R026 — Missing Input Validation
Executive Summary
Key Takeaways
- ✓ R026 checks numeric input cells on identified input sheets for Excel data validation coverage — a constraint on what can be typed into the cell.
- ✓ An uncovered input cell allows any value, including an out-of-range or nonsensical one, to be entered with no in-model guard against the error.
- ✓ When more than a high proportion of a sheet's numeric input cells lack validation, R026 emits a single sheet-level summary finding instead of one finding per uncovered cell, to avoid an unreadable wall of near-identical findings.
- ✓ Below that proportion, individual per-cell findings are produced, since a sparse gap is more useful addressed cell by cell.
Purpose¶
R026 checks numeric, non-formula cells on a model's identified input sheets for Excel data validation coverage — whether a constraint is applied to what can be typed into the cell.
Detection Logic¶
For each identified input sheet, every numeric, non-formula cell is checked against the sheet's recorded data validation ranges. Cells not covered by any validation range are counted. If the proportion of uncovered cells on a sheet exceeds a high threshold, a single sheet-level summary finding is produced, naming the uncovered count against the total and the resulting coverage percentage. Below that threshold, an individual finding is produced for each uncovered cell.
Why It Matters¶
An input cell with no data validation rule accepts any value a user types, including one outside the range the model's author actually intended — a negative growth rate where only positive values make sense, a percentage entered as a whole number instead of a decimal, or a date far outside the model's intended horizon. Without a validation rule, none of these entry errors are caught at the point of entry; they simply flow into the model's calculations and can produce a materially wrong result with no visible warning that the input itself was implausible.
Evidence Produced¶
For a sheet-level finding, the evidence names the sheet, the count of uncovered cells against the total, and the resulting coverage percentage. For an individual per-cell finding, the evidence identifies the specific sheet and cell address, its current value, and a description noting the absence of a validation rule.
Severity¶
Medium. Weight 6.0. R026 is not one of the five critical-override rules. Confidence is always medium.
Example¶
Trigger — sheet-level. An input sheet has 30 numeric input cells, of which 27 (90%) carry no data validation rule. R026 produces a single sheet-level finding naming the 27-of-30 gap.
Trigger — per-cell. A different input sheet has 20 numeric input cells, of which 3 lack validation. Since this falls below the high-gap threshold, R026 produces three individual findings, one per uncovered cell.
Non-trigger. An input cell covered by an Excel data validation rule constraining it to a sensible range. R026 does not fire for this cell, regardless of what value currently happens to be entered in it.
Recommended Remediation¶
Apply an Excel data validation rule to every numeric input cell, constraining accepted values to the range the model's logic actually expects (for example, a percentage between 0 and 100, or a date within the model's intended horizon), so an out-of-range entry is caught immediately at the point of entry rather than silently propagating into the model's calculations.
Related Rules¶
R026 shares the Model Governance taxonomy category with the other Model Governance rules published in the Rule Reference, and is closely related in concept to R024 — Unused Input Driver, since both evaluate the same identified input-sheet layer for a distinct governance concern — see the Rule Taxonomy page for the full category membership.
Related Articles¶
No existing Knowledge Centre technical guide addresses input-validation coverage specifically as of this writing; this section will be updated with a link in the same edit that publishes one.
Version History¶
No version-specific changes to R026's severity, weight, or category are recorded as of engine version 2.1.0. This section will be updated in the same edit as any future change to the rule's declared attributes.
How OXXON tests thisRun a free structural check with FMAE
Frequently Asked Questions
What does FMAE rule R026 check for?
Numeric, non-formula cells on a model's identified input sheets that have no Excel data validation rule applied — meaning any value, including one outside a sensible range, can be typed into the cell without any in-model check catching it.
Why does R026 sometimes report one finding for a whole sheet instead of per cell?
When most of a sheet's numeric input cells lack validation, listing every individual cell would produce an unreadably long, repetitive set of findings for what is really one governance gap — the sheet as a whole has no validation discipline. Below that threshold, individual per-cell findings are more useful, since the gap is sparse enough to address cell by cell.
Does R026 check every numeric cell in the model?
No. It only evaluates numeric, non-formula cells on worksheets already identified as the model's input layer — the same input-sheet identification used by R024.
Related Articles
FMAE Rule Taxonomy
Every rule in the FMAE structural rule pack declares a category attribute at the point it is defined in source — this is not a classification imposed on the rules afterward for documentation purposes, it is the classification the engine itself uses. Six categories cover all 26 rules — Structural (18 rules), Assumptions Governance (1), Integrity Controls (2), Structural Hygiene (1), Aggregation Logic (1), and Model Governance (3). This page publishes that taxonomy as the FMAE equivalent of a control catalog's classification scheme, cross-linked to the Rule Reference page for each member rule.
Finding Data Model & Confidence
Every FMAE finding carries the same fixed structure — which rule triggered it and that rule's identity at the time it ran, its evidence, a narrative explanation, and a confidence label of high, medium, or low. Confidence is a deterministic categorical label derived from how strongly a row's cells agree on a pattern, not a machine-learning probability estimate. Stating this plainly matters, since describing FMAE's confidence as AI-derived or probabilistic would overstate what the engine actually does.
R024 — Unused Input Driver
R024 (Unused Input Driver) flags a numeric, non-formula cell on a worksheet already identified as a model's input layer that no formula anywhere in the model actually references. An input that cannot be traced to any output is either a stale assumption that was never connected, or a driver that was intended to feed a calculation but was silently missed. Confidence is deliberately kept low, since the engine only resolves single-cell references and cannot see a driver consumed only through a range formula or an Excel data table.