The Case Against Spreadsheets

Using a spreadsheet to prop up core business processes is a really bad idea. And yet, if you walk into most care organisations across Australia, you'll find a prolific use of spreadsheets for exactly this purpose. Let's see why that's a bad idea by looking through a couple of examples.

1: Using spreadsheets as a pseudo-client information management system is a bad idea because you're storing sensitive information, often case notes (considered medical records), in a single file on a shared drive. These are hard to secure and easy to copy. In a security breach -- whether physical or via the Internet -- attackers will look for files with identifiable information and medical records on shared drives. Unlike a client information management system, which allows fine-grained security controls to minimize damage from discontented employees or cyber attacks, spreadsheets are difficult to secure at that level. Typically, an entire team has access to all client spreadsheets, so access to one means access to all.

We've seen situations where all client records and case notes are kept in spreadsheets, and even where client information (first name, last name, date of birth) is in folder names, which is also a security risk.

Keeping client details in a spreadsheet is not only a bad idea from a risk perspective but also suggests a low degree of automation, affecting downstream compliance reporting and client services delivery. When client interactions are tracked in a spreadsheet, there's no automation from step to step. This lack of automation leads to less impact and fewer client services being delivered because team leaders, supervisors, or schedulers are conducting manual tasks instead of focusing on client care. The money spent on these manual tasks is not going into client care, making it another reason why keeping customer records in spreadsheets is a bad idea.

2: The second area where spreadsheets are commonly used is to prop up the integration between systems. This is problematic not only for security reasons but also because these repetitive tasks occur daily, weekly, four-nightly, monthly, six-monthly, or annually. When these activities are conducted using spreadsheets, they remain manual, requiring human intervention each time.

We've seen payroll processes where information must be downloaded from a client information management system, pasted into a spreadsheet, run through a macro to change the data format, and then copied and pasted into another file. In extreme cases, this file is uploaded into multiple systems. The problem is that a human is required to run this process every time. If that person is on leave, the payroll can't run, and even when they are available, it's time spent on a non-value-added activity.

Using spreadsheets for integration diverts money that could be used to deliver care to more clients into rework and manual tasks like copying and pasting between systems. There is also a continuity risk when using spreadsheets for integration. Complex macros built in these spreadsheets are fragile and difficult to document. Despite being written in a scripting language, these macros are custom code that is hard to maintain and test. If the macros stop working, critical processes like payroll or billing can grind to a halt, forcing organizations back to the drawing board.

In summary, using spreadsheets to compensate for inefficiencies or gaps in your core systems or as an integration mechanism between systems needs to be remediated quickly to mitigate risks, ensure business continuity, and improve efficiency, enabling you to deliver more care to your clients.

Andrew Walker
Technology consulting for charities
https://www.linkedin.com/in/andrew-walker-the-impatient-futurist/