What breaks when IT teams manage access in spreadsheets?

Why This Matters for Security Teams

Spreadsheet-managed access usually looks harmless until the organisation needs to prove who had access, when it changed, and why it was approved. The problem is not just administrative drag. A spreadsheet is a static record in a dynamic environment, so it cannot keep pace with joiner, mover, and leaver events, emergency changes, temporary elevation, or offboarding. That gap creates stale access, delayed provisioning, and weak audit evidence.

For security teams, the bigger issue is that spreadsheets turn access governance into a memory exercise. They do not enforce policy, they only document it after the fact, which leaves room for drift between recorded approvals and actual entitlements. That is why frameworks such as the NIST Cybersecurity Framework 2.0 and the OWASP Non-Human Identity Top 10 both emphasise control, visibility, and accountability rather than manual recordkeeping. NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives shows the same pattern in identity operations: when records are not current, neither humans nor machine identities can be governed reliably.

In practice, many security teams discover the gap only after an access review, incident, or audit has already exposed how far the spreadsheet drifted from reality.

How It Works in Practice

Spreadsheet workflows break down because access management is a lifecycle process, not a filing exercise. A row in a workbook may show who requested access and who approved it, but it cannot automatically reconcile the current HR status, privilege level, recertification date, or revocation state. Once a person changes role, leaves a team, or exits the company, the spreadsheet must be updated manually. That delay is where risk accumulates.

Operationally, the failure shows up in three places: entitlement sprawl, slow fulfilment, and weak deprovisioning. Teams often compensate by granting broad access “just to keep work moving,” then leave cleanup for later. That later never arrives on time. NHIMG’s Ultimate Guide to NHIs notes that only 5.7% of organisations have full visibility into service accounts, which is a useful reminder that visibility failures are not limited to human access. The same governance pattern affects secrets and service accounts when spreadsheets are used to track ownership, rotation, and offboarding.

• Provisioning becomes slower because approvers must manually validate each request.
• Deprovisioning becomes unreliable because stale rows survive role changes and departures.
• Audit trails become fragile because approval evidence is scattered across email, chat, and file versions.
• Attestation becomes performative when the spreadsheet says one thing and the directory says another.

A more durable model is to treat the spreadsheet, if it exists at all, as a reporting artifact and move enforcement into the identity platform, ITSM workflow, or policy engine. That aligns better with the control expectations in the NIST Cybersecurity Framework 2.0 and with NHIMG guidance in the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs.

These controls tend to break down when access changes are handled in multiple disconnected systems because no single record remains authoritative.

Common Variations and Edge Cases

Tighter access control often increases operational overhead, so organisations have to balance speed against assurance. That tradeoff is especially visible in small IT teams, mergers, and regulated environments where a formal IAM platform may not yet be fully deployed.

Best practice is evolving, but current guidance suggests that spreadsheets may be tolerated only as a temporary intake or reconciliation aid, not as the system of record for access decisions. In low-risk environments, a spreadsheet might help track approvals for a short transition period. In higher-risk environments, especially where privileged access, secrets, or service accounts are involved, the same approach becomes unacceptable quickly because it cannot support timely revocation or trustworthy evidence.

The edge case that catches teams most often is partial automation. A workbook may feed a ticketing queue, yet approvals still happen by email and revocations still depend on manual cleanup. That creates a false sense of control. NHIMG’s Top 10 NHI Issues and the 52 NHI Breaches Analysis both reinforce the same lesson: identity failures usually persist where ownership, rotation, and offboarding remain manual.

For audit-heavy organisations, the practical path is to define a single authoritative source for access state, then require every spreadsheet export to be time-bound and disposable. Anything longer-lived should be managed in the directory, PAM, or workflow engine rather than in a file.

Related resources from NHI Mgmt Group

• How should security teams manage access reviews across multiple compliance frameworks?
• What breaks when SOX access evidence still lives in spreadsheets?
• What breaks when teams rely on human judgment to limit machine access?
• How should teams govern device access when they manage macOS, Windows, and Linux separately?