Compliance
Why Spreadsheets Fail Lab Compliance (and What Replaces Them)
Every laboratory we’ve ever talked to starts the same way: a spreadsheet for calibration, another for training, a third for EQA, a folder of PDFs for SOPs, and a paper log on the maintenance bench. It works. It works for years, sometimes. And then it stops working — usually at the worst possible moment.
This isn’t a pitch. It’s an honest account of why the spreadsheet stack fails the labs that rely on it, what the failure modes look like in practice, and what a system designed for the job does differently. If you’re reading this from inside that stack, you’ll recognise yourself in places.
Why spreadsheets feel like they work
It’s worth steelmanning the spreadsheet first, because it’s not crazy. Spreadsheets are:
- Free, or close to it
- Universally available — every staff member can open one
- Flexible — you can model any workflow, any cadence, any schema
- Familiar — nobody needs training to use them
For a single-site lab with a small team and a stable list of procedures, a well-built spreadsheet can carry the lab through years of inspections. The labs we see in the worst trouble are not the ones that started with spreadsheets; they’re the ones that kept using spreadsheets long after the lab outgrew them.
Where spreadsheets fail
The failures aren’t dramatic. They’re slow, cumulative, and obvious in retrospect.
Drift
Every spreadsheet starts the same: clean columns, consistent naming, a sensible schema. Over months, someone adds a column. Someone else copies a row. A new test gets logged in a slightly different way. A technologist puts a comment in the cell for the date. By year two, the schema is “whatever the most recent edit was”. By year four, half the formulas are pointing at cells that no longer exist.
Drift is structural. It happens because spreadsheets have no enforced schema. The only thing keeping the data consistent is the diligence of the people typing into it, and that diligence is finite.
No event time
A spreadsheet records state — the most recent date, the current value, the latest status. It does not naturally record events — when something changed, who changed it, what it was before. You can build event tracking in by adding a “history” tab, but very few labs do, and the ones that do find it doubles the maintenance burden.
When an auditor asks “show me the calibration history for this analyser”, you want a flat list of events with dates and signatures. What spreadsheets give you is the current row plus whatever notes anyone bothered to write.
Reminders that don’t fire
Compliance is a reminder problem more than anything else. Calibration is due in 30 days. Training expires in 14 days. The EQA review window closes in 7 days. The SOP is up for review next month.
A spreadsheet doesn’t send reminders. Someone has to look at it and notice. That someone is usually busy. The reminder that doesn’t fire is the deficiency that does.
No multi-user concurrency
Two people editing the same spreadsheet at the same time is a recipe for either a merge conflict or — worse — silent data loss. Most labs respond by having a designated “owner” for each spreadsheet, which creates a single point of failure: that person goes on leave, the file goes stale.
No audit trail
Who changed cell C47 from “due 5 March” to “due 5 April”? The spreadsheet doesn’t know. Track changes in Excel is brittle and easily turned off; version history in Google Sheets is better but rarely consulted. When an inspector asks who modified a record and when, “we don’t know” is not a viable answer.
Files versus the truth
The spreadsheet is the calibration log. The PDF certificate is in a shared-drive folder. The link between the two is “the filename starts with the analyser serial number” — until somebody renames a file, or until two analysers have similar serials, or until the shared drive gets reorganised. The connection is implicit, and implicit connections rot.
The “where is it?” problem
A normal Tuesday: the QA officer needs to confirm that staff member X is current on procedure Y. With a spreadsheet stack, the answer takes ten minutes:
- Open the training matrix spreadsheet
- Find row X (sort, search, scroll)
- Read the date in column Y
- Cross-reference with the competency assessment spreadsheet
- Confirm the assessment hasn’t expired
- Check the SOP folder for the current version of procedure Y to confirm it matches what the assessment covered
Multiply by 80 staff members and 40 procedures and you have someone’s entire week. That’s not a productivity problem. That’s a budget the lab is paying every month, forever, to compensate for a system that wasn’t designed for the job.
What a system designed for this does differently
The replacement isn’t novel. The principles are well-understood, and any well-built compliance platform implements them:
Schema enforcement
A real system has a fixed data model. You can’t accidentally store a calibration date in a “notes” field; the field doesn’t accept dates. New procedures inherit the same structure. Drift becomes structurally impossible.
Event sourcing
Every calibration logged, every training completed, every SOP acknowledged is a discrete event with a date, an actor, and a payload. The “current state” of any record is derived from its event history. When an auditor asks for history, you give them history — the same data the rest of the system is built on.
Active reminders
The system knows what’s due, who owns it, and when to remind them. Reminders fire 30, 7, and 1 day before due, plus on overdue. Each reminder is itself a recorded event — if the question becomes “did anyone tell the technologist?”, the answer is in the log.
Roles and concurrency
Multiple people can use the system simultaneously without trampling each other. Permissions are explicit — technologists log their own training; admins manage the register; viewers see everything in read-only. There’s no spreadsheet to lock; there’s a database that handles it.
Audit trail by default
Every change is attributable. Edits are recorded. Soft deletes preserve history. When the inspector asks who changed what and when, the system tells them.
Linked evidence
The calibration record links to the certificate file. The training record links to the evidence upload. The SOP version links to the staff acknowledgments. Files aren’t loose objects in a shared drive — they’re attached to the records they belong to, with checksums to prove they haven’t been altered.
Live readiness
Instead of opening five spreadsheets, you open one dashboard. Calibration score, training score, maintenance score, EQA score, document score — five numbers, side by side, current to the moment. The thing the auditor will look at first is the thing you look at every morning.
When to make the switch
The labs that move usually do so for one of three reasons:
- A finding made the cost obvious. Something slipped, the inspection found it, the corrective action requires a system change.
- The lab grew past the spreadsheet’s limits. New site, new instruments, new staff — the volume crossed a line where the manual effort stopped being defensible.
- The person who maintained the spreadsheet stack left. The institutional knowledge of which tab is the real one walked out the door.
The right time, in all three cases, is “before”. Building the system while compliance is calm is much cheaper than rebuilding it from a finding.
The honest summary
Spreadsheets are not the enemy. They are tools that were never designed for the load that lab compliance puts on them. They drift because they have no schema. They go stale because they have no reminders. They lose history because they have no event model. They create work because they have no integration with the evidence they reference.
A purpose-built platform handles all of that as the default behaviour, not as a feature you have to remember to invoke. The lab keeps doing the right work on the bench — that part was never the problem — and the system keeps the records that prove it.
The next inspection is the test. The system you choose decides whether that test feels like a week-long project or a normal Tuesday.
Related reading:
