>> ...And when it breaks (not if, when), guess who gets called to fix it?

>I'm not sure, honestly. It depends on whether you want the fix being done by a resource you consider to be a cost center or a value center. The former will do the cleanup job for bottom dollar. The latter would team up with Karen to amplify the project's impact while cleaning it up.

You're right that the answer is "it depends." In the world of risk management and audit, what Karen has created is called a "user-developed application." Her employer should give her a big pat on the back, and then take a step back to decide 1) if this Excel spreadsheet is mission critical, 2) if it is, who will maintain it, and 3) whether its importance justifies building a formal IT solution to support the business function (either in-house or using COTS software).

I agree that Karen did nothing wrong! She found a process that could be improved or automated, and was able to use technology to do it. If someone is caught off guard when the Excel file goes kaput, then that's not Karen's problem nor is it her fault; it's her employer's responsibility to pay attention to their own business requirements.