Why spreadsheet-led safeguarding processes create evidence risk.

A spreadsheet is a perfectly good record. Under CASS 15, that is not the same thing as evidence, and the distinction has quietly become expensive.

There is a specific spreadsheet, or more often a specific folder of spreadsheets, that has become quietly indispensable to a payments or e-money firm’s safeguarding process. It usually started as a temporary solution. Someone in operations built it to solve a particular problem. It worked. Colleagues began to use it. Over the months and years that followed, columns were added, tabs proliferated, macros were built and then broken and then patched, and at some point the workbook stopped being a temporary solution and started being the process itself. Reconciliation runs there. Break resolution is tracked there. Sign-off is recorded there, or somewhere adjacent, or in an email chain that references it. When the auditor asks how the firm managed its safeguarding through the year, the workbook is the answer.

Under CASS 15, that answer has become materially riskier than most firms realise. Not because spreadsheets are inherently bad, and not because the work done inside them is dishonest. Both are almost never true. The risk sits somewhere more specific. Spreadsheets are excellent records and poor evidence, and the safeguarding regime is now built around evidence.

This article is about the distinction between a record and evidence, why that distinction has become expensive under CASS 15, and the specific ways in which spreadsheets fail the evidence test even when the underlying work was done correctly.

Record and evidence are not the same thing

Start with the distinction. A record is what the firm remembers. It is the internal note of what happened, structured however the firm finds useful, maintained by the people who did the work. Evidence is what stands up when the firm is not in the room to explain it. It is the trail that a reader who was not present, and has no reason to trust the firm’s recollection, can follow to their own conclusion about what happened.

Under the previous regulatory position, records and evidence were often treated as interchangeable in practice. A firm that could describe what it had done, and could produce something that documented what it had done, was usually in a defensible place. Under the CASS 15 regime introduced by Policy Statement PS25/12, that treatment has narrowed. The safeguarding regime asks firms to demonstrate, in a form that does not depend on their description, that specific things happened in specific ways: that reconciliations ran on each reconciliation day, that discrepancies were investigated and corrected promptly, that sign-off happened at the appropriate level, that mandatory documents in the resolution pack are current, and that all of this was captured as the work happened.

A record that can be produced later is not the same as evidence that was captured at the time. Spreadsheets, by their nature, are the first kind. Making them into the second kind is harder than most firms realise.

Four ways a spreadsheet fails the evidence test

Spreadsheets fail as evidence in four specific and repeatable ways. They are worth naming because each one is invisible until an auditor asks the question that surfaces it.

The first is attributability. A spreadsheet cell records what is in it. It does not, by default, record who put it there. Version histories on shared drives capture some of this, but not reliably, and not at the level of individual cells. Two people can edit the same cell in the same session and the workbook cannot resolve which of them was responsible for the value that remains. Shared credentials, generic service accounts and the ordinary habits of collaborative work make the attribution problem worse, not better. Under CASS 15, sign-off and action are expected to be tied to a specific person or role. A cell containing a name and a date is not the same as a system record that a specific user made a specific action at a specific time.

The second is immutability. A spreadsheet is designed to be edited. Any value in any cell can be changed, at any time, by anyone with access. Later changes can be made to look like earlier ones. A row entered on the 27th can be given a date of the 12th, and the workbook will accept both entries with equal authority. Track-changes features exist in some tools but are frequently disabled, and are unreliable across the copy-paste patterns that spreadsheet work depends on. What auditors need, and what CASS 15 implicitly requires, is a record whose past entries cannot be quietly amended to fix a problem the firm noticed later. Spreadsheets do not provide this on their own.

The third is timestamping. Even where a spreadsheet captures modification times, those times are generated by the operating system of the machine that made the change and can be edited, wrong, or lost in the ordinary course of file movement. A workbook copied from a laptop to a shared drive may inherit the copy time rather than the edit time. A cell that says the reconciliation was signed off at 09:32 on the 8th of the month is not evidence that the sign-off happened then. It is evidence that someone typed that value into that cell at some later point.

The fourth is enforced workflow. A defensible break resolution moves through investigation, correction, evidence gathering, escalation and sign-off in a defined order, and each stage should be recorded as it happens. A spreadsheet does not enforce this. Nothing stops a user from marking a break as closed without recording the investigation. Nothing stops a sign-off column from being filled in retrospectively. Nothing stops a stage from being skipped entirely. The workflow lives in the head of the person filling in the spreadsheet, which is exactly the point at which evidence stops being evidence and starts being memory.

Why this now costs firms more

These four failures have existed for as long as safeguarding processes have used spreadsheets. What has changed is the cost of them. Under the CASS 15 regime, the annual safeguarding audit under SUP 3A and the monthly safeguarding return both depend on evidence that the underlying controls operated. When the evidence rests on a spreadsheet, three specific problems tend to surface.

The first is that the auditor asks a question the workbook cannot cleanly answer. Who signed off the correction of the £2,400 break identified on the 14th? At what time? Against what supporting material? The workbook shows a name in a column. The firm can usually reconstruct the answer, from emails, from the person’s memory, from the surrounding evidence. The reconstruction takes time, and produces a story that is broadly true and evidentially thin. That thinness compounds across the range of activity a full audit covers.

The second is that the firm cannot demonstrate the negative. When an auditor asks whether any break was corrected without appropriate sign-off, a spreadsheet cannot conclusively answer no. The absence of evidence is not evidence of absence. A system that enforces workflow can demonstrate the negative, because unsigned actions cannot happen. A spreadsheet cannot, because a missing signature might mean the sign-off did not happen, or might mean it did happen and was not recorded, and the workbook cannot distinguish the two.

The third is that senior individuals attest to information they cannot fully verify. Under the safeguarding regime, the monthly return is attested to by a senior individual as accurate. When the underlying evidence sits in workbooks whose integrity depends on the good faith of everyone with access, that attestation carries a personal risk the attester may not fully appreciate. It is one thing to attest to numbers produced by controlled systems with enforced workflows. It is another to attest to numbers produced by a workbook that any user with the file open could have altered.

What this changes in practice

The fix is not to abandon spreadsheets for the tasks they do well. Spreadsheets remain excellent tools for ad hoc analysis, working calculations and one-off investigations. The fix is to stop asking them to serve as the primary evidentiary record for a regulated safeguarding process, because they are the wrong shape for that job. What CASS 15 asks for is a record that was captured by the systems that did the work, at the time the work happened, with attribution, immutability, reliable timestamping and enforced workflow built in. That is a different kind of tool.

This is the work Imperium(L) Prism is built for. Prism captures every reconciliation, every break resolution stage, every sign-off and every user action inside a system that enforces the workflow, ties each action to a specific user and time, and does not permit past entries to be quietly amended. The audit trail is a byproduct of running the platform, not a record assembled from workbooks after the fact. The technology behind Prism has supported businesses in live, high-volume environments for over 12 years, so the operational logic has already been tested against real reconciliations and real audits.

Spreadsheets did not create the operational control gap that CASS 15 has exposed. They just happen to be where a lot of firms discover it. The distinction between a record and evidence has always mattered. The regime has made it enforceable. Firms whose safeguarding process rests on workbooks tend to find that they can describe their work perfectly well and cannot cleanly prove it. Under a regime that asks specifically for proof, that gap is where the risk now sits.

Frequently Asked Questions

Are spreadsheets banned under CASS 15?

No. CASS 15 does not name any specific tool. What it asks for is evidence that specific controls operated, in a form that does not depend on the firm’s later description. Spreadsheets can hold information usefully, but they struggle to serve as the primary evidentiary record for a regulated safeguarding process, because they lack the attributability, immutability, reliable timestamping and enforced workflow that a defensible evidence trail depends on.

What is the difference between a record and evidence?

A record is what the firm remembers. It is an internal note of what happened, maintained by the people who did the work. Evidence is what stands up when the firm is not in the room to explain it. Under CASS 15, the regime is built around evidence: a trail that a reader who was not present can follow to their own conclusion about what happened.

Can a spreadsheet be made defensible with track-changes or version history?

Partially, but not reliably. Track-changes features can be disabled, do not survive common copy-paste and file-movement patterns, and are not designed to enforce workflow. Version history on shared drives captures file-level changes but not cell-level attribution. Neither addresses the underlying problem, which is that spreadsheets are designed to be edited freely and do not enforce the sequence in which safeguarding actions should occur.

What does a defensible safeguarding evidence trail look like?

It is captured by the systems that do the work, at the time the work happens. Every action is attributable to a specific user or role. Past entries cannot be quietly amended. Timestamps are generated by the system rather than entered by a user. Workflow stages are enforced in sequence, so a step cannot be skipped or filled in retrospectively. The trail is a byproduct of running the system, not a record assembled after the fact.