First build a risk-control matrix in Excel, then look for software – how daft is that?

What you can expect from this article

Open Excel, enter the risks, add the controls alongside them. Specify a probability of occurrence on a scale of 1 to 5, then the level of loss. Then quickly add a formula for the risk score, assign traffic-light colours, and your ‘ICS light’ is ready. Or your ‘TCMS light’. Or is it? That’s how many managers in companies think.

I hear comments like this surprisingly often:

• „We want to start with Excel for now.“
• „We need to start by identifying our risks and controls.“
• „Once that’s in place, we can always introduce software later on.“

It sounds pragmatic, but it often isn’t. This is because it involves more than just creating a list; it already defines structures, assessment criteria, responsibilities and working methods. And if it is later found that Excel may not, after all, be the best platform for a long-term ICS or TCMS, the workload escalates.

How do we incorporate all of this into the software now?

The reason for this is simple: an Excel spreadsheet is not, in itself, a data model. The core problem is not the 100, 500 or 2,000 rows. You can import those somehow. Rather, the crucial question is: what do these rows actually mean? After all, a modern ICS or TCMS does not consist solely of „risk/control/person responsible“. Processes involve risks. And risks can have multiple controls. These controls, in turn, can address multiple risks. There are responsible parties, implementers, auditors, organisational units, legal areas, control frequencies, supporting evidence, tasks, deadlines and escalations. Added to this are assessments, versions and changes over time.

An Excel spreadsheet can represent this to some extent, but software must represent it in a structured way. Anyone who builds the Excel spreadsheet first and only then selects the software may therefore end up building it twice: first an Excel model – and then the actual system. And where does the risk assessment actually come from?

Things get even more interesting with the classic risk-control matrix:

• Probability of occurrence: 3.
• Amount of damage: 4.
• Risk: 12.

It looks scientific. But why a 3, actually? Who decided that? On what data was it based? When was the assessment carried out? What information was available at that time? Who subsequently changed the rating? Why did a 4 eventually become a 3? What rating methodology was in use at that time? And was the extent of the damage assessed before or after the controls were taken into account?

Instead of answers, one is left with even more questions

Suddenly, a neat little Excel „traffic light“ system turns into a rather interesting governance issue. After all, a robust ICS or TCMS should provide a clear record of who assessed, amended, checked and approved what, when and on what basis. This is the difference between documentation and a system. Only a system delivers the quality that generates added value and stands up to scrutiny. But hang on a minute – don’t we have version control in SharePoint? Yes, of course. And that’s certainly better than the infamous ‘IKS_final_v7_NEW_reallyfinal.xlsx’ on the network drive. And, of course, with Microsoft 365, permissions, version control and supplementary organisational measures, it’s possible to create significantly better structures than with an Excel file being passed around uncontrollably.

However, this is far from turning Excel into a specialised ICS or TCMS application. After all, file versioning does not automatically answer technical questions such as:

• Which risk was reassessed, and when?
• Which control has been changed?
• What impact did this have on the residual risk?
• Who then had to take action?
• Was the inspection actually carried out?
• Where is the evidence?
• Was it effective?
• What task did this give rise to?

Yet these interrelationships are crucial for carrying out a meaningful analysis of the data collected.

Perhaps the biggest misconception: an ICS is not a table

An ICS is not the same as a risk-control matrix. Similarly, a TCMS does not consist solely of an Excel file in which tax risks are documented. Such overviews always represent only part of the overall system. A functioning ICS or TCMS encompasses processes, risks, controls, responsibilities, assessments, measures, tasks and evidence. Added to this is the ongoing monitoring of these elements. The system must be updated regularly, as the operating environment within the organisation may change. Controls are carried out and documented, deadlines must be met, responsibilities may change and processes may be adapted. This may give rise to new risks or necessitate a review of existing assessments and measures.

The real work often only begins once a risk-control matrix has been drawn up. An ICS or TCMS must subsequently be maintained and further developed on an ongoing basis. Anyone who starts out using Excel and later switches to specialist software must therefore transfer existing processes, risks, controls and responsibilities. The data structures often differ significantly. Structured data records, status values and workflows must be developed from simple Excel rows, free-text entries or colour codes. As a result, what initially appears to be cost-effective preparatory work in Excel can quickly turn into a complex migration project.

Avoid supposed shortcuts that lead to detours

Please don’t get me wrong: I don’t want to force our software on anyone. Rather, I’m concerned with the mindset required to tackle important projects such as ICS and TCMS. Ultimately, every company should choose the solution that best suits its own workflow. Compare the solutions available on the market and carry out a proof of concept. Examine role and authorisation models, workflows, audit trails, valuation methods, task management, supporting documentation, interfaces and reporting in detail.

If it is clear from the outset that an ICS or TCMS is to be operated on a long-term basis, then you should give some thought right from the start to the system in which it will eventually be hosted. Don’t just develop the entire structure in Excel first and then try to work out how to integrate it into a professional application. That said, I wouldn’t want to put anyone off using Excel. After all, it’s great for planning workshops, gathering ideas and preparing data imports. Excel is also an excellent tool for evaluations, quick analyses or an initial assessment. However, the same applies to Excel as to all pre-installed standard programmes on a company PC: do not try to compulsively use one of the installed programmes for every task simply because it is already there.