Spreadsheet Dependency Audit: 12‑Point SME Checklist

(purpose of the checklist)

Give SME leaders a structured spreadsheet audit so you can see where Excel is fine – and where it has become a commercial risk.
Help you decide what can safely stay in spreadsheets and what must move to automated systems in the next 6–12 months.
Turn “we know we rely on spreadsheets too much” into a prioritised workflow automation audit, with clear next steps.

Most UK SMEs run on a quiet layer of spreadsheets that nobody has fully mapped.

They started as quick fixes: a tracker here, a calculator there, something your predecessor built for “just this quarter”. Years later, they are effectively core systems – running invoicing schedules, stock control, pipeline forecasting, payroll journals and regulatory reports.

That’s where the real risk sits. Not in “we use Excel”, but in Excel dependency: processes where a single workbook, often owned by one person, has become a critical part of how money moves through the business.

When those workbooks break or their owners leave, the damage is rarely theoretical. We routinely see:

Missed renewals and discounts because a manual contract tracker wasn’t updated.
Incorrect VAT totals from a complex finance spreadsheet being copy‑pasted into HMRC submissions.
Supply chain decisions made on stale stock data because the “master” spreadsheet was last refreshed a week ago.

This checklist is designed to expose that dependency. It will not tell you to rip out every spreadsheet. Some are healthy and efficient. But it will show you which ones cross the line from helpful tool to structural risk – and therefore belong in a more robust, automated system.

We use a similar structure in our own AI workflow audit and AI readiness scorecard at SIMARA AI when we assess London SMEs. The goal is always the same: identify the 10% of processes where automation and proper systems generate 90% of the risk reduction and ROI.

1. Is this spreadsheet a single point of failure?

What it is
You’re looking for any spreadsheet where one person is the only real owner: they build it, understand it, update it and fix it when it breaks.

Why it matters
When knowledge is concentrated in one head, you have a people risk problem, not a tooling problem. If that person is off sick, leaves, or simply makes a tired mistake on a Friday afternoon, entire workflows can stall. In small businesses this often shows up as:

Delayed invoicing because only one finance officer understands the billing template.
Recruitment offers held up because the salary and approval tracker is locked to one laptop.

This is a core excel dependency risk UK pattern. According to UK SME surveys, staff turnover in admin roles is around 15–20% annually in London [rough estimate based on HR industry data, 2024]. Basing critical processes on one person’s spreadsheet memory is not governance – it is luck.

Actionable step
For each major spreadsheet you identify:

List the people who can fully explain and change it safely (not just “type into the yellow cells”).
If that list has fewer than two names, mark this file as Red: single point of failure.
Red‑labelled sheets are candidates to either:
- move into a shared, governed system (for example Xero, HubSpot, SharePoint List, Airtable), or
- be rebuilt as a simple workflow in an automation platform such as Microsoft Power Automate or Make.

If you are unsure where to move it, treat this as an input into a broader workflow automation audit, not a trigger for rushed replacement.

2. Does it drive money, compliance, or just convenience?

What it is
Classify each spreadsheet by what it touches:

Money‑critical: invoicing, payroll, VAT, revenue forecasts, stock valuations, rebate calculations.
Compliance‑critical: HR records, GDPR consents, health and safety logs, ISO/quality evidence.
Convenience‑only: internal lists, to‑dos, ad‑hoc analysis.

Why it matters
Not all dependencies are equal. A broken lunch‑order sheet is annoying. A broken VAT workbook is expensive. HMRC penalties, mis‑paid staff, incorrect statutory accounts – these are regular problems for SMEs [HMRC, 2024].

Our process priority matrix prioritises processes by impact × frequency. Money‑critical and compliance‑critical spreadsheets score far higher because errors feed straight into your P&L and regulatory risk.

Actionable step
For every spreadsheet you find:

Tag it as Money / Compliance / Convenience.
Anything tagged Money or Compliance and used weekly or daily should be assessed for migration into a proper system:
- Finance: Xero / QuickBooks / digital approval tools.
- HR: HRIS such as Breathe HR or Personio.
- Compliance: SharePoint Lists, Notion databases, or sector systems.

If you’re unsure, use this simple rule of thumb:

If an error could plausibly cost you more than £2,000 in a year (rough estimate), the process should not live primarily in Excel.

3. How often is the spreadsheet manually updated or re‑keyed?

What it is
Count the manual touches: data copied from emails, exported from systems, typed from paper, or reconciled line by line.

Why it matters
Each manual touch is:

A cost: time × fully loaded hourly rate (salary × ~1.3 for NI and benefits [rough estimate based on UK HR benchmarks, 2024]).
An error risk: mis‑types, missed lines, wrong columns.

