What should organisations do when spreadsheets are filling Oracle control gaps?

Why This Matters for Security Teams

When Oracle control evidence lives in spreadsheets, the problem is usually not the spreadsheet itself. The real issue is that approvals, exception handling, and reconciliation have been split away from the systems that create, change, and revoke access. That creates weak lineage, manual handoffs, and evidence that is hard to trust during audit. For NHI programs, the same pattern shows up in service accounts, API keys, and privileged workflows, where manual tracking cannot keep pace with change. NHI Mgmt Group research shows that only 5.7% of organisations have full visibility into their service accounts, which helps explain why spreadsheet-led controls keep failing. A better reference point is the governance model described in the Ultimate Guide to NHIs — Standards, paired with the evidence and traceability expectations in the NIST Cybersecurity Framework 2.0. In practice, many security teams discover the control gap only after auditors ask for proof that nobody can produce with confidence.

How It Works in Practice

The right response is to treat spreadsheets as a temporary bridge while the control moves into policy-driven workflow, not as the control itself. Start by identifying each Oracle process that depends on manual files: access approvals, segregation-of-duties exceptions, emergency access, reconciliations, and quarterly attestations. Then map each step to a system of record that can generate immutable evidence, such as ticketing, IAM, PAM, or workflow automation tied to the Oracle admin path. The goal is to make every decision traceable back to a requester, approver, policy rule, and timestamp.

For NHI-heavy environments, this is where manual reconciliation usually breaks down. Secrets, service accounts, and integration users should be managed as governed identities, not row entries in a workbook. Current guidance suggests aligning this work with the lifecycle, visibility, and rotation practices in Ultimate Guide to NHIs — Standards and the access control expectations in NIST Cybersecurity Framework 2.0. A practical implementation usually includes:

• Policy-based approvals that route by role, risk, and application sensitivity.
• System-to-system evidence capture for who approved what, when, and under which control.
• Automated recertification for privileged Oracle access and NHI credentials.
• Centralised ownership for exceptions so temporary workarounds do not become permanent controls.

The most useful test is simple: if an auditor asked for the last 90 days of access decisions, could the organisation reconstruct them without opening a spreadsheet? These controls tend to break down when Oracle access is spread across multiple teams and legacy integrations because evidence becomes fragmented across emails, file shares, and local admin tools.

Common Variations and Edge Cases

Tighter workflow control often increases process overhead at first, so organisations have to balance automation speed against auditability and change management friction. That tradeoff is real, especially where Oracle supports legacy finance or manufacturing systems that cannot be reworked quickly.

There is no universal standard for every exception model yet, but current guidance suggests keeping spreadsheets only for transitional tracking, not as the source of truth. If a business unit insists on manual files for edge-case approvals, the minimum safeguard is to bind the spreadsheet to a formal ticket, a named owner, and a time-bound expiration for the exception. That reduces the chance of “temporary” access becoming standing access.

The highest-risk edge cases are emergency privileged access, cross-system reconciliations, and service account ownership transfers. Those should be brought under Ultimate Guide to NHIs — Standards where identity lifecycle and revocation discipline are explicit, and measured against NIST Cybersecurity Framework 2.0 outcomes for protected access and recoverable evidence. The practical rule is straightforward: if the spreadsheet is making a decision, the control is still manual; if the workflow is making the decision and the spreadsheet is only a shadow record, the organisation is moving in the right direction.

Related resources from NHI Mgmt Group

• Why do Oracle ERP environments create evidence and access-review gaps?
• When should organisations move beyond Oracle-native governance?
• How do organisations operationalise NHI ownership at scale?
• When should organisations treat an NHI as a high-priority risk?