A spreadsheet that tracks a handful of orders is easy to trust: one person can check it by eye, a wrong cell is easy to spot, and a mistake affects one order at a time. The same spreadsheet, carrying a growing domestic stock programme with dozens of running order lines, several contributors and formulas copied down by hand, does not announce the moment it stops being trustworthy. It keeps producing numbers; it simply stops being able to guarantee they are correct.
This lesson gives you a working method for recognising that point, using a domestic brand's own growing replenishment programme as the case. Recognising a control risk early is what makes Lesson 5.4's preparation and Lesson 5.5's keep-or-replace decision possible before a bad number reaches a real order.
You need: Lessons 5.1 and 5.2 on access rights and audit trails, plus a basic understanding of a standing forecast and a replenishment order.
By the end of this lesson you can:
Not covered here: a specific spreadsheet product, or how to build the replacement system. Lesson 5.4 covers preparing for a move once a risk is confirmed; this lesson stays vendor-neutral and focuses on recognising the risk itself.
| Term | Meaning |
|---|---|
| Control risk | The chance that a working method can no longer reliably prevent, detect or correct an error before it causes loss. |
| Single point of failure | A single file, formula or person that, if it fails or is unavailable, stops the whole working method from working correctly. |
| Version history | The ordered record of every saved version of a file or record, showing what changed and when. |
| Change control | The agreed process for approving, recording and communicating a change to controlled business information before it takes effect. |
| Audit trail | A record of who did what and when, kept so a decision or change can be checked and reviewed later. |
Five factors decide whether a spreadsheet can still be trusted: whether it has a single point of failure, whether it keeps a version history, whether it has any access control, whether its formulas are copied by hand instead of controlled once, and whether the number of order lines has grown past what one person can check by hand each week. A spreadsheet can be large and still safe if these factors are controlled; a small spreadsheet can already be a risk if several of them are missing.
Judging risk this way, against a fixed list, replaces a vague feeling that "the spreadsheet is getting out of hand" with a checkable score that says which factors are actually the problem.
| What can differ | The shapes you will meet | Why it matters to you |
|---|---|---|
| Domestic replenishment under Make to Stock | A standing forecast spreadsheet grows one row at a time as new replenishment lines are added, with no single moment that feels like "too many." | The single point of failure and scale factors build up gradually here, which is exactly why they need a periodic score rather than a one-off impression. |
| Export order under Make to Order | A smaller number of higher-value confirmed orders are tracked, often by more than one department reading the same file. | The access-control factor matters most here, since several departments touching one file with no control is a fast route to a wrong shared value. |
| Hybrid mix handled by an agent | An agent's own tracking file may mix several buyers' order types in one sheet, with formulas copied across buyer sections by hand. | The manual-formula factor is common here, because a formula copied and adjusted by hand for each buyer is easy to get wrong in one section without anyone noticing. |
| A single owner versus several contributors | One person's own file, kept on one computer, differs from a shared file several people edit. | A single point of failure is not only about the file; it includes a single person whose absence stops the work, even on a well-controlled spreadsheet. |
| Different product families | Socks, knit-to-garment, terry and bedding replenishment programmes each track different fields, but the same five risk factors apply to every one of them. | The content of the rows changes; the checklist for whether the file itself is still trustworthy does not. |
Cedar & Co., a domestic brand with 12 shops, runs a Make to Stock replenishment programme with Delta Garments on 60-day open account, using Order A's own fixed figures (15,000 T-shirts, agreed FOB USD 3.20 per piece) as the reference transaction shape for a single running batch. Omar, the owner of Cedar & Co., built the original tracking spreadsheet himself two years ago, when it held about ten replenishment lines a month.
The same spreadsheet today holds several dozen running lines, is opened by three people, and its reorder-quantity formula has been copied down by hand into new rows so many times that nobody remembers whether every row still uses the same version of it. No one owns a change-control step for it, there is no version history beyond the file's own "Save As" copies with dates in the filename, and there is no access control beyond whoever has the shared folder link. None of this happened at a single moment Omar can point to; it built up one convenient shortcut at a time.
The worked numberUsing the five factors from the rule, Cedar & Co.'s spreadsheet is scored 1 for each factor present and 0 for each factor controlled.
A score of 5 out of 5 against a working threshold of 3 out of 5 (the level at which Cedar & Co. has agreed a control risk is worth acting on) shows the spreadsheet is well past the point where its own age or usefulness should decide whether to act.
