Case Study: Replacing Excel-Based ISMS with SharePoint and Saving 100+ Hours

Introduction

Excel is often where an ISMS begins.

It feels simple. It is familiar. Everyone knows how to use it. And for a small compliance program, it can work well enough at first.

• A risk register in one spreadsheet.
• Corrective actions in another.
• Vendor reviews in a third.
• Evidence tracking in a fourth.
• Policy review dates in a fifth.

Then the organization grows. More controls. More evidence. More owners. More audits. More customer security questions. More versions of the same file.

The Client Situation

Let’s call the company CloudLedger SaaS.

CloudLedger was preparing for ISO 27001 and SOC 2 readiness while serving a growing number of mid-market customers. The team had:

• 65 employees
• a small security and compliance team
• Microsoft 365 already in place
• a growing vendor list
• recurring access reviews
• internal audit requirements
• customer questionnaire pressure
• leadership asking for clearer compliance status

The company’s ISMS was mostly managed through Excel files stored in SharePoint. At first, that seemed practical. But by the time audit preparation started, the system had become hard to manage.

The Problem

The ISMS was split across multiple spreadsheets:

• risk register
• Statement of Applicability tracker
• corrective action tracker
• vendor review tracker
• evidence request tracker
• policy review schedule
• access review tracker
• internal audit findings list

Each file had its own format. Some had owners. Some had dates. Some had evidence links. Some had outdated status fields. Some had copied tabs from older versions.

The problem was not that Excel was useless. The problem was that Excel had become the operating system for the ISMS, and it was no longer strong enough for the job.

The Breaking Point

The breaking point came during audit readiness. A customer asked for evidence of access review completion, vendor review process, incident response readiness, policy approval history, and corrective action closure.

The evidence existed. But gathering it took too long.

• open several spreadsheets
• verify latest versions
• chase control owners
• copy status updates into a summary
• check whether evidence links still worked
• confirm whether closure notes were complete
• rebuild a report for leadership

The Goal

CloudLedger wanted a better system without buying a heavy GRC platform. Because the company already used Microsoft 365, SharePoint was the practical choice.

The goal was to replace the Excel-based ISMS with a SharePoint structure that could manage:

• risks
• controls
• evidence
• vendors
• corrective actions
• policy reviews
• internal audits
• management review inputs

The Solution: Turning SharePoint Into an ISMS Workspace

The team redesigned SharePoint around live lists, controlled libraries, metadata, and filtered views.

Instead of treating SharePoint as a file cabinet, they turned it into a working ISMS environment.

1. Risk Register Moved From Excel to SharePoint List

The risk register became a structured SharePoint List with risk ID, title, description, owner, asset or process, inherent risk, existing controls, residual risk, treatment decision, treatment action, due date, status, and next review date.

2. Corrective Actions Became Trackable Work Items

Corrective actions were moved into a dedicated SharePoint List. Each action had an ID, source of finding, description, owner, priority, due date, status, evidence link, verification status, and closure date.

The team created views for:

• overdue actions
• high-priority actions
• actions pending verification
• actions by owner

3. Vendor Reviews Became a Live Register

The vendor review spreadsheet was replaced with a SharePoint vendor register.

4. Evidence Library Got Metadata

The evidence library was rebuilt with metadata instead of loose folders. This was one of the biggest time savers.

5. Policy Reviews Became Visible

Policy review tracking was added directly into the policy document library. Each policy had an owner, document type, approval status, version, approval date, next review date, and related control.

The team created views for:

• policies due for review
• policies pending approval
• approved policies
• archived documents

6. Internal Audit Findings Connected to Corrective Actions

Internal audit findings were no longer tracked in a standalone spreadsheet. They were added to a SharePoint audit findings list and linked to corrective actions.

• finding ID
• audit area
• description
• severity
• owner
• related corrective action
• status
• closure evidence

The Time Savings

After the SharePoint ISMS was implemented, the team tracked time savings over the next audit-prep cycle. They estimated more than 100 hours saved.

What Improved Beyond Time

The time savings were valuable. But the bigger improvement was control.

The compliance lead was no longer acting as the human connector between eight spreadsheets. The system itself showed what needed attention.

What Made the Migration Work

The project succeeded because the team did not try to overbuild.

They focused on the highest-value ISMS areas first:

• risk register
• corrective actions
• vendor reviews
• evidence library
• policy reviews
• internal audit findings

Each list had clear fields, owners, due dates, statuses, and views. The goal was not to create a complex system. The goal was to make compliance work easier to run.

Lessons Learned

1. Excel is fine until the process becomes recurring and audit-critical: Once owners, deadlines, evidence links, and status updates are involved, Excel starts creating drag.
2. SharePoint works best when designed around workflows: Folders alone are not enough.
3. Metadata saves more time than people expect: Good metadata makes evidence searchable and useful.
4. Corrective actions need visibility: If findings are hidden in spreadsheets, follow-up slows down.
5. Management review gets easier when inputs are structured: Risk, vendor, incident, and action summaries are faster when the data already lives in lists.

Canadian Cyber’s Take

At Canadian Cyber, we often see organizations using SharePoint only as a place to store compliance files. That misses the biggest opportunity.

Takeaway

Replacing an Excel-based ISMS with SharePoint is not just a technology change. It is an operating model change.

Stay Connected With Canadian Cyber

Follow Canadian Cyber for practical guidance on SharePoint ISMS, ISO 27001, SOC 2, evidence management, audit readiness, and vCISO support.