Dan wrote...
I'm in the middle of a SOX audit and one of the issues that came up
was Excel reports used for journal entries in our ERP. We were told
that we will need to validate Excel in order to use our spreadsheets
and also be in compliance with SOX. . . .
....

Shouldn't your auditors be able to provide you with (1) precise
guidance on what validation entails and (2) some practical advice on
what they expect you to do?

From my perspective, validation is NOT the same as protection. I'd
have thought validation means PROVE the workbook(s) produce CORRECT
results by verifying that ALL formulas do what they're supposed to do,
and it wouldn't hurt to document where input data comes from.