The time to replace spreadsheets with software is the first time a mistake in one costs you money, or the first time someone outside the business asks for the audit trail. Size has nothing to do with it. A spreadsheet is a good calculator and a poor system of record: once two or more people edit it and it drives invoices, schedules, stock or compliance, it has become a business system with no owner, no permissions, no validation and no record of who changed what. The errors that follow are documented, and some of them are enormous. The replacement does not have to be.
When should a business replace spreadsheets with software?
When the spreadsheet has started doing a system's job. One of four signs is enough. More than two people edit it. A downstream process depends on it: the invoice, the rota, the compliance return, the stock count. Somebody spends most of their day keeping it up to date. Or a regulator, auditor or customer can ask to see how a number was arrived at, and you would have to reconstruct it.
HMRC has written the fourth sign into law. Under Making Tax Digital, data has to move between your records and your return through a digital link, and HMRC does not consider copy and paste a digital link. Spreadsheets are allowed as records, but only joined up by linked cells or bridging software, and the rule reached sole traders and landlords with income over £50,000 on 6 April 2026. Re-keying is non-compliant, in the regulator's own words.
The ordinary case is a building contractor. The site team fills in a job sheet in Excel on a tablet when the job is done and emails it to the office. The works diary is a shared spreadsheet that one or two people in the office keep straight. The invoice is typed up from both. Nobody involved thinks Excel has done a bad job, and they are right; it has been doing it for years. The trouble is that the job sheet, the diary and the invoice have become three copies of the same information, each typed by hand, and the office spends its day reconciling them.
How often do spreadsheets contain errors?
Almost always, once they are big enough to matter. Raymond Panko's synthesis of field audits for the European Spreadsheet Risks Interest Group (2015) pooled six studies in which auditors spent days on each of 85 operational spreadsheets, and found errors in 94 per cent of them. Cell error rates run at 1 to 5 per cent, which sounds small until you have a thousand cells, and Panko's abstract adds that developers and corporations "are highly overconfident in the accuracy of their spreadsheets".
The incidents bear it out. Norway's sovereign wealth fund used the wrong month's country weights in its bond benchmark calculation from December 2021 until a check caught it in February 2023; the Supervisory Council's report puts the loss against the mandate at NOK 984 million. Milton Keynes City Council's draft budget for 2025-26 stated an estimate of £5.6 million that should have been £4.002 million, because a cell was linked to the wrong cell. In October 2020 Public Health England left 15,841 Covid cases out of the daily figures because files in the reporting pipeline "exceeded the maximum file size", a landmark everyone remembers as the Excel row limit.
None of those organisations was careless. Each had a check, and the check sat outside the file.
What goes wrong that nobody can see?
The file carries data its author cannot see, and the regulator has said so. In August 2023 a Police Service of Northern Ireland analyst answered a freedom of information request by deleting the visible tabs from a workbook; a worksheet off-screen held the names of 9,483 officers and staff, and it was public for two hours and twenty minutes. The ICO's penalty notice (September 2024) fined the force £750,000, said the fine would have been £5.6 million for a private body, and put the cause down to "a lack of simple internal administration procedures".
Southend-on-Sea City Council released a spreadsheet with hidden personal data on more than 2,000 people in 2023 even though two members of staff had checked it. Hammersmith and Fulham's FOI response carried 35 hidden workbooks with 6,528 people's details, 2,342 of them children, for almost two years before anyone noticed. In September 2023 the ICO advised every public authority to stop releasing source spreadsheets and convert them to CSV, because the format itself was the hazard.
The lesson for a business is the Southend one. "Someone double-checks it" is not a control when the tool hides what it holds.
What does a spreadsheet lack that a system has?
Six things, each with a public failure to its name.
What a system has | What the spreadsheet had instead | The incident |
|---|---|---|
One record, entered once | Three copies, typed by hand | A contractor's job sheet, diary and invoice |
Validation at the point of entry | A cell that accepts anything | Milton Keynes: £5.6m for £4.002m |
Permissions by role | Everyone edits everything | ICAEW principle 20: manage access levels |
An audit trail of who changed what | No history | Norges Bank: fourteen months before a check caught it |
Digital links to accounts and HMRC | Copy and paste | HMRC: not a digital link |
Visibility of everything it holds | Hidden sheets and pivot caches | PSNI, Southend, Hammersmith and Fulham |
The accountants' own guidance is that table in another form. ICAEW's Twenty Principles for Good Spreadsheet Practice (fourth edition, May 2024) asks you to "determine if a spreadsheet is a suitable tool" (principle 4), to build in "checks, controls, and alerts from the outset" (17), to run version control (19) and to manage access levels (20). A spreadsheet that met all twenty would be a database with worse permissions. The National Audit Office made the same point about a £15.9 billion Help to Buy loan book in July 2025: valued in "a spreadsheet application" that had to be "split over multiple workbooks due to size", with "a high degree of manual intervention", and therefore a significant risk of material misstatement.
Does the replacement have to be big?
No, and bigger has its own failure mode. Williams Racing managed around 20,000 car parts on an Excel list that its team principal called "a joke" in March 2024. It replaced the sheet with an enterprise resource planning system, and by September 2026 had pulled part of that system out because "it was hurting us, not helping us", while staying off Excel. The right replacement is the size of the process, not the vendor's catalogue.
For most businesses we build for, the process is a job, an order, a case or a property, and the system is one record of it with the rules attached. For the contractor, that record is the job: the site team's sheet, the works diary and the invoice all come off it, and the screens keep the colour coding and columns of the spreadsheet they replaced, because the office already knows how to read them. One client's invoicing cycle went from six weeks to six hours on that principle. A business system of that kind typically costs £15,000 to £60,000 excluding VAT, with a first phase between £15,000 and £25,000 and live in 8 to 12 weeks; the full breakdown is published. The connection to Xero or Sage is usually part of the build, and integrations are where the price moves, so the spreadsheet that talks to your accounts package is the first one to look at.
If a two-week discovery finds that an off-the-shelf tool does most of the job, or that the spreadsheet is fine, that is the recommendation you get. Excel is brilliant. It is not a system of record.