Home / Blog / Leaving spreadsheets

Stop running SOX testing out of spreadsheets: a migration path

Let's start by defending the spreadsheet, because most articles like this don't and it makes them useless. Excel is the most successful audit tool ever shipped. Your RCM is in it, your sample selections are in it, and every auditor on your team is fluent in it. Any migration plan that begins with "abandon Excel" is a plan written by someone who has never had to close out testing in the second week of January.

The realistic goal isn't leaving spreadsheets. It's demoting them — from system of record for the audit's state back to what they're actually good at: analysis, populations, and data prep. Here's what that migration looks like when it goes well, based on where spreadsheet SOX programs actually break.

The four failure modes (check how many you have)

1. Status is a rumor. The testing tracker has a status column, and it's wrong. Not because people are careless — because a cell that anyone can type anything into, with no enforced sequence, is not a workflow. "Complete" rows that were never reviewed; "In progress" rows the tester finished weeks ago; the version on the share disagreeing with the version in someone's email. Every status meeting starts with fifteen minutes of reconciling reality against the tracker.

2. Sign-off doesn't hold up. A reviewer's initials in a cell prove nothing — the cell can be edited afterward, the content can change after review, and there's no record of either. External auditors and QA reviewers have learned to ask the sharp question: how do you know the workpaper is the same one that was reviewed? With files on a share, you mostly don't. And self-review — the same person preparing and "reviewing" under deadline — is invisible in a spreadsheet and glowing in any inspection.

3. Concurrency is a lock file or a fistfight. Either one person at a time can have the tracker open, or you co-author and discover Excel's merge behavior at the worst moment. Teams route around it by splitting the file per tester — and now consolidation is a job, and the "one audit file" is a fiction assembled quarterly.

4. Nothing connects. The RCM, the testing tracker, the deficiency log, the ITGC scoping memo, and the evidence folder tree are five artifacts with no shared keys, drifting apart from February onward. "Which failed tests touch controls that rely on the ERP we're migrating?" is a legitimate one-line question that takes a day to answer.

If you have one of these, you're normal. Two or more, and the tax you're paying already exceeds the cost of fixing it — you're just paying it in evenings instead of invoices.

The migration path

The whole trick is sequencing: move the state first, keep the analysis where it is, and never retype anything.

Step 0: clean the RCM where it lives (half a day)

Your RCM spreadsheet is the migration payload, so make it load-bearable:

Note what you're not doing: no reformatting into a vendor's 40-column monster, no re-writing control descriptions. Cleanup, not authorship.

Step 1: import — and insist on a preview (an hour)

Any tool worth migrating to imports the RCM from CSV and shows you exactly what it will do before it does it. In SoxDesk this is literal: the preview is the real import, run inside a transaction and rolled back, so preview and commit cannot disagree. Whatever tool you use, demand the equivalent, plus two behaviors that decide whether the tool respects your data:

After this step your controls, tests, and assignments exist in the tool. Elapsed effort so far: about a day.

Step 2: move the state machine (the first real change)

Now the actual demotion: status, sign-off, and review live only in the tool from a chosen date. This is the step that needs a manager's spine rather than technology, so make it crisp:

Expect a week of grumbling and then silence, because the payoff is immediate: the status meeting opens with a live dashboard instead of a reconciliation, and "who's blocked on review" is a glance.

Step 3: move the evidence to where the workpaper is

Stop maintaining a parallel folder tree. Evidence attaches to the workpaper it supports — and in an on-premise tool like SoxDesk, attachments land inside the same data-store folder on your own share, so you're not uploading audit evidence anywhere. The discipline that matters: changing evidence on a signed-off workpaper should clear the sign-off, same as changing content. If your tool doesn't enforce that, your sign-off integrity has a side door.

Keep using Excel for what happens before evidence: population pulls, sample worksheets, recalculations. Those files simply get attached instead of filed.

Step 4: connect what was never connected

With state and evidence in one place, the linkage you could never maintain across five files comes almost free: the report view that walks area → control → test → conclusion → finding without a lookup formula; deficiencies that reference the failed test instead of paraphrasing it; ITGC scoping as a live chain from walkthroughs to applications to covering controls (a method worth adopting on its own — see our piece on walkthrough-driven ITGC scoping). And at year-end, roll-forward is a button, not a fortnight of Save-As archaeology.

What to keep in spreadsheets forever

Populations and completeness checks. Sample-size rationale worksheets (even if the tool suggests sizes). Data analysis and recalcs. Ad-hoc management views someone asks for once. The one-page memo formats your audit committee likes. Excel is a superb workbench; it was only ever a poor system of record.

The pilot that proves it

Don't migrate the program — pilot one cycle. Pick a mid-size area (order-to-cash works), import just those controls, run two weeks of real testing in the tool, then ask the team three questions: is status truer? is review faster? did anyone lose work? If the answers aren't obviously yes-yes-no, stop; you've spent two days and a small CSV.

If you want to run that pilot without asking anyone's permission, SoxDesk's free 60-day trial is built for it: a portable zip that runs on your own machine and network share, with an RCM template and preview import, so your data never leaves your environment — and if the pilot fails, deleting a folder is the whole rollback plan.