For you if · The workaround became the system
Your team maintains a spreadsheet beside the compliance platform
A parallel spreadsheet is not a discipline problem. It is your organisation telling you, in the most direct way available, that the software cannot represent something the work actually requires.
That spreadsheet is also the most valuable specification document you will ever have. It was written by the people doing the work, refined under real pressure, and it describes exactly the gap.
Almost every custom engagement I take on starts here. Not with a strategy workshop, not with a feature list. It starts with someone opening a spreadsheet they are slightly embarrassed about and explaining why it exists.
You probably recognise at least three of these
- The spreadsheet is the version staff actually trust, and the platform is what gets updated before an audit.
- One person understands the formulas, and everyone quietly worries about them leaving.
- It has been rebuilt at least once after someone broke it.
- It holds a relationship the platform has no field for: a subcontracting arrangement, a shared program, a consent that was withdrawn and re-given.
- Reporting means exporting from two places and reconciling by hand.
- Nobody can answer "how did we know that was true on that date" without opening a file history.
The last one is the audit exposure. Evidence of control means being able to show what was known, by whom, when. A spreadsheet has a modification history; it does not have an evidence trail. Auditors increasingly know the difference.
What the engagement actually looks like
Two weeks inside your workflow, before anyone writes code. Not a discovery deck. Sitting with the spreadsheet and the people who maintain it, and mapping what it holds against what you are obliged to hold.
You come out with a build plan, an accuracy baseline and a risk register. You keep all three whether or not you engage further, and one legitimate outcome is being told the right answer is to configure your existing platform properly and build nothing.
What gets built, when something does
Usually not a replacement for your compliance platform. A narrow system that holds the thing the spreadsheet holds, with the evidence trail the spreadsheet cannot produce, integrated with what you already run so nobody maintains two sources of truth.
- Australian-hosted, inside your own tenancy where that matters
- Architected against the Privacy Act 1988 (Cth)
- Audit trail and retention handling as first-class features, not a reporting add-on
- WCAG 2.1 AA as a floor
- You own the code, the infrastructure and the documentation from day one
Common questions
We are not sure the spreadsheet is a big enough problem to spend on.
That is what the two weeks establishes, and it is deliberately cheap enough to be worth running to find out the answer is no. The risk register alone usually pays for it.
Will this replace the platform we already pay for?
Rarely, and I would generally advise against it. The platform handles the standard obligations well. What gets built is the piece it structurally cannot represent.
Who maintains it afterwards?
Whoever you choose. Everything is handed over with documentation and no dependency that only I can renew. A system you cannot leave is a system you should not commission.