Why Small Internal Audit Teams Still Cling to Excel—and Why That Needs to Change

Peter Armstrong
May 7
3 min read

For small internal audit departments, Excel has become more than just a tool—it’s a way of life. Need to document a control test? Fire up a spreadsheet. Track audit findings? Spreadsheet. Manage walkthroughs, risk assessments, or deficiencies? You guessed it: spreadsheet.

Despite a flood of modern GRC tools entering the market promising automation, consistency, and visibility, many small audit teams continue to rely on manual Excel-based processes.

Not because they don’t see the value in a GRC system—but because change feels riskier, harder, and more expensive than the status quo.

So, what’s behind the hesitation?

1. Limited Bandwidth

Let’s start with the obvious: small teams are stretched thin. Many operate with a handful of auditors covering SOX, operational audits, risk assessments, compliance requests, and reporting to the board. There's little time left to explore new systems, let alone implement one.

Change management takes time. It takes training. It takes convincing leadership. For an internal audit function already operating in survival mode, even the thought of diverting attention to evaluate and adopt a GRC tool can feel overwhelming.

The result? A quiet but powerful apathy: “We’re too busy to improve the way we work.”

2. A Legacy of “Making It Work”

Audit professionals are problem-solvers by nature. When resources are limited, they build workarounds. And over the years, many small teams have developed intricate Excel-based processes that technically get the job done. They're duct-taped systems, but they’re familiar—and familiarity is comforting.

There’s also pride involved. Many auditors have spent years refining templates, building macros, or perfecting spreadsheets that feel like home. They’ve “made it work” this long—so why fix what’s not broken?

But the truth is, it is broken. Or at the very least, fragile, inefficient, and prone to error.

3. Perceived Complexity of GRC Tools

For years, GRC tools have had a reputation: powerful, but complex and clunky. Built for enterprise-level operations with armies of users and IT support. These legacy platforms often came with long implementation timelines, steep learning curves, and high costs—not to mention surprise fees for every extra module or user.

Small audit shops took one look at those solutions and said, “Not in this lifetime”

Unfortunately, this perception stuck—even as newer, leaner solutions entered the market. The result? A mental association between GRC tools and unnecessary complexity keeps smaller teams on the sidelines.

4. Budget Constraints

Let’s be honest: GRC tools haven’t always been budget-friendly. And in smaller organizations, internal audit isn’t typically viewed as a revenue-generating function. Asking leadership for software funding is often met with questions like, “Can’t you just keep using Excel?”

Even when the ROI is qualitative—reduced risk, better visibility, improved documentation—it’s hard to justify the cost when the department’s budget is tight.

Breaking the Cycle with the Right Fit

The good news? The landscape is changing.

Modern GRC tools—like daitaGRC—are being designed specifically for small and mid-sized internal audit teams. Tools that don’t require weeks of onboarding. That don’t break the budget.

These platforms deliver the benefits of traditional GRC—automation, visibility, standardization—without the pain. Built-in AI helps speed up documentation and testing. Simple setup and training make adoption fast. And pricing is minimal with smaller teams in mind.

What’s missing now isn’t functionality. It’s a mindset shift.