The Hidden Cost of “We’ll Just Use Excel for Now”
Almost every business says some version of this sentence when Tranche 2 first lands on their desk. “We’ll just track it in a spreadsheet for now, and sort out a proper system later.” It feels reasonable. Excel is free, everyone already knows how to use it, and it feels like progress compared to doing nothing.
The problem is that “for now” tends to quietly become permanent, and the actual cost of that decision does not show up on day one. It shows up later, in three specific places. Let’s go through them honestly.
The time cost
A spreadsheet does not know anything. It does not remind you that a customer’s risk review is due, that a program update needs to be documented, or that a matter has crossed into a designated service. Every single one of those things depends on a person remembering to check, manually, across every row.
Here is where this becomes a real problem, not just an inconvenience. Under AUSTRAC’s rules, when you update your AML/CTF program or risk assessment, you are required to document that update within 14 days of making it. That is a hard deadline attached to a specific event, not a flexible internal target. If your only record of “we made a change” lives in someone’s memory and a spreadsheet cell they meant to update, that 14 day window becomes very easy to quietly miss.
Multiply this across every customer file, every risk rating, every review date, and every training record, and the time cost is not really about typing data into cells. It is about someone needing to manually cross reference everything, every time, with no system checking their work or flagging what has been missed.
The error cost
Spreadsheets fail quietly. That is what makes them dangerous here.
A formula gets dragged one row too far and silently pulls the wrong number. A risk rating gets updated in one tab but not in the summary tab someone else is actually looking at. A column gets sorted while another column stays still, and suddenly every row is mismatched with the wrong customer. None of these mistakes announce themselves. They just sit there, looking correct, until someone happens to notice.
This matters more here than in a typical business spreadsheet, because the stakes are not just an internal reporting error. AUSTRAC’s guidance expects your risk assessment and the reasoning behind it to be properly documented and reviewed. If your actual underlying data is quietly wrong, and nobody spots it, you can end up with a documented process that looks complete while the substance underneath it has drifted from reality.
There is also the question of who changed what, and when. A spreadsheet generally does not keep a clean history of every edit made to every cell by every person. If a customer’s risk rating changed from medium to low six months ago, can you actually show why, who made that call, and what information it was based on. If the honest answer is “probably, if we can remember,” that is the error cost catching up with you.
The cost that shows up on review day
This is the one that tends to hurt the most, because it arrives all at once, at the worst possible time.
Get Duely’s stories in your inbox
Join Medium for free to get updates from this writer.
AUSTRAC requires that Part A of your AML/CTF program be independently and regularly reviewed by someone not involved in developing or running it. The reviewer will look at things like whether your program is current, whether your policies actually match your risk assessment, and whether changes have been properly made and documented. You are also expected to keep records showing how any issues the reviewer raises were actually addressed.
Picture what that day looks like with a spreadsheet based system. The reviewer asks to see the risk assessment history for a specific client. Someone has to manually dig through old versions of a file, if those old versions were even saved separately at all. The reviewer asks for evidence that a program update was documented within 14 days of being made. Someone has to try to reconstruct, after the fact, exactly when a change happened and when it was written down, often relying on email threads or a vague recollection.
None of this looks good, and more importantly, none of it is actually about whether your business is doing the right thing. It is about whether your business can prove it did the right thing, at the exact moment someone independent is asking. A spreadsheet built for convenience during onboarding was never designed to answer that question under scrutiny.
Why this trap is so easy to fall into
None of this is really about spreadsheets being a bad tool in general. Excel is genuinely useful for a lot of things. The problem is specific to what AML/CTF compliance actually demands: a running history that cannot be quietly overwritten, deadlines that trigger themselves instead of relying on memory, and evidence that can be pulled up immediately rather than reconstructed under pressure.
A spreadsheet can hold the information. It generally cannot hold the discipline around that information staying accurate, current, and provable over time, especially as the number of clients and matters grows and more than one person is touching the file.
What this actually means in practice
“We’ll use Excel for now” is not automatically the wrong call for a business just starting out with a handful of clients. The mistake is treating it as a permanent home for something that only gets harder to manage properly as it grows. The honest questions worth asking are:
- If a reviewer asked for a specific customer’s full history right now, could you produce it in minutes, not hours or days.
- If your risk assessment changed six months ago, is there a documented record of exactly when, and why.
- Is anyone actually being reminded of upcoming deadlines, or is everyone relying on remembering to check.
- If two people touched the same file, would you know who changed what.
If the honest answer to any of these makes you uneasy, that is the hidden cost finally showing itself. The spreadsheet did not cause the problem on its own. It just made it very easy not to notice the problem building, until the day someone actually needed to look closely.
This article is for general information only and is not legal advice. Requirements can vary depending on your specific business and the services you provide. For full and current guidance, always check AUSTRAC’s official resources at austrac.gov.au.