We often see London SMEs where someone spends 4–8 hours each week “updating the sheet” – usually on Fridays. That is a direct opportunity to replace spreadsheets with systems or at least with automated data flows. Tools such as Power Query in Excel, or data syncs built in Zapier or Make, can pull data from Xero, HubSpot or Shopify automatically.

Actionable step
For each major spreadsheet, estimate:

Hours per week spent updating it.
Number of manual re‑key or copy‑paste steps.

Use this simple rule:

If more than 2 hours a week are spent on manual updates, or there are 3+ manual sources being combined, mark the spreadsheet as automation candidate.
Feed these candidates into your automation roadmap. This is exactly where our three‑phase implementation model starts: map → pilot → scale.

4. Is it the “single version of the truth” or one of many conflicting files?

What it is
Look for cases where multiple versions of a similar spreadsheet exist: “Sales Forecast v4 – Final – New 2024”, “Copy of FINAL”, and so on.

Why it matters
When multiple spreadsheets fight over reality, decisions slow down or are made on stale data. In our work with SMEs on creating a single version of the truth, we often find:

Different teams keeping their own customer lists because they don’t trust the CRM.
Finance and sales arguing over which forecast is “the right one”.

This is a classic IT governance small business UK problem: who owns the data, and what is the master source?

Actionable step
Run this quick test for each data domain (customers, suppliers, stock, employees):

Is there a designated system of record? (for example CRM for customers, Xero for invoices.)
Are spreadsheets derived reports from that system, or competing masters?

If you find competing masters:

Decide which system should be the source of truth.
Freeze the other spreadsheets as read‑only archives.
Plan a migration or integration so that required fields live in the system:
- For example, use Power Automate to sync new customer data from web forms directly into CRM rather than into a spreadsheet first.

For more on re‑designing these flows, see how we approach it in our guide on building a single version of the truth for SMEs.

5. How complex are the formulas, macros and hidden logic?

What it is
Examine the technical complexity of each spreadsheet:

Nested formulas spanning multiple tabs.
Hidden sheets, named ranges, VBA macros or scripts.
Password protection with no documentation.

Why it matters
Complex logic is hard to test and almost impossible to hand over. When the author leaves, the spreadsheet effectively becomes “frozen software” running your business, with no maintenance path.

Spreadsheets with macro‑heavy logic are often better recast as:

A small application (for example Power Apps on top of Microsoft 365).
A workflow in an automation platform (Power Automate, Make, n8n).
Configuration inside a proper SaaS tool – for example, modelling pricing rules in HubSpot rather than in a pricing workbook.

Actionable step
For each core spreadsheet, score complexity 1–5:

Simple: sums and filters only.
Moderate: some VLOOKUP/XLOOKUP, pivot tables.
High: macro‑driven, multi‑sheet, external references.

Score 1–2: fine to keep in Excel, but document owner and purpose.
Score 3–4: review annually and document the logic.
Score 5 (and used for money or compliance): schedule a project to rebuild this logic in a governed system within 6–12 months.

6. Is there clear ownership, documentation and change control?

What it is
Governance basics for each important spreadsheet:

Named owner.
Documented purpose, inputs, and outputs.
Simple notes on how and when it is updated.

Why it matters
Without this, you have shadow systems – ungoverned tools that behave like production systems but live outside your IT controls. Our analysis of shadow systems in SMEs shows that these are often where the worst errors and rework originate.

Actionable step
For your top 10–20 spreadsheets:

Create a one‑page register: name, location, owner, purpose, update frequency, data sources.
If any money‑critical or compliance‑critical sheet has no named owner or no documentation at all, mark it as governance gap.

Then apply a simple rule:

If a spreadsheet is important enough to run payroll, VAT or stock, it is important enough to have:
- Named owner.
- Versioning via OneDrive/SharePoint or Google Drive.
- A lightweight change log (what changed, when, by whom).

If this feels over the top for Excel, that’s a signal in itself: the process probably belongs in a system with built‑in audit trails.

7. How many people touch or depend on it each week?

What it is
Count both editors (who change it) and consumers (who read or download it) in a typical week.

Why it matters
The more people rely on a spreadsheet, the higher the coordination cost and the risk of accidental damage. We see this especially in:

Shared sales trackers that half the team updates and everyone filters differently.
Operations schedules where any edit can knock formulas out of alignment.

As your SME grows from 10 to 50+ people, these high‑touch spreadsheets quietly become a drag on collaboration.

Actionable step
For each spreadsheet, estimate:

Number of editors per week.
Number of viewers per week.

Apply this rule:

If more than 5 editors or more than 15 regular viewers, and the sheet is used weekly or daily, it likely wants to be:
- A shared system view in your CRM, ERP or project tool, or
- A dashboard or report generated from a database.

