Let's begin with fairness: the spreadsheet is a magnificent invention, and starting your risk register in one is completely reasonable. Rows for risks, columns for ratings, a bit of conditional formatting for the matrix colors — twenty minutes, zero budget, done. For a first risk workshop, there is no better tool.
The trouble starts around month three. Not with a bang, but with a filename.
A short tragedy in five files
RiskRegister.xlsx — created after the kickoff workshop. Forty risks, clean structure, genuine enthusiasm.
RiskRegister_v2_final.xlsx — after the management review. Someone reordered the columns. The old file still circulates.
RiskRegister_v2_final_NEW.xlsx — emailed to department heads for input. Three of five reply — with edited copies. Someone merges them by hand, introducing two errors that will surface at the worst possible moment.
Copy of RiskRegister_v2_final_NEW(1).xlsx — nobody knows who created this or why it lives in the project folder. It differs from the "current" version in eleven cells. Which eleven? Unknown.
RiskRegister_2025_CURRENT.xlsx — the fresh start, created because nobody trusted the old files anymore. Contains 60% of the original risks. The treatment history of the other 40% is gone.
If you've lived any version of this story, what follows will feel familiar — and the point is that none of it reflects carelessness. These are structural properties of the tool.
The five structural failures
No single source of truth. A spreadsheet is a file, and files multiply — attachments, local copies, exports. The moment two versions exist, the register's core promise ("this is our current risk picture") is broken. Everyone has seen a register; nobody is sure they've seen the register.
No change history. Cell C14 said "likelihood: 4" in March and says "2" today. Who changed it? When? On what grounds? The spreadsheet doesn't know. For a document whose entire value lies in tracking judgments over time, this is fatal — and it becomes acutely painful the day an auditor asks exactly that question. Rating history isn't bureaucratic garnish; it is the risk management record.
No accountability mechanics. The register says the review is quarterly and the treatments have deadlines. The spreadsheet enforces neither — it doesn't remind, escalate, or nag. Follow-through depends entirely on one coordinator manually chasing owners, and when that person is on holiday or changes jobs, the cadence silently dies. Most spreadsheet registers don't fail dramatically; they just quietly stop being updated.
Collaboration by collision. Risk management is a team sport — a dozen owners updating their entries, ideally around the same review deadline. Shared spreadsheets handle concurrent structured editing poorly: locked files, overwritten changes, or the email-merge dance from our tragedy above. So in practice, one person becomes the register's typist, owners dictate updates second-hand, and the sense of ownership that makes risk management work evaporates at the keyboard.
Reporting as manual labor. Every quarterly meeting needs the matrix, the top-ten list, the movers-since-last-quarter view. In a spreadsheet, each is an evening of copy-paste and chart-fiddling — repeated every cycle, forever. The predictable result: reporting shrinks to what's cheap to produce, and the delta view (the most decision-relevant of all) is the first casualty, because spreadsheets have no memory of last quarter to compare against.
The deeper cost: friction compounds
Each of these failures is survivable alone. Their combination produces a compounding effect worth naming.
A risk register lives or dies by the habit of updating it, and habits are exquisitely sensitive to friction. When updating means finding the right file, hoping it's not locked, remembering what changed, and emailing the coordinator — each update costs ten minutes and mild annoyance. When reviewing means someone manually assembles the picture first, reviews happen less often. Every point of friction shaves a percentage off participation, and participation is the product. The register doesn't die of a single wound; it dies of a thousand small inconveniences.
This is why the spreadsheet trap is a trap: the tool that made starting easy makes continuing expensive, and continuity is the entire game.
When to graduate (a checklist)
Spreadsheets remain fine for a genuinely small setting: one site, a handful of risks, a single person maintaining it, no audit obligations. You've outgrown the grid when several of these are true:
More than one person needs to update the register. You've ever lost time to version confusion. An auditor, certifier, or board asks for rating history or evidence of reviews. Treatment deadlines slip because nothing reminds anyone. Preparing the quarterly risk report takes more than an hour. You manage risks across multiple departments, projects, or entities and need aggregated views.
Two or more? The math has flipped: the "free" tool is now the expensive one, paid in coordinator hours, lost history, and slow decay.
What purpose-built tooling actually changes
The value of dedicated risk software isn't sophistication — a 5×5 matrix needs no supercomputer. The value is the systematic removal of friction:
One URL that is always the current truth, ending version archaeology forever. A change log on every field — who, when, what, why — which turns audits from excavation into a filter click. Owners who update their own risks in two minutes, restoring real ownership. Automatic reminders that keep the review cadence alive without a human nagger. And reporting — matrix, top risks, quarter-over-quarter movement — generated in seconds because the tool remembers everything the spreadsheet forgot.
None of this manages risk for you. People identify risks, people judge them, people fix them. What the tooling does is make the system durable: independent of any single coordinator's diligence, legible to any auditor, and cheap enough to maintain that it actually gets maintained.
The spreadsheet got you started, and that was its honest job. Knowing when its job is done — before the version chaos, not after — is itself a small act of risk management.