Most BCM is still run in Excel + SharePoint folders. We’re not going to pretend that’s irrational — for some organisations, it’s the right call. Below: when it works, when it breaks, and what changes when an auditor walks in.
Five things that cause spreadsheet-BCM to stop working. If two or more apply to you, you’re past the breakpoint.
SAMA, ISO 22301, NCA ECC examiners want consistent §8.4.4 plan structure, audit trails, and §8.5 activation evidence. Spreadsheets typically fail all three. Most BCM Managers move off spreadsheets right after their first formal examination finding.
The analyst who built and maintained the workbook leaves. Their replacement has to reverse-engineer the formulas, the cross-sheet references, and the unwritten conventions. Knowledge transfer gaps become BCM gaps.
One BCM Manager builds one workbook. Adding Finance, IT, Operations, Customer Service multiplies versions. Format drift accumulates. Six months later you have six workbooks with five different impact-matrix conventions.
During an actual activation, nobody opens a 12-tab Excel workbook and follows it. They call the people they remember. Plans authored as spreadsheets aren’t executable when it counts — because they were optimised for being authored, not for being followed.
The submission requires evidence of a working BCMS — committee minutes, BIA assessments, BCP plans, exercise outcomes, improvement actions. Pulling that together from scattered files in 30 days is a fire drill. Pulling it from one platform is a button.
Internal audit asks: “Show me the corrective actions raised from the last 12 months of exercises and crisis events.” In a platform: one query. In spreadsheets: a week of analyst time chasing cells across files.
Spreadsheets feel free; the cost shows up as analyst time, not a line item
Add analyst time + audit-prep + crisis chaos and the platform wins
Examiner findings happen — when, not if
Locked workbooks, conflicting copies, manual merge
SharePoint perms are coarse; platform RBAC is fine-grained
Track-changes is per-file; platform audit log is global
Spreadsheets can have the columns, but no enforcement
Activations live in email; platform captures them as data
Excel is universal; learning the platform takes a week
| Audit & evidence | ||
|---|---|---|
| Capability | BCMStack | Spreadsheets |
| Structured §8.4.4 plan content | Yes | If author bothers |
| Cross-module audit log | Yes | No |
| Per-field version history | Yes | Track-changes |
| §8.5 activation log | Yes | No |
| Improvement-action register | Yes | Ad-hoc |
| Multi-user | ||
| Concurrent editing | Yes | Conflicting copies |
| Role-based access (5 roles) | Yes | SharePoint perms |
| Department-scoped views | Yes | No |
| Approval workflow | Yes | |
| Crisis ops | ||
| Structured crisis log | Yes | No |
| Auto-coded action items | Yes | No |
| BCP activation linkage | Yes | No |
| Stakeholder comms matrix | Yes | No |
| Familiarity | ||
| Universal authoring tool | No | Yes |
| No vendor evaluation needed | No | Yes |
| Already paid for | No | Yes |
| No training required | Limited | Yes |
Most spreadsheet-to-platform migrations fail because they try to migrate the chaos. This sequence migrates the hygiene.
Week 1
Week 2
Week 3-4
Week 5-6
Week 7-8
Note for SAMA-regulated orgs
If your next SAMA examination is more than 90 days away, the 4-8 week sequence works comfortably. If it’s less than that, talk to us — we can compress to 3-4 weeks with implementation services. Don’t miss the deadline because the migration plan was paced for normal time.
For small organisations (under 50 employees, no external regulator), yes — and many do for years. The breaking points are: regulatory audit (SAMA, ISO 22301 certification), team turnover (the analyst who maintained the workbook leaves), multi-department scope (different formats accumulate), and crisis activation (a structured workbook is the wrong artifact during an actual incident). For SAMA-regulated organisations, the breakpoint is usually the next examination cycle.
Three reasons. First, spreadsheets are 'free' — already paid for via Office 365. Second, they're familiar — every team member can edit one. Third, replacing them means a vendor evaluation + procurement cycle that BCM Managers often don't have authority to drive alone. The cost shows up as analyst time, audit-prep chaos, and regulator findings rather than as a line item.
Five common findings: (1) plans authored in different formats — no consistent §8.4.4 structure, (2) version history exists in Word's track-changes but not in a structured audit log, (3) no role-based access — every reader has edit permission unless explicitly removed, (4) cross-references break when files are renamed or moved, (5) no record of plan invocations — exercises and real activations both live as ad-hoc emails. SAMA examiners typically write all five up.
4-8 weeks for a typical mid-market organisation with 30-50 processes and 10-20 plans. The migration itself is fast — CSV import for processes and vendors; manual recreation of plans into the §8.4.4 template. The slow part is data hygiene — most spreadsheet-based BCM has accumulated inconsistencies that need cleanup before the platform can use them. A side benefit of migrating is that the cleanup happens.
Tell us. Some organisations genuinely aren't — under 25 employees, no regulatory pressure, BCM is 'we should have something written down' rather than 'we have to defend it'. For those cases, we'll point you at our public BCP template (ISO 22301 §8.4.4-shaped Word doc) and circle back when you're closer to needing the platform. We'd rather not sell to organisations that won't get value from the spend.
Tell us about your current spreadsheet setup — number of plans, departments, regulator timeline. We’ll show you a 4-week migration plan and the specific spreadsheets that get retired in week one.
Plan my migrationCompared with another peer? See BCMStack vs Castellan, BCMStack vs Fusion, BCMStack vs Origami Risk, or BCMStack vs 6clicks.