Brocade
TL;DR: The Building Safety Act doesn't just say "keep records." It requires a digital Golden Thread of building safety information — accessible, version-controlled, and audit-ready. Spreadsheets fail on every count. If you're managing a higher-risk building with Excel files and shared drives, you're not compliant, and the Building Safety Regulator has the power to act.
Read the complete Golden Thread guide ->
The Spreadsheet You Trust Is a Liability
You know the one. It started as a quick tracker — maybe for fire risk assessment actions, maybe for fire door inspections. Someone added a tab for contractor details. Another tab for resident contact information. A few macros to calculate overdue items. It's grown into the thing your entire compliance operation depends on.
An accountable person for a higher-risk building must— (a) keep prescribed information in accordance with prescribed standards, and (b) so far as possible keep such information up to date.
(Building Safety Act 2022, s.88(1))
Here's the problem: that spreadsheet is doing a job it was never designed for, and the Building Safety Act 2022 has made that a legal issue, not just an operational one.
Section 88 of the Building Safety Act 2022 places a duty on Accountable Persons to keep prescribed information to prescribed standards, and section 89 governs providing it. The Higher-Risk Buildings (Keeping and Provision of Information etc.) (England) Regulations 2024 spell out what information you must keep. Regulation 7 of the Higher-Risk Buildings (Management of Safety Risks etc) (England) Regulations 2023 sets the standards: the information must be kept in an electronic format, be accurate, be secure from unauthorised access, and only be changed under procedures that record who made the change and when.
A spreadsheet on someone's laptop, or a shared Excel file on OneDrive, struggles to meet those standards. Let's look at why.
Five Ways Spreadsheets Fail the Golden Thread
1. No Version Control
The standards prescribed for the keeping of information under section 88(1) of the 2022 Act are that the information— (a) is kept in an electronic format which ensures it is capable of being transferred electronically to other persons without the data in it being lost or corrupted; (b) is accurate; (c) is intelligible to the intended readers of the data, and any key needed to understand the data is provided with the data; (d) is kept in such a manner as to be accessible as soon as reasonably practicable in response to a request from any person specified in section 89(1) of the 2022 Act or prescribed by regulations made under that subsection; (e) is secure from unauthorised access; and (f) is only changed in accordance with procedures which record the person who made the change and the date of that change.
(Higher-Risk Buildings (Management of Safety Risks etc) (England) Regulations 2023, reg 7(1))
The Golden Thread must be accurate and up to date. When three people edit the same spreadsheet, which version is current? When someone overwrites a formula or deletes a row, there's no record of what changed, when, or why.
A building with 40 fire risk assessment actions needs a clear history: when was each action raised, who was assigned, what evidence was uploaded, and when was it signed off? In a spreadsheet, that history lives in people's memories. In a compliance notice scenario, memories don't count.
2. No Audit Trail
The BSR can request your Golden Thread information at any time. When they do, they want to see not just the current state but how you got there. Every decision, every update, every piece of evidence — linked and traceable.
Spreadsheets don't log who changed cell B47 on Tuesday. They don't record that a contractor uploaded a fire stopping certificate on 14 March. They don't prove that you reviewed and actioned your fire risk assessment within the required timeframe. A purpose-built compliance system timestamps every change with the user's identity — creating a tamper-proof chain that holds up when the BSR asks "show me how you managed this." You can say you did all these things. A spreadsheet just can't prove it.
3. No Access Control
The Regulations require that Golden Thread information is accessible to those who need it — and only to those who need it. That means controlled access, not "anyone with the link can edit."
Think about what's in your compliance spreadsheet: resident names, contact details, flat-specific vulnerability information for PEEPs. Under GDPR, that data needs protection. Under the BSA, it needs to be shareable with the BSR on request. A spreadsheet gives you neither proper protection nor structured sharing.
4. No Evidence Linking
A spreadsheet can say "Action 12: Replace fire door, Flat 4B — Complete." But where's the evidence? The contractor's completion photo is in an email. The invoice is in a shared drive. The sign-off is a text message. Nothing is linked. Nothing is findable under pressure.
The Golden Thread requires information to be stored "in a simple format that is easy to understand." A scavenger hunt across email, WhatsApp, and shared drives is not simple. In a compliant system, evidence is attached directly to the action it relates to — a contractor uploads a completion photo via a magic link, and it's automatically linked to the fire risk assessment action, timestamped, and visible in the audit trail. No chasing. No filing. When the BSR asks for evidence of how you're managing fire safety risks, it's one click away.
5. No Structured Reporting
Your Safety Case Report needs to demonstrate that you're actively managing building safety risks. That means showing what's overdue, what's in progress, and what's been completed — with evidence.
Building that picture from a spreadsheet means hours of manual work: filtering, cross-referencing tabs, chasing people for updates, hoping the data is current. And the moment you export it, it's already out of date. A compliance platform with a live dashboard — showing overdue items, in-progress work, and completed actions with evidence — generates this view in real time. Some platforms can even auto-generate Safety Case Report PDFs from live compliance data, pulling together fire risk assessment actions, checks, issues, and documents into the structured format the BSR expects.
Compare Brocade to spreadsheet tracking ->
What the Law Actually Requires
Let's be specific about what the Golden Thread demands, because "keep good records" undersells it:
Information scope — The Higher-Risk Buildings Regulations 2024 require you to maintain summaries of fire risk assessments, safety case reports, structural information, maintenance records, and resident engagement strategies. This isn't one spreadsheet tab. It