Spreadsheets are brilliant…until they become the thing standing between you and the business you're trying to build

Every business leader remembers building the file. 

Maybe it was a risk register knocked together the night before a board meeting. A sales forecast held together by formulas and optimism. A compliance tracker that started as a tab and quietly became a system. Whatever it was, it worked - it gave shape to the chaos at a moment when the business needed shape more than it needed perfection. 

That resourcefulness is something to be proud of. It's how most good businesses begin. 

But growth has a way of turning your best workarounds into your biggest vulnerabilities. 

The file that carried the business 

More customers arrive. More commitments are made. More stakeholders - investors, lenders, auditors, board members - start expecting clear answers to hard questions. And slowly, almost imperceptibly, the file that once helped you move begins carrying weight it was never designed to hold. 

The spreadsheet isn't the villain here. It never was. It did exactly what you asked of it. The problem is what you gradually needed it to become - and what no spreadsheet was ever built to be. 

The moment the gap becomes visible 

Most businesses don't lose clarity all at once. They lose it by degrees. 

A customer asks for proof of controls. A lender wants confidence in the numbers. A regulator or auditor wants evidence that obligations are being met. A board member pushes for a clearer view of risk. And the business responds the only way it knows how - another tracker, another folder, another late night before the meeting. 

For a while, the effort holds. Then it doesn't. Teams hold different versions of the truth. Evidence exists somewhere, but finding it takes too long. Risks get discussed, then drift. The gap between what leadership believes is true and what they can actually prove grows wider than anyone wants to admit. 

This is the moment that separates two very different kinds of businesses. 

Two worlds 

On one side: a governed, orchestrated GRC environment where risks, controls, evidence, owners and obligations are connected and visible in real time - where leadership can see not just that a risk has been recorded, but that it has an active owner, that controls are in place, that those controls are working, and that the business can demonstrate compliance against its regulatory requirements and relevant standards. 

On the other: a collection of spreadsheets that nobody fully trusts, maintained by people doing their best with tools that were never built for this. A spreadsheet can list a risk - it cannot ensure that risk still has an active owner, that controls are in place, or that those controls are actually effective. It can hold evidence - it cannot confirm whether that evidence is current, connected to the right obligation, or sufficient to satisfy a regulatory requirement or ISO standard. It can flash a red cell - it cannot tell leadership which objective that red cell threatens, whether a control has failed, or whether the business is exposed to a breach it doesn't yet know about. 

Neat rows hide messy accountability. And mistaking activity for control is one of the most expensive habits a growing business can develop. 

A stronger layer for the work that matters most 

This is where AI changes the equation. Not as a replacement for human judgment, but as a layer that makes it better informed and better connected. 

An AI agent can watch the links between an objective, a risk, an owner, a control, and the evidence behind it. It flags when a risk has no active owner, surfaces controls that haven't been tested, identifies evidence that is stale or disconnected from the obligation it's meant to satisfy, and prompts follow-up before an overdue action becomes next month's problem. Leaders stop waiting for someone to update a file and start asking better questions: Is this objective on track? Are these risks being actively managed? Are our controls effective? What needs attention before it becomes something larger? 

The information behind every decision becomes clearer, more current, and more connected — and the business moves from hope to confidence. 

From scattered effort to something you can stand behind 

This is the shift my company Drova is built for. I’ve helped many organisations turn objectives into coordinated action across risk, compliance, resilience, sustainability and strategy, so leaders can protect margin, prove progress, reduce surprises and run good business as the business grows up. That's what it means to run a good business. 

Spreadsheets helped you get here, and they'll always have a place. But the business you're building - the people it serves, the obligations it carries, the outcomes it exists to deliver - deserves more. 

If your spreadsheets feel like they are doing too much, that’s usually the first sign your business is ready for its next operating layer. 




About Sam Riley 

Sam Riley is a seasoned technology entrepreneur with more than two decades of leadership experience in enterprise software and business strategy. Sam is Co-Founder and CEO of Drova, a platform that helps businesses run good – bringing risk, compliance, resilience and sustainability together into a simple, unified and AI-led platform. With deep expertise in product innovation, Sam has a strong track record building solutions that are simple, scalable and deliver long-term impact and outcomes for businesses on a national and global scale. Visit www.drova.com for more information.