Most businesses start managing compliance on spreadsheets. It makes sense — they're free, flexible, and everyone knows how to use them. But there comes a point where the spreadsheet stops being a tool and starts being a risk. Here are five signs you've crossed that line.

1. Nobody is sure which version is current

When your risk register or controls checklist lives in a shared drive, it gets downloaded, edited locally, re-uploaded, and duplicated. Within a few months you have four versions of the same document and no confidence about which one reflects reality. When your auditor asks for your current risk register, which file do you send?

2. Evidence is scattered across email threads and shared drives

ISO 27001 and Cyber Essentials both require evidence — screenshots, configuration exports, policy sign-offs, test results. If that evidence is spread across inboxes, Teams channels and random folders, pulling it together before an audit becomes a multi-day exercise in archaeology. That last-minute scramble is entirely avoidable.

3. Only one person actually understands it

Spreadsheet-based compliance programmes tend to become the personal project of whoever set them up. When that person goes on holiday, changes role, or leaves the business, the institutional knowledge walks out with them. A compliance programme that depends on one person is a single point of failure.

4. You can't answer basic questions quickly

"What's our current risk score?" "Which controls are failing?" "When did we last review our supplier list?" If answering any of these questions requires opening multiple files and cross-referencing tabs, your compliance programme is not giving you the visibility you need. Leadership and auditors both expect instant answers.

5. Your spreadsheet hasn't been updated in three months

Compliance is not a one-time exercise — it requires continuous review. If your spreadsheet is only touched in the weeks before an audit, you don't have a compliance programme. You have an audit preparation exercise. The difference matters, especially if you ever face an incident or a regulatory investigation.

What to do about it

The answer isn't necessarily a £15,000 enterprise platform. There are tools built specifically for SMBs and growing businesses that give you proper compliance management — risk registers, evidence tracking, audit trails, supplier questionnaires — without the complexity or cost of enterprise software.

If any of the above sounds familiar, it might be time to look at whether a dedicated compliance platform makes sense for your business.