Why most small businesses start with a spreadsheet
All small businesses are exposed to certain IT risks. This is natural since all of them use systems, products and applications that process information to some extent. Most of those businesses that manage IT risk start by using Excel or Google Sheets to track them. It is cheap, familiar and flexible. Often the trigger is a client security questionnaire, an insurer’s form or an upcoming audit, and a spreadsheet is the quickest way to get organised. It makes sense.
For many companies, that is the right start and a solution that can be sustained for a long time. But a spreadsheet only holds what you put in it. It doesn’t tell you which risks you are missing, remind anyone of a deadline, or keep a reliable history. It is static and hard to update, which can eventually become a bottleneck if improving your IT maturity is your end goal.
This post shows what a good IT risk spreadsheet looks like, six signs you have outgrown it, and what to look for in IT risk management software.
What a good IT risk spreadsheet looks like
As we established, IT risk registers are a great start to putting order in chaos. A simple IT risk register may contain the following elements:
| Column | What to fill in | Example |
|---|---|---|
| Risk | What could go wrong, to what, and why | An application sends unencrypted data to the internet |
| System or asset | What is affected by the risk | Email system |
| Risk owner | One named person responsible | Department lead |
| Likelihood | Low, Medium or High | Medium |
| Impact | Low, Medium or High | High |
| Risk level | Likelihood and impact combined (multiplied) | High |
| Current controls | What you already do to address the risk | Instruction to avoid sending critical information through the application |
| Action | What you will do to remediate the risk | Implement encryption for the application |
| Due date | When the action is due | End of this month |
| Status | Open, In progress or Done | In progress |
| Last reviewed | When you last checked this risk | The date of your last review |
The items above are a good starting point for setting up a spreadsheet-style IT risk register. Identify the main risks you know you are exposed to now, and start with those. Review the register at least every quarter, and after any major change, such as a new system, a new supplier or an incident affecting your IT infrastructure.
Not sure which risks belong on your list? EvRisko’s plain-language questionnaire helps you find them and shows what to fix first.
Six signs it’s time to switch to software
Although an IT risk record in the form of a simple spreadsheet is a great starting point, it certainly has its limitations. There are certain signs that indicate that the spreadsheet has outgrown its purpose and capability, signaling it’s time to move to a dedicated software solution to better achieve IT maturity and growth. Here are some tell-tale signs of this taking place:
1. Only one person understands the spreadsheet
If the person who built it leaves or is on holiday, nobody knows how to use or update it. The knowledge should sit in your process and tooling, not in one person’s head.
2. You don’t know if it’s complete
A blank spreadsheet doesn’t tell you what to check. If you are unsure whether you have missed important risks, maybe the register is not clearly structured to enable the collection of information. In those cases, a dedicated IT risk solution can bridge that gap.
3. Several versions are going around
Copies by email, files called “final_v3” and conflicting updates mean nobody is sure which version is correct. Version control can make or break an IT risk management register.
4. Actions don’t get done
Due dates pass without anyone noticing. Risks are left unchecked, leading to findings. A spreadsheet doesn’t send reminders and doesn’t follow up with owners. A bespoke software solution likely (and hopefully) does that.
5. Clients, auditors or investors ask for evidence
They want to see what you assessed, when, and what you fixed. Building that history from old spreadsheet versions takes time and is easy to get wrong. Showing current items on a central dashboard is way more efficient.
Interested in how to approach client audits as effectively as possible? Check out how to create and maintain a client IT security audit checklist.
6. Updating it takes longer than managing the risks
Broken formulas, manual scoring and reformatting for every report are signs the tool is costing you more time than it saves. Ease of use and simplicity are vital when managing relevant IT risks, and spreadsheets often lack that clear overview and simplicity needed to manage and maintain them.
The message then becomes clear: if several of these sound familiar, it is worth considering upgrading to dedicated software that can get the job done.
When a spreadsheet is still enough
A spreadsheet can still work well if one or more of the below conditions apply:
- You use only a few systems and IT suppliers.
- One person is clearly responsible, and someone else can take over at any time.
- Clients and regulators don’t ask you for detailed evidence.
- You actually review and update it on a regular schedule.
If any of the boxes are checked, it is worth considering making the switch.
What to look for in IT risk management software
A dedicated IT risk management solution might be the best next step for your enterprise; however, it is not necessarily an easy transition. In our view, a relevant tool should offer:
- Plain language. You shouldn’t need an extensive security background to use it.
- Guidance on what to check. The tool should help you find relevant risks, and point you in the right direction.
- Clear priorities. You need to know what to fix first, based on risk.
- A clear overview. A central dashboard that shows you your current state and how to improve your IT readiness.
- The right size. Enterprise GRC (governance, risk and compliance) suites are built for large companies with risk teams. For most small businesses they are too complex and too expensive.
- Security of the tool provider. Ask where your data is stored and how it is protected: the same questions your clients ask you.
Three mistakes to avoid when switching
Switching over can be the next step for your enterprise’s needs, but don’t do it hastily. Avoid these mistakes to ensure a smooth transition:
- Copying the spreadsheet one-to-one. Review your risks first. Outdated risks clutter the new tool, and it’s best to remove or update them as needed.
- Treating the tool as the goal. Software helps, but risks still need owners and actions. The tool is there to facilitate your efforts.
- Deleting your old records. Keep a dated copy of your spreadsheet as evidence of earlier work. Ideally, the latest version of the spreadsheet will feed into the first version of the tool of your choice.
How EvRisko helps
The hardest part of managing IT risk in a spreadsheet is not the format. It is knowing what to check and what matters most.
EvRisko asks plain-language questions about your IT setup. You get a risk score from 0 to 100, rated Poor, Fair or Good, and a list of what to fix first. A first score takes about 25 minutes, and no technical knowledge is needed. You can export the results as a PDF report to share with clients, auditors or investors.
You can also use EvRisko alongside your spreadsheet at first: use the fix-first list to decide which risks and actions belong in your register.
14 days · No credit card required
Start your 14-day trial →Frequently asked questions
What is an IT risk register?
A list of your IT risks, each with an owner, a rating, current controls and planned actions. It helps you track what could go wrong and what you are doing about it.
Can I manage IT risk in Excel?
Yes, if your setup is small and simple and someone keeps the spreadsheet up to date. Many companies switch once they need guidance on what to check, reminders, automations or evidence for clients.
What is the difference between a risk assessment and a risk register?
A risk assessment is the process of finding and rating your risks. A risk register is where you record the results and track the actions. In other words, you perform risk assessments which directly update your risk register.
How often should I review my IT risks?
At least every quarter, and after any major change, such as a new system, a new supplier or a security incident.