related in concept to R001 — Hardcoded Cells — see the Rule Taxonomy page for the full category membership.

Version History

No version-specific changes to R010's severity, weight, or category are recorded as of engine version 2.1.0. This section will be updated in the same edit as any future change to the rule's declared attributes.

How OXXON tests thisRun a free structural check with FMAE

Frequently Asked Questions

How is R010 different from R001?

R001 flags a hardcoded value specifically because it breaks an otherwise-consistent row formula pattern. R010 flags a hardcoded value because of how many downstream formula cells depend on it, regardless of whether it sits in a consistent row — the two rules examine different structural signals and can each fire independently on different cells.

Does every hardcoded input cell get flagged by R010?

No. R010 only evaluates hardcoded cells whose direct dependent count exceeds a fan-in threshold, and even then derives a severity that can be as low as an informational note when the surrounding context strongly suggests an intentional, well-placed input.

What signals does R010 use to judge whether a hardcode is likely an intended input?

The classification of the worksheet it sits on (an Input or Interface sheet suggests intentional use), whether the sheet has data validation or named ranges, the sheet's overall formula-to-constant ratio, and the formula density of the cell's immediate neighborhood.

Related Articles

FMAE Rule Taxonomy

Every rule in the FMAE structural rule pack declares a category attribute at the point it is defined in source — this is not a classification imposed on the rules afterward for documentation purposes, it is the classification the engine itself uses. Six categories cover all 26 rules — Structural (18 rules), Assumptions Governance (1), Integrity Controls (2), Structural Hygiene (1), Aggregation Logic (1), and Model Governance (3). This page publishes that taxonomy as the FMAE equivalent of a control catalog's classification scheme, cross-linked to the Rule Reference page for each member rule.

Finding Data Model & Confidence

Every FMAE finding carries the same fixed structure — which rule triggered it and that rule's identity at the time it ran, its evidence, a narrative explanation, and a confidence label of high, medium, or low. Confidence is a deterministic categorical label derived from how strongly a row's cells agree on a pattern, not a machine-learning probability estimate. Stating this plainly matters, since describing FMAE's confidence as AI-derived or probabilistic would overstate what the engine actually does.

R001 — Hardcoded Cells

R001 (Hardcoded Cells) flags a formula cell that has been overridden by a typed numeric value, in a row where the surrounding cells otherwise share a clear, dominant formula pattern. It is critical severity, carries the highest weight of any FMAE rule (15.0), and is one of five critical-override rules under the SM-2.0 scoring methodology — meaning a single R001 finding caps the model's overall letter grade below A or B regardless of its numeric score.

Hardcoded Formulas in Financial Models

A hardcoded value in a financial model is a fixed numeric value embedded directly within a formula cell, rather than being referenced from a dedicated input or assumption cell. Hardcoded values in formula cells are a structural risk because they do not update when the model's assumptions change, they are invisible during normal model navigation, and they cannot be changed consistently through the model's standard input interface. The ICAEW Financial Modelling Code and the FAST Standard both explicitly prohibit hardcoded values within formulas, requiring that all input values be entered in a dedicated input cell and referenced by formulas rather than embedded within them.

Request Demo