Tools such as Power BI, Looker Studio, or reporting views inside platforms like Xero and HubSpot are built precisely to replace these multi‑user reporting sheets with something auditable and refreshable.

8. Does it contain personal data under UK GDPR?

What it is
Any spreadsheet storing personal data:

Employee details, salaries, performance notes.
Customer names, emails, addresses, complaint details.
Supplier contact information combined with contract terms.

Why it matters
Under UK GDPR, you must safeguard personal data, control access, and ensure proper retention and deletion. Spreadsheets emailed around or stored on laptops are hard to monitor and easy to leak [ICO, 2024].

From an IT governance small business UK standpoint, unmanaged Excel files with personal data are a frequent weak point in ICO investigations.

Actionable step
For each spreadsheet, mark whether it includes personal data.

If yes, and it is stored outside centrally managed storage (for example local desktop, personal Dropbox), plan to:
- Move it into secure, access‑controlled storage (SharePoint, Google Drive, or a dedicated HR/CRM system).
- Restrict access to those who genuinely need it.
- Replace it over time with system modules that have proper roles, audit logs and retention settings.

Automated workflows that route this data (for example HR approvals or customer onboarding) should be designed with clear data processing records. We build this into our AI readiness scorecard assessments because it is a prerequisite for safe automation.

9. How often does it break, go wrong, or need patching?

What it is
Look at the operational history:

How many times in the last 12 months has the spreadsheet produced wrong numbers?
How often has someone had to “fix the formulas” or recover from an overwritten tab?

Why it matters
Repeat failure patterns are a sign that the spreadsheet has outgrown its original purpose. We see this especially with:

Forecast models being extended year after year instead of rebuilt.
Stock or job trackers being stretched to handle more locations, teams or product lines.

Each patch adds fragility. At some point you are not maintaining a tool – you are running your business on a series of hot‑fixes.

Actionable step
For each high‑impact spreadsheet, answer:

Number of known incidents (errors discovered) in the last year.
Severity: minor inconvenience vs delayed invoices, under‑billing, or compliance risk.

Apply this rule:

If there have been more than 3 incidents in a year, or a single high‑severity incident, mark the spreadsheet as unreliable.
Unreliable spreadsheets should be targeted for:
- Simplification (narrowing scope), or
- Replacement with an automated system or database plus reporting layer.

This is where our AI readiness scorecard “cost of inaction” dimension comes in: add up the lost hours and direct costs to justify the migration.

10. Is it doing operational workflow, not just analysis?

What it is
Identify whether the spreadsheet is:

Analytical: used for reporting, modelling, one‑off analysis.
Operational: used to run day‑to‑day workflows – approvals, schedules, task hand‑offs, job status, and similar.

Why it matters
Spreadsheets are excellent analysis tools. They are poor workflow engines. When used to manage live workflows, they cause:

Constant version sync issues (“Have you refreshed the sheet?”).
No built‑in notifications, SLAs or escalation.
No audit history of who changed what when.

This is the point where you want to replace spreadsheets with systems or automated workflows. Systems such as Monday.com, Airtable, or Microsoft Lists exist specifically to handle structured operational data with better controls and collaboration.

Actionable step
Tag each spreadsheet as Analytical or Operational.

Analytical spreadsheets can generally stay, but consider automating their data refresh.
Operational spreadsheets used daily or by more than three people should be shortlisted for:
- Migration to a workflow tool (for example Teams + Power Automate + SharePoint List).
- An AI‑assisted workflow where repetitive steps (notifications, approvals, document creation) are automated.

We explored how to choose between workflow tools and bespoke automation in detail in our workflow automation buyer’s guide for UK SMEs.

11. What is the time and error cost of keeping it in Excel?

What it is
For the highest‑risk spreadsheets you’ve identified, roughly quantify:

Hours per week spent on this process.
Average loaded hourly cost of the people doing it (for example £25–£45 for admin, £55–£85 for specialists in London [rough estimate based on salary data, 2025]).
Error rate (for example number of corrections, disputes, or rework tasks per month).

Why it matters
This is where you put a number on the spreadsheet dependency risk. Using our ROI calculator template:

Monthly savings = (weekly hours × hourly cost × 4.33) × automation coverage

Even partial automation (60–80% coverage is typical for SMEs) can produce rapid payback if the process is frequent and high‑cost.

Actionable step
For each risky spreadsheet:

Estimate the weekly hours and error cost.
Assume a conservative automation coverage of 60% to start.
Run the maths:
- If payback on moving this into an automated system is under 18 months, it is usually worth doing.
- If payback is over 24 months, re‑examine whether you are over‑engineering the replacement.

If you want to go deeper, plug these into an AI ROI model like the one we use in our AI ROI calculator for UK SMEs, but a basic calculation is enough to rank your priorities.

