Spreadsheet Audit Trails: Why Excel Cannot Give You One

"Audit trail" gets used loosely. When an auditor, a regulator or a customer's compliance team asks for one, they are asking for a record that satisfies five specific properties:

• Attributable — every change is tied to an identified person, not to a shared login or a filename
• Complete — every change is recorded, not only the ones someone chose to save
• Immutable — the record cannot be altered by the people whose work it records
• Contemporaneous — captured when the change happened, not reconstructed later
• Retrievable — you can answer a question about one figure without reading a whole file

These are not arbitrary. They are roughly the ALCOA properties used in regulated manufacturing, and they turn up in similar form in financial controls and in customer quality agreements. A spreadsheet fails four of the five.

Most spreadsheet-driven processes never face this question. These do, usually with a deadline:

• A customer quality agreement requiring traceability of inspection or batch records
• Financial controls where someone has to evidence separation of duties and approval
• Pharmaceutical, medical device or regulated manufacturing supply chains with retention and recall obligations
• A dispute where a customer challenges a price, a quantity or a sign-off, and the file is the only evidence
• Certification — ISO 9001, SOC 2, IATF — where the auditor asks how records are controlled
• Any process where the answer to "how do you know this number is right" is a person's memory

1. 1Lock the spreadsheet down — single master file on SharePoint with version history on, edit rights restricted, no local copies. Improves attribution and gives you something rather than nothing. Does not give immutability, and a determined user can still bypass it.
2. 2Log changes out of the spreadsheet — a macro or scheduled job that writes every change to an append-only store the editors cannot reach. A real improvement, and it is a workaround: it captures what it was built to capture, and nothing else.
3. 3Move the record of truth into a system — the data lives in a database with per-record history, identified users and enforced approval steps, and people work through an interface. This is the only option that satisfies all five properties, and it is what an auditor is actually describing when they ask for an audit trail.

Option 1 is worth doing this week regardless of what else you decide. Option 2 is a legitimate middle ground when the obligation is narrow and known. Option 3 is what a binding compliance requirement eventually forces, and the useful thing to know is that it does not have to happen across the whole business at once — the process under obligation can move on its own.

• Every record carries who created it, who last changed it, and when
• Changes are stored as an append-only history, including the previous value
• Approvals are recorded as events with an identified approver, not as a signature in a cell
• Users are individually identified — no shared accounts, ever
• History is retained on a defined schedule and cannot be deleted by ordinary users
• Any single record's full history can be produced without reading the whole dataset

None of that requires an enterprise platform. It is the default behaviour of a modestly built application over a relational database, which is why this is one of the clearer cases where replacing the spreadsheet pays for itself — the cost of failing an audit is rarely bounded.