Process guide
A spreadsheet is a good tool for one-off analysis and a weak tool for running a continuous process. The boundary sits where three things appear at once: multiple concurrent users, deadlines that need reminders, and an obligation to show who changed what and when. Below that line Excel is fine; above it, it starts generating hidden costs.
Nobody abandons spreadsheets because they look bad. They abandon them because, two days before an audit, three people are reconstructing which version of the file is the right one.
Published: 2026-02-02 · Updated: 2026-11-01 · 8 min · Varilo deployment team
Start with the honest positive. Excel is instantly available, needs no deployment or IT approval, can calculate anything, and lets you build any table layout in fifteen minutes. For a one-off trend analysis or preparing data for a meeting, it is hard to beat.
The problem is not that spreadsheets are bad. It is that a tool designed for calculation ends up serving as a workflow system, an evidence register and a deadline calendar at the same time.
First: files circulate named “final”, “final2”, “after comments”. Second: nobody can reconstruct who changed a cell value or on what basis. Third: health surveillance, training and inspection deadlines are tracked by one person's memory backed by conditional formatting.
Fourth: the board summary is assembled by hand over several hours and comes out slightly different each time. Fifth: shop floor data reaches the system late because it is written on paper first. Sixth: at audit there is no evidence of completion — there is a “done” entry but no photo or report.
Seventh, and most serious: the file contains personal data and travels by email between people who should not have access. That signal usually settles the matter faster than all the others combined.
A small organisation with one site, one person handling safety and a stable set of workstations can work on spreadsheets for years without harm. The same goes for a one-off analytical project or a summary produced once a year.
The signal to change is not company size but the number of concurrent participants in the process and the number of deadlines somebody has to remember. Three people editing the same file is already a problem; thirty deadlines a quarter is already a risk.
The worst strategy is migrating everything at once. The best is choosing the single process that hurts most — usually reports and actions after events — and running it end to end in the system: from a phone report to the effectiveness review.
Historical data moves selectively. Open actions, current risk assessments and live deadlines — yes. A five-year-old archive stays where it is; securing it is enough.
After the first process, the next ones arrive faster because the organisational structure, permissions and workstation list are already in place. A typical order is: reports and events, then corrective actions, then audits and safety walks, then training and health surveillance, and finally chemicals and technical registers.
Audit trail — an automatic record of who changed or deleted which value and when. A spreadsheet's file version history does not replace it because it does not show changes to individual records.
Health data (GDPR Article 9) — occupational medical certificates, accident and occupational disease information are special category data requiring restricted access and accountability; a file emailed widely may be a personal data breach.
Single source of truth — every register (employees, training, medical checks, corrective actions) exists in one current version used by everyone.
Total cost of ownership (TCO) — compare not only licences but the hours spent consolidating files, building reports and reconstructing history before audits.
EHS metrics and ESG reporting — accident frequency, near misses, training completion and CAPA closure feed the social part of sustainability reports; a system calculates them the same way every period.
Spreadsheet as an analysis tool — Excel stays for exports and one-off charts; the process runs in the system, for example in near-miss reporting.
Internal audits and safety inspections
Audits and inspections — from checklist to a closed nonconformity
Plan an audit or round, run it from a phone, record nonconformities and launch actions immediately — without retyping results into a spreadsheet.
Explore the VIMS EHS module: Audits and inspections in one systemCorrective and preventive actions — CAPA
CAPA — corrective and preventive actions with real accountability
No more action lists in a spreadsheet. Every action has an owner, a deadline, a status and an effectiveness check — all in one view.
Explore the VIMS EHS module: CAPA corrective actionsEmployees and competence
Employees and competence — one record instead of ten separate name lists
The same people appear on the training list, in the examination schedule, in a risk assessment, on a work permit and in an accident report. If each of those lists lives its own life, sooner or later they stop agreeing. This module fixes the problem at the data level, not at the form level.
Explore the VIMS EHS module: Employee registerNo. The spreadsheet stays as an analytical tool: data exports, one-off calculations, meeting material. It stops being the place where the process runs and evidence is stored.
With the single process that has the highest frequency and the highest risk — usually reports and actions after events. One process running end to end delivers more than five processes running halfway.
Only what is still operational: open actions, valid risk assessments, live training and health surveillance dates, active substances. The archive can stay in its current form.
Usually not a feature list but one specific question asked live: how many overdue deadlines do we have across the organisation right now. When the spreadsheet answer takes two days and the system answer takes ten seconds, the discussion ends.
The tool itself is not banned, but medical certificates are health data under Article 9 GDPR. The employer must ensure restricted access, accountability and security, which is hard when files circulate by email.
An unalterable log of record changes — who changed what and when — showing auditors that data was not edited after the fact.
Accident, near-miss, training and corrective action metrics come from one data source using the same method each period instead of manual assembly.
In a demo we can take one of your registers and show the same process running inside VIMS.