12. Can this spreadsheet become a better system in under 8 weeks?

What it is
A practical feasibility test: of the spreadsheets you’ve marked as risky or costly, which ones can be turned into:

A configuration inside an existing tool you already pay for.
A light database + workflow in your Microsoft 365 or Google stack.
A small, targeted automation built in 4–8 weeks.

Why it matters
Not every spreadsheet justifies a big project. The trick is to target the ones where you can:

Reduce risk,
Save time, and
Prove return on investment

within a single quarter. Our three‑phase implementation model is built around this 90‑day window.

Tools like Microsoft Power Automate, Make and simple table‑based systems like Airtable are high‑leverage here. You get structure, auditability and automation without a full ERP implementation.

Actionable step
For your top 5 risky spreadsheets, ask:

Can we map this process and design a small replacement in under 2 weeks?
Can we pilot it with one team for 2–4 weeks without disrupting everything else?

If yes, these are your first automation candidates. Run them through a structured workflow automation audit – which we detail in our AI workflow audit checklist – and design a pilot that leaves the old spreadsheet running in parallel for a short safety window before decommissioning it.

Final review / summary

By now, you should have a simple but revealing view of your spreadsheet landscape:

Which files are single points of failure.
Which carry money and compliance risk.
Which consume unnecessary manual hours.
Which have grown into unreliable shadow systems.

The goal is not to declare war on Excel. It is to stop running core business workflows on tools that were only ever meant to be temporary. A well‑run SME will still have dozens of useful spreadsheets – but they will be clearly:

Analytical, not operational.
Derived from systems of record, not competing with them.
Documented, owned and non‑critical to cash flow if they fail.

The rest – the ones that fail this audit – are your roadmap for change. They are where automation, better systems and tighter governance will remove real risk and free real time.

You can tackle them alone or fold this into a broader automation roadmap. Either way, this 12‑point spreadsheet audit SME checklist is the starting point for a less fragile, more automated operations layer.

What to explore next

If you want to turn these findings into a structured automation plan, here are natural next steps:

AI automation services
Client success stories
About SIMARA AI
Ready to cut your spreadsheet risk in practice? → Book a consultation

Sources and further reading

Federation of Small Businesses (FSB), UK Small Business Statistics 2024 – overview of SME population and employment: https://www.fsb.org.uk
HMRC, “Compliance checks: penalties and interest” – guidance on errors in returns and their consequences: https://www.gov.uk/government/collections/compliance-checks
Information Commissioner’s Office (ICO), “Guide to the UK General Data Protection Regulation (UK GDPR)” – data protection obligations relevant to spreadsheets: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources
Microsoft, “Power Automate documentation” – examples of automating workflows currently run from spreadsheets: https://learn.microsoft.com/power-automate/

It is not the number that matters; it is where they sit in your operations. A 30‑person firm can comfortably have hundreds of small analytical spreadsheets. The red flag is when money‑critical or compliance‑critical workflows depend on a handful of fragile, owner‑only workbooks that fail multiple items in this checklist. Concentrate first on spreadsheets that are single points of failure, updated weekly, and touch cash or regulators.

Should we move everything from Excel into a dedicated system?

No. That is rarely cost‑effective. Spreadsheets remain excellent for one‑off analysis, modelling and low‑risk internal tracking. Use this audit to identify a small subset of high‑impact spreadsheets that should move to systems or automated workflows. Typically, this is 5–15% of your overall spreadsheet estate.

How do we prioritise what to automate first after this audit?

Combine three signals:

Risk (money/compliance + incident history).
Volume (hours per week, number of users).
Feasibility (can we improve it within 8 weeks using tools we already have?).

Anything high on all three is your first automation candidate. This mirrors how we use our process priority matrix and AI readiness scorecard with SME clients.

Is it safe to keep staff and client data in spreadsheets under GDPR?

It can be, but you must control access, secure storage, and retention. That is difficult when files are emailed or stored locally. For regular, ongoing processing of personal data, it is usually safer to use systems with built‑in permissions and audit trails (HR, CRM, ticketing tools) and keep spreadsheets for temporary analysis only. Always consult your data protection officer or adviser for high‑risk use cases.

How often should we repeat a spreadsheet dependency audit?

For a 10–100 person SME, running this audit once a year is usually enough, with an additional review after major changes – such as a new finance system, a merger, or rapid team growth. The key is to keep your spreadsheet register updated and ensure any new money‑critical process is challenged before it solidifies in Excel.

Find 3 hidden efficiency gains in 30 minutes → Book a consultation

The Spreadsheet Dependency Audit: A 12‑Point Checklist to Decide What Stays in Excel and What Must Move to Automated Systems