Managing SM&CR on spreadsheets, what it is actually costing your network
A spreadsheet costs nothing to open, which is exactly why its real cost rarely gets counted. For a network, that cost shows up in four places: rules that change while the sheet stays the same, errors nobody can see, evidence that cannot be produced when the regulator asks, and hours that never appear on any invoice. None of it is dramatic on a given day. All of it surfaces at once when someone outside the firm asks to see the record.
What a principal firm actually has to keep track of
SM&CR sits with the principal firm, not with its appointed representatives, which means the network carries the accountability for what its ARs do under the agreement. In practice, that gives a network a set of recurring, date driven obligations. A named Senior Manager needs to be accountable for oversight of the ARs. Staff of the network itself who hold certification roles must be assessed as fit and proper and certified every year. The FCA must be notified at least 30 days before a new AR is appointed. Every AR needs an annual review covering the fitness and propriety of its senior management, its financial position, and whether the network's own controls and resources are adequate to oversee it, with a written record kept for at least six years. And the network submits an annual return on AR complaints and revenue, known as REP025.
Take a network of 50 ARs as an illustration. That is 50 annual reviews, 50 written records to retain, 50 agreements to keep under regular review, and 50 sets of complaints and revenue data to assemble for the return, before counting a single certified member of the network's own staff.
The gap between confidence and evidence
The FCA reviewed how principal firms were embedding its December 2022 AR rules, surveying about 270 firms. Ninety six per cent said they were confident they had implemented the rules effectively. The findings looked different. Fewer than half of the annual reviews examined were of good quality, and 18 per cent of principals had not carried out an annual review at all. Around half were not regularly reviewing their AR agreements, and about a third were not using data or management information to check whether ARs were staying within the scope of their agreements.
Those findings concern AR oversight in general, not spreadsheets specifically. But the pattern is worth noticing. A tracker full of green cells produces confidence. It does not, by itself, produce evidence.
Cost one, the rules moved and the sheet did not
SM&CR changed this year, and a tracker built around the old rules is already out of date in several places. The FCA's policy statement PS26/6, published in April 2026, set out the first phase of reforms. From 24 April, firms should aim to provide regulatory references within four weeks rather than six, criminal record checks for Senior Manager applicants remain valid for six months rather than three, digital certificates are permitted, and recertification can be carried out as part of existing processes such as annual appraisals, with a less detailed process allowed where nothing has changed from the previous year. From 10 July, overlapping certification functions were removed, which the FCA estimates covers around 15 per cent of certification roles, and the thresholds for becoming an enhanced SM&CR firm were raised. Changes aligned with the FCA's rules on non-financial misconduct apply from 1 September 2026.
A second phase is coming. The government intends to remove the Certification Regime from legislation and let the FCA and PRA replace it with rules, and the FCA has said it expects to consult on that before the end of 2026.
None of these changes is large on its own. The cost is that a spreadsheet has no one watching for them. Someone has to read the policy statement, work out which columns, formulas and reminders it affects, and change them without breaking anything else.
Cost two, errors nobody can see
Spreadsheet research is consistent on one point. A review by Raymond Panko of intensive inspections of operational spreadsheets found errors in 94 per cent of those examined. In one experiment he reports, developers estimated their own chance of having made an error at around 10 per cent, and 86 per cent of them had. Definitions of error vary between studies, and these were not compliance trackers specifically, so treat the figures as a warning about the format rather than a measurement of yours.
The failures that matter tend to be silent. In October 2020, Public Health England lost 15,841 positive Covid test results because they were passed between systems as older Excel files with a row limit, and everything past the limit was dropped without anyone being told. The compliance equivalent is not dramatic either. It is a certification date that passed unnoticed, or an AR review that was never scheduled, because the sheet only reports what someone thought to ask it.
Cost three, the evidence is not there when it is needed
The FCA expects a written record of each AR review, kept for at least six years, and its April 2026 review of inactive ARs emphasised data led oversight and an accurate picture of the revenue ARs generate. A spreadsheet can hold a date. It struggles to show who changed that date, when, and why. Cells get overwritten, versions multiply across inboxes, and the one person who understands how the sheet works becomes a single point of failure. When a principal is asked to show how it reached a conclusion about an AR, a record that has been quietly edited is a weaker answer than one that cannot be.
Cost four, the hours nobody records
This one has to be measured by you, because no reliable published figure exists for how long networks spend on it, and any number offered without a source should be treated with suspicion. Count how many ARs, advisers and certified staff the tracker covers. Count how many recurring date driven events each person generates in a year. Then time one full review cycle, from gathering the information out of emails, the CRM and separate documents, to chasing missing items, to updating the sheet. Multiply the hours by whatever those hours cost. That is your number, and it will be more convincing than anyone else's.
When a spreadsheet is still fine
A small network with a handful of ARs, one clear owner, version history switched on and a monthly check by a second person can run a perfectly respectable tracker. The costs above scale with headcount and with the number of date driven obligations. They are modest for a small book and heavy for a large one.
What replacing it should actually do
The test is not whether a system has more features than a spreadsheet. It is whether it closes the specific gaps above. One record, not several. Reminders generated from dates, not from memory. Role based access so only the right people can change an entry. A history showing who changed what and when. Oversight tied to the actual case files, so the data the FCA expects principals to use is the data the network is looking at. And a vendor that tracks rule changes, so the update lands in the product rather than in someone's inbox.
Mortgage Magic™'s compliance monitoring and SM&CR management tools are built around that idea for networks, keeping the record, the reminders and the audit trail in the same system as the cases they relate to, rather than in a separate document that someone has to keep in step.
The real question
The question is not whether a spreadsheet can store the information. It can. The question is whether, on the day someone outside the firm asks for the record, the network can show what was reviewed, who reviewed it, when, and on what evidence, without reconstructing it first.
Comments
Post a Comment