That feeling is misleading, because a spreadsheet with every risk factor present can still avoid a serious error for years by luck alone, right up until the week a wrong formula copy or an uncontrolled edit reaches an order that actually ships. The absence of a past error does not mean the control factors are actually in place; it means no one has yet been unlucky.
The better rule is simple: score the spreadsheet against the fixed risk factors on a schedule, not against its own track record of not having failed yet.
A spreadsheet is like a small bridge built for light foot traffic. It carries that traffic safely for a long time, and nothing about it changes to warn you when the traffic crossing it has grown into something the bridge was never built for. The bridge does not creak louder as more people cross; it simply reaches a point where it can fail without warning.
Check a working spreadsheet against a fixed list: does one file or one person's absence stop everything, is there a real version history, is access controlled, are formulas controlled rather than copied by hand, and has the amount it carries grown past what one person can check each week. The answer to those five questions, not how long the spreadsheet has worked without a problem, tells you whether it is still safe to rely on.
While reviewing an unusually large reorder suggestion, Omar traces it back and finds that one editor's copy of the reorder formula rounds differently from the other two editors' copies, because it was corrected once by hand and never copied back into the rest of the file.
Should Cedar & Co. treat this as a one-off formula fix, or as a sign the spreadsheet itself needs to change? Decide before opening the answer.
Treat it as confirmation that the spreadsheet has already reached the risk threshold; fixing this one formula does not remove the other risk factors that let it diverge unnoticed.
1. Scoring the spreadsheet against the five risk factors shows a single point of failure (no shared, controlled version), no real version history, no access control, and a manual formula already at 4 out of 5, well above the 3-out-of-5 threshold Cedar & Co. uses. 2. Fixing today's formula divergence corrects one row, not the condition that produced it. Without a controlled formula and a version history, the same drift can happen again in any other row, unnoticed for just as long. 3. The programme's current scale, several dozen lines across three editors, is itself one of the five factors, so the spreadsheet has grown past the point a single fix resolves.
The cost of treating this as a one-off is not the single wrong reorder found today; it is the unknown number of smaller, unnoticed divergences the same missing controls may already have allowed elsewhere in the file.
Order A's fixed figures show the reference transaction shape Cedar & Co.'s programme is built around: 15,000 pieces at USD 3.20 per piece.
A single diverged reorder formula rarely costs the whole value of a batch at once; its real cost is a wrong quantity ordered, held as extra stock or a stockout, repeated quietly across however many rows used the wrong copy before anyone checked. Because the spreadsheet has no version history and no access control, nobody can even say how many rows are affected without checking every one by hand, which is itself the scale problem the risk score already flagged.
The cheapest point to stop this cost is before the risk score reaches the threshold, not after a wrong reorder is noticed by chance.
Use the T17-C05 Data governance decision tool workbook. In the Spreadsheet risk score sheet, mark each of the five risk factors as present or controlled for a spreadsheet you use, total the score, and compare it with your own agreed threshold. Start with Cedar & Co.'s own standing forecast shape, then repeat the exercise for a working spreadsheet you use at work.
[Download the Data governance decision tool workbook](../../templates/T17-C05-data-governance-decision-tool.xlsx)
1. Why does Cedar & Co.'s spreadsheet score 5 out of 5 on the risk factors, even though it worked well for two years?
2. A different domestic replenishment spreadsheet has a named owner, a real version history, access limited to two named editors, and one controlled reorder formula referenced by every row, but now carries 60 running lines, more than one person can check by hand each week. What is its risk score out of 5?
| EN | AR | FR | TR | Meaning |
|---|---|---|---|---|
| Control risk | مخاطرة رقابية | Risque de contrôle | Kontrol riski | The chance that a working method can no longer reliably prevent, detect or correct an error before it causes loss. |
| Single point of failure | نقطة فشل واحدة | Point de défaillance unique | Tek hata noktası | A single file, formula or person that, if it fails or is unavailable, stops the whole working method from working correctly. |
| Version history | سجل الإصدارات | Historique des versions | Sürüm geçmişi | The ordered record of every saved version of a file or record, showing what changed and when. |
| Change control | ضبط التغيير | Contrôle des changements | Değişiklik kontrolü | The agreed process for approving, recording and communicating a change to controlled business information before it takes effect. |
| Audit trail | سجل التدقيق | Piste d'audit | Denetim izi | A record of who did what and when, kept so a decision or change can be checked and reviewed later. |
Next you will learn how to prepare data and agree working methods before a move to a shared business system, seen through a sourcing agent's own onboarding into the new system. Back to the course map