The Hidden Costs of Spreadsheet-Based Due Diligence

For decades, spreadsheets have been the default tool for operational due diligence. But as allocator portfolios grow in complexity and regulators raise their expectations, the quiet costs of this approach are becoming impossible to ignore.

The Spreadsheet Illusion

At first glance, spreadsheets appear to offer everything an operational due diligence (ODD) team needs: flexibility, familiarity, and zero incremental cost. They can be customised overnight, shared by email, and tailored to any manager type or asset class. For a small team running a handful of annual reviews, the logic is hard to argue with.

But this perception is an illusion, and an expensive one. The real costs of spreadsheet-based ODD are rarely captured on a budget line. They accumulate silently, embedded in analyst hours, missed signals, inconsistent judgements, and the institutional liability that follows a preventable operational failure.

As ODD programmes scale, whether by number of managers, asset classes, or regulatory jurisdictions, the hidden costs compound. Below, we examine each in turn.

1. The Time Tax: Labour That Doesn’t Scale

The most immediate and measurable hidden cost is time. A typical spreadsheet-based ODD review involves a significant volume of manual activity: copying data from manager questionnaires, reformatting responses, cross-referencing prior-year assessments, and consolidating findings across multiple tabs and files.

Studies of financial services firms consistently show that knowledge workers spend between 30 and 40 percent of their time on tasks that are essentially administrative, gathering, cleaning, and reorganising information rather than analysing it. In ODD, this proportion can be even higher, particularly when questionnaire responses arrive in inconsistent formats from different managers.

The result is that highly skilled, and expensively employed, professionals spend a disproportionate share of their time on data entry rather than judgement. At a firm running 50 to 100 annual ODD reviews, the cumulative time cost of this inefficiency can amount to hundreds of analyst hours per year.

Equally important is what gets crowded out. When analysts are consumed by administrative work, the quality of substantive review suffers. Deep-dive investigations, qualitative assessment of culture and governance, and proactive monitoring of emerging risks all require the cognitive bandwidth that manual data handling steadily erodes.

2. Inconsistency: The Enemy of Comparability

A core function of operational due diligence is comparison: How does Manager A’s custody arrangement compare to Manager B’s? How has Manager C’s cybersecurity posture evolved over three years? Does a particular operational red flag appear across multiple managers in the same sub-sector?

Spreadsheet-based approaches make this kind of analysis structurally difficult. Without a common data model enforced across all reviews, each analyst will inevitably develop their own shorthand, their own approach to weighting concerns, and their own interpretation of ambiguous responses. Over time, and especially as team membership changes, the resulting body of assessments becomes heterogeneous in ways that make reliable comparison impossible.

This inconsistency is not a reflection of analyst quality. It is a structural property of unstructured tools applied to structured problems. The solution is not better analysts; it is better infrastructure.

The downstream effect is a reduction in portfolio-level insight. An ODD programme that cannot reliably answer “which of our managers present the most significant operational concentration risk” is not fully serving its purpose, regardless of the quality of individual manager assessments.

3. Monitoring Gaps and the Risk of Stale Data

Operational due diligence is not a point-in-time exercise. Managers change their prime brokers, key personnel depart, regulatory sanctions are issued, and counterparty exposures evolve, all between scheduled review cycles. A robust ODD programme requires ongoing monitoring, not just periodic assessment.

Spreadsheets are inherently static. They capture a snapshot in time and provide no mechanism for proactive alerts, automated data refresh, or systematic tracking of change events. Unless an analyst actively checks and updates each file, a process that is both time-consuming and error-prone at scale, assessments become stale almost immediately.

The risk this creates is acute. Many of the most significant operational failures in the asset management industry have been preceded by identifiable warning signals. Signals that were either missed or not acted upon in time. A monitoring capability that depends on manual vigilance will, over a sufficiently large portfolio and a sufficiently long-time horizon, miss some of those signals. The question is not whether this will happen, but when.

4. Regulatory and Reputational Exposure

Regulatory expectations around ODD have risen substantially in recent years. Institutional investors, particularly those subject to AIFMD, MiFID II, or ERISA obligations, are increasingly expected to demonstrate not just that they conducted due diligence, but that their processes are systematic, documented, and consistently applied.

Spreadsheet-based processes struggle to meet this bar. The very flexibility that makes them attractive, the ease with which they can be customised, modified, and adapted, also makes it difficult to demonstrate to a regulator or auditor that a standardised methodology was followed. When a fund experiences an operational failure and the allocator’s due diligence process comes under scrutiny, a folder of inconsistently formatted spreadsheets is not a compelling exhibit.

Beyond regulatory exposure, there is reputational risk. Limited partners, pension funds, sovereign wealth funds, endowments, are increasingly sophisticated in their assessment of their managers’ own operational capabilities. An ODD programme that cannot demonstrate structured, auditable processes may not pass the scrutiny of the allocator’s own investors.

5. The Cost of Key-Person Dependency

Spreadsheet-based ODD programmes are frequently built around individuals. Over time, a senior analyst becomes the de facto custodian of the template, the institutional memory of how scores are assigned, and the person who knows where to find the relevant files. When that individual takes a new role, the programme’s institutional knowledge walks out with them.

This key-person dependency is both an operational risk in itself and a constraint on the programme’s ability to grow. Onboarding new team members into a spreadsheet-based process is slow; quality control is informal; and the tacit knowledge that determines what “good” looks like is hard to codify and transfer.

Technology platforms resolve this by externalising institutional knowledge into structured workflows, standardised scoring criteria, and documented rationale. The methodology belongs to the organisation, not to any individual within it.

6. The AI Problem: Garbage In, Garbage Out

There is a newer and increasingly urgent dimension to the spreadsheet problem, one that was not on most ODD teams’ radar five years ago: artificial intelligence.

Across the financial services industry, firms are investing heavily in AI-powered tools, large language models, agentic workflows, automated risk scoring, to augment or accelerate decision-making. ODD is no exception. The promise is real: AI can surface patterns across large datasets, flag anomalies that a human reviewer might miss, and synthesise qualitative information at a speed no analyst can match.

But AI systems are only as good as the data they consume. Feed a model clean, structured, consistently formatted data and it will perform well. Feed it a collection of manually maintained spreadsheets, inconsistently labelled, riddled with legacy workarounds, version-controlled by filename convention, and the outputs will reflect those flaws, often invisibly.

This is the data quality problem that AI makes newly urgent. In a manual process, a human analyst will often catch an inconsistency or override an obvious error through contextual understanding. An AI agent will not, or at least, cannot be relied upon to do so. It will process what it receives. If a risk score was entered in the wrong cell three years ago, or a manager’s counterparty exposure was classified differently by two different analysts, the model will treat those inputs as ground truth.

The consequences can be subtle but serious. An AI-assisted red flag system that generates false confidence because its training data was inconsistent is arguably worse than no system at all, it creates the appearance of rigour without its substance. An agentic workflow that automates parts of the ODD review process will systematically reproduce whatever biases and gaps existed in the data it was built on.

Organisations that are serious about deploying AI in their ODD processes, now or in the future, need to reckon with this dependency honestly. AI readiness is not primarily a technology question; it is a data infrastructure question. And for many firms, the honest answer is that their current data infrastructure, built on spreadsheets and manual inputs, is not AI-ready.

Investing in structured, platform-managed ODD data is therefore not merely about improving today’s workflow. It is about building the foundation that tomorrow’s AI-assisted capabilities will require. The firms that delay that investment are not just accepting the operational costs described in this article, they are closing off a strategic capability that their competitors are already beginning to build.

What Good Looks Like

The answer to these challenges is not to abandon the analytical rigour that characterises the best ODD teams. It is to provide that rigour with the infrastructure it deserves. A modern ODD technology platform should offer:

• Structured, standardised data capture that enforces consistency across managers and review cycles without constraining analyst judgement.
• A full audit trail, every response, every rating change, every sign-off, timestamped and attributable.
• Portfolio-level analytics that surface cross-manager trends, concentration risks, and emerging concerns before they become crises.
• Automated monitoring workflows that flag relevant change events between scheduled reviews.
• Role-based access controls, version management, and the documentation standards required for regulatory defensibility.
• Integration with existing investment workflows, avoiding the data silos that fragment decision-making.

None of these capabilities replaces the expert judgement that experienced ODD professionals bring to their work. What they do is free that judgement from administrative overhead and give it the data infrastructure it needs to operate effectively at scale.

The True Cost Comparison

When organisations evaluate ODD technology, they typically compare the cost of a platform against the cost of maintaining their existing spreadsheet process. This comparison almost always understates the true cost differential, because the costs of spreadsheet-based ODD are diffuse and largely invisible.

Add up the analyst hours absorbed by administrative tasks. Factor in the cost of a regulatory investigation triggered by inadequate documentation. Consider the reputational consequence of missing an operational warning signal that a monitoring tool would have surfaced. Account for the delay and disruption when a key-person leaves and their institutional knowledge leaves with them.

When these costs are made explicit, the economics of ODD technology become compelling. The question is not whether organisations can afford to invest in better infrastructure. It is whether they can afford not to.