In this article, we explore 8 reasons to stop using spreadsheets to manage risk, and the additional threats this approach to risk management subjects businesses to. We also suggest a better, cost-effective alternative to spreadsheets.
For most organisations, maturing their risk management process can be difficult.
Many organisations start their risk management process with spreadsheets to document risk and countermeasures for compliance reasons. However, as the organisation grows, its risk analysis often doesn’t keep pace. Managing the risk assessment process with a spreadsheet can quickly become problematic and inefficient. Spreadsheets are fantastic for tracking sales, compiling lists, and making bar charts – but they were never designed for managing shifting risks.
There are agile alternatives that we’ll describe later. But first, let’s explore why spreadsheets do not work for risk management.
- Spreadsheets require a lot of manual input which detracts from the active management of risk. Teams sometimes believe that because risks have been recorded, the task of risk management is complete. This not only misses the point and exposes an organisation to poorly managed risk, but it also detracts from risk management as a key business driver. Additionally, those responsible for managing risk become seen as tick-boxes rather than integral to effective project delivery.
- The process of manual inputs makes it difficult to visualise and report risk. Long lists of risks fail to bring to life the challenges and indeed the success of mitigation strategies.
- It is difficult to apply countermeasures to one risk and actions for that same risk.
- Different versions of Excel can lead to confusion. Large organisations may require information from different spreadsheets to be merged and there is a risk of data loss. Recently the use of Excel XLS file format resulted in the loss of some 65,000 public records simply because this older format couldn’t handle the volume of data supplied so they simply fell off the bottom of the list. Prof Jon Crowcroft from the University of Cambridge commented at the time that:
“Excel was always meant for people mucking around with a bunch of data for their small company to see what it looked like.”
- Management teams and boards are legally obliged to sign off risk reports but can be exposed to incomplete, missing, or confusing data via spreadsheets.
- Spreadsheets are not designed for rapidly changing risk modelling and risk assessment. With information dispersed across users and possibly incomplete, it is incredibly difficult to gain actionable insight into risk and make accurate predictions and recommendations.
- Qualitative risk heat maps can be run in spreadsheets, but they do not provide a full picture of risk alone.
- Quantification risk methodologies such as Monte Carlo analysis can be run on spreadsheets, in principle, but the reality is that they take specialised knowledge to build.
RiskTree is a smart new SaaS tool for analysing risk. It’s agile, affordable and has the power to transform your risk analysis efforts.
It helps organisations with a systematic approach to identifying how their assets could be attacked, it quantifies those threats and enables rapid prioritising of risks quickly and effectively.
But that’s not all. RiskTree also shows you how risks will change once you implement controls, so you can make informed decisions about risk mitigation strategies now and in the future.
RiskTree eliminates the guesswork around risk to support strategic decision-making, prioritisation of resources and justification of expenditure to maximize ROI.
RiskTree has proven success supporting customers in highly regulated and targeted industries such as healthcare, and government.