Assurance tests the record, not the tool, so a spreadsheet survives wherever it carries an audit trail, controlled access, reproducible calculations and evidence attached to every figure. Most spreadsheets carry none of these by default. A platform supplies them as a property of the system. The deciding variable is the cost of changing a number late.
The question is usually framed as a purchasing decision. An assurance provider does not assess software. It samples figures and asks who entered each one, from which source, under which calculation, and whether the number can be reproduced today. Both options can pass that test. Only one passes it by default.
The five tests that decide it
| Test | Spreadsheet, as usually kept | Platform, as usually configured |
|---|---|---|
| Audit trail | Versions are file copies; who changed a cell, and when, is rarely recorded | Every edit is stamped with user, time and prior value |
| Access control | Permission is granted to the whole file | Permission is granted per site, per metric, per role |
| Recalculation | Factors are buried in formulas, so restating a year means rebuilding the sheet | Factors are versioned data, so a restatement reruns against a dated set |
| Evidence | Invoices sit in a parallel folder tree, joined by naming convention | Documents attach to the figure they support |
| Cost of change | A late correction propagates by hand into every dependent sheet | One correction reruns every dependent figure, and the rerun is itself logged |
Cost of change is the test most often underestimated. Sustainability figures move late, because a supplier restates a factor or a meter reading is corrected after the boundary is fixed. In a workbook, a late correction becomes a manual sweep through every dependent sheet, and the sweep is itself unevidenced.
Making a spreadsheet assurable
A spreadsheet clears assurance when five conditions hold together:
1. Ownership of every input cell is recorded outside the file, so an assurance sample can reach the person who entered it. 2. Access is restricted by role, so entry, review and sign off sit in separate hands rather than behind one shared file password. 3. Emission factors sit in one dated reference table rather than inside formulas. 4. Source documents are indexed to the exact figure they support, not to the folder that holds it. 5. The workbook is locked once the figures are signed off, and any restatement opens a new version instead of editing the signed one.
Those five conditions are a control environment built by hand. One site in a first reporting cycle can sustain it. Multiple entities, value chain data and a second year of comparatives usually cannot, and the failure surfaces as sampling exceptions rather than as a missing file. GreenSutra structures the evidence and readies the data file in either environment. The independent accredited provider forms the opinion.
Sources: IAASB, International Standard on Sustainability Assurance 5000, SEBI, BRSR Core assurance circular
The ESG guide sets out the record keeping a reporting cycle needs before assurance begins. ESG solutions covers data architecture, control design and evidence readiness for a workbook or a platform.