Modern Excel and Google Sheets let several people work in the same shared spreadsheet at once, with version history and sharing roles built in. So "spreadsheets can't collaborate" is not the reason to move a process off one. The real question is narrower: standard workbook sharing and cell protection, on their own, do not give you record-level confidentiality, an approval step that cannot be skipped, or a tamper-evident audit trail. You can add some of that with permissions, scripts, add-ons or an external workflow tool — so the first job is to look at the controls you already have.
This guide helps a Hong Kong SME decide when a shared spreadsheet should become a proper workflow: what spreadsheets genuinely do well now, what they do not do on their own, a checklist to tighten the sheet first, a discussion heuristic, and a worked example. It is an operational guide, not a product recommendation.
What shared spreadsheets already do well
It is worth being precise here, because the decision goes wrong when people over- or under-state the tool.
- Co-authoring. With a supported version of Excel and the file stored in the right cloud location, several people edit at the same time and the workbook keeps a version history, as set out in Microsoft's guide to co-authoring Excel workbooks.
- Sharing roles. Google's documentation on sharing files from Drive describes viewer, commenter and editor access, plus controls over copying, downloading and re-sharing.
- Change history. Both tools record who changed what and when, at the file level.
Collaboration and history, then, are not the gap. A spreadsheet in the cloud is a perfectly reasonable place for a small shared list.
What a shared spreadsheet does not give you on its own
- Confidentiality at the row level. Sheet and range protection in Excel and Sheets restrict who can edit designated cells; they are not confidentiality barriers. Microsoft's page on protecting a worksheet says worksheet protection is not a security feature. Google's documentation on protecting a range says range protection is not a security measure and does not hide those cells from anyone who can open the file. File-level sharing settings are separate: they can limit who opens the file and, for viewers, restrict download, copy and print — but an editor can generally still copy or export what they can see.
- An approval step that holds. In a plain shared sheet, a row can be marked "approved" or "done" by anyone with edit access, or changed back later. An approval that only the right role can give, recorded and locked, has to be built and configured — a spreadsheet does not do it by default, and neither does simply putting a portal in front of the data.
- A reliable audit trail. File version history shows changes, but a tamper-evident, per-record log tied to who approved what is a capability you have to build, configure and test.
- Structured relationships. One flat list is fine. Linked data — customers to orders to deliveries to invoices — gets fragile in a spreadsheet, and people paper over it with copy-paste.
- Heavy concurrent editing. Co-authoring limits depend on your Excel version and on which features the file uses; some features and file states interrupt it. Whether a particular file slows down is something to test with your real file and team — editor count on its own is not a threshold for replacing it.
Fix the process first
Some "we need a system" problems are really "we have several copies of the file". Before deciding to rebuild, it is worth spending a week on this:
- One master file, shared by link — not copies emailed around.
- Use the right shared file location. For Excel co-authoring, use OneDrive or SharePoint and enable AutoSave in a supported version. For Google Sheets, use the native shared sheet in Google Drive, which saves edits automatically.
- Convert the range to a Table and add data validation (dropdowns, date formats) on the columns that matter.
- Give each person an area or set of columns they own — this is Microsoft's own co-authoring advice for avoiding conflicts.
- Add a dated change-log tab (who, what, when) — a manual record, only as trustworthy as the sheet's permissions allow, and not a substitute for a required audit trail.
- Lock formula and reference cells with sheet protection, accepting that this restricts who edits those cells, not who can see the data.
- A weekly 10-minute reconcile against whatever is the real source of truth.
If that fixes it, you have saved yourself a project.
A discussion heuristic: is your spreadsheet under strain?
This is an original, illustrative prompt for a conversation — not a validated benchmark and not an automatic decision to buy or build anything. Score each row 0, 1 or 2.
On a phone, scroll sideways to see the full table.
| Question | 0 | 1 | 2 |
|---|---|---|---|
| People editing it in a normal week | 1 | 2–3 | 4 or more |
| "Locked for editing" or conflict messages | Never | Sometimes | Most weeks |
| Can you reconstruct who changed a value last month, and why? | Yes, easily | With effort | No |
| Where an approval is needed, can it be skipped? | Not needed, or enforced | Manual checks only | No effective control |
| Can everyone edit everyone else's rows? | No | Partly | Yes |
| Do outside parties (clients, suppliers, field staff) need scoped access? | No | Maybe soon | Yes, now |
Read the total as a rough temperature, not a verdict:
- Lower total: look first at hardening the existing workbook.
- Higher total: investigate the specific controls that are missing, and compare the smallest fix that closes each gap against a rebuild.
- A confidentiality gap, or a genuine gap where a required approval can be skipped, outweighs the total — a low score never makes those acceptable. Four editors on their own is not a failure.
Worked example: a job sheet under strain
Illustrative example — 示範例子（非真實客戶資料）. The staff numbers and row counts below are invented for the example; they are not technical limits.
"Jobs 2026.xlsx" is used by 6 office staff and 4 field staff, at roughly 400 rows a month. Over the last month: a "locked for editing" message three or four times a week; two quotes overwritten and lost; one job marked "invoiced" that had not been; and no way to see who changed a price. Field staff are supposed to see only their assigned jobs, yet the shared file exposes every customer’s job details to them.
Run through the heuristic: editors 4 or more (2); conflict messages most weeks (2); reconstruct changes — no (2); an approval is needed here to mark a job "invoiced" and there is no enforced step (2); everyone edits everything (2); field staff need scoped access (2). Total 12. The arithmetic is right, but the total is not what makes the case — it does not prove anything about Excel's capacity.
What makes the case is the observed failures: a job was marked "invoiced" with no approval, quotes were lost with no way to see who changed them, and field staff can view customer job details outside their assignments and have full edit access they do not need. Those are a required-approval gap and a confidentiality gap.
A sensible path: remove inappropriate broad access immediately and provide field staff only the job information they are authorised to see. Then improve the remaining office workbook with column owners, validation and a change-log tab; in parallel, scope a small jobs workflow with a status that only the right role can advance, a per-job history, and field-staff access limited to their own jobs; keep Excel for the month-end revenue view. A project could build that workflow over the same data you already hold — an option, not something already running for you.
For related reading, see tasks worth automating in a small business and where a tool like ChatGPT helps and where a built workflow is the right call. If you have a spreadsheet that is starting to creak, send us how it is used today and we will tell you honestly whether to harden it or move it.
FAQ
Can several people edit one Excel file at the same time? Yes. With a supported version of Excel and the file in OneDrive or SharePoint, co-authoring works and keeps a version history, per Microsoft's co-authoring guide.
Is password-protecting the sheet enough to control who sees what? No. Microsoft and Google both describe sheet and range protection as controls over who can edit specified cells, not as security or confidentiality features. Someone who can open the file can still read what is in it. File-level sharing settings — which can limit download and copy for viewers — are a separate control.
Do we have to buy a big system? Usually not first. Tighten the spreadsheet, move only the part that needs enforced rules, and keep Excel for analysis and reporting.
How do we get a proper audit trail in the meantime? A dated change-log tab is a temporary operational record, only as reliable as the permissions around it. Locked reference cells help protect routine editing, but these measures are insufficient where trustworthy approval or audit evidence is required. A per-record audit tied to approvals is something a workflow has to be built and tested to provide; it is not automatic.