Have you ever heard the expression, “Better the devil you know”?
It explains why people stick with old habits, outdated systems, and processes that should have been replaced years ago.
Not because they’re good.
Because they’re familiar.
We know where the problems are. We know the shortcuts. We know the workarounds. Somehow, that feels less risky than changing.
Environmental compliance spreadsheets are a classic example.
Most organisations understand their limitations. Version control becomes more difficult as more people get involved. Changes can happen without anyone noticing. And when auditors come knocking, proving who changed what, when, and why can be difficult.
Many organisations have experienced the endless cycle of:
- Compliance Register v7.xlsx
- Compliance Register v7 Final.xlsx
- Compliance Register v7 Final Updated.xlsx
- Compliance Register v7 Final Updated Approved.xlsx
When an audit, investigation, or management review occurs, teams often find themselves piecing together evidence from spreadsheets, emails, and meeting notes to understand what actually happened.
Yet they keep using them.
Not because spreadsheets are the best tool for managing environmental compliance.
Because they’re the devil they know.
For a while, that can work.
Then monitoring programmes grow. More sites come online. More laboratory results arrive. More obligations need to be tracked. More people become involved.
The spreadsheet stays the same.
The complexity doesn’t.
That’s when the cracks start to appear.
The question isn’t whether spreadsheets can be used to manage environmental compliance.
They can.
The real question is whether they’re still the right tool for the job.
The Problem Isn’t Hidden
The strange thing about spreadsheet-based compliance systems is that most of the risks aren’t hidden.
We already know they’re there.
We know version control becomes harder as more people become involved.
We know information can change without a clear audit trail.
We know preparing for audits often means searching through spreadsheets, emails, shared drives, and meeting notes to piece together the full story.
Yet many organisations continue with the same approach because, most of the time, it appears to work.
Reports get submitted.
Monitoring programmes continue.
No alarm bells ring.
The weaknesses only become visible when the process is tested.
An environmental incident.
A missed reporting deadline.
An auditor asking for evidence.
A regulator requesting records from years ago.
That’s when organisations discover whether they have a compliance system or simply a collection of files.
Compliance Is About More Than Data
Spreadsheets are excellent at storing information.
Environmental compliance is about much more than storing information.
It’s about accountability.
It’s about traceability.
It’s about ensuring the right people know the right things at the right time.
And it’s about being able to confidently answer questions when management, auditors, or regulators come asking.
This is where spreadsheets often start to struggle.
Not because they’re bad tools.
Because they were never designed to manage complex compliance processes.
The Comfort of Familiarity
This is where the “better the devil you know” mindset becomes dangerous.
The longer a spreadsheet-based process survives, the more confidence people place in it.
After all, it hasn’t failed before.
But the absence of incidents doesn’t prove the absence of risk.
It may simply mean the process hasn’t been tested yet.
Many organisations only discover weaknesses in their compliance processes when they’re required to prove that everything was done correctly.
Unfortunately, that’s usually the worst possible time to find out.
Final Thoughts
Spreadsheets have earned their place in business.
They’re flexible, familiar, and incredibly useful.
The problem is that environmental compliance is no longer just a data management exercise.
It’s a governance exercise.
An accountability exercise.
A risk management exercise.
And while it’s natural to stick with the devil you know, it’s worth asking whether that familiarity provides genuine confidence or simply a false sense of security.
Because when an auditor, regulator, or environmental incident finally puts your processes to the test, that’s when you’ll discover whether the devil you know was really looking after you at all.
For more support with compliance systems, speak with DB Gurus.
For more support with compliance systems, speak with DB Gurus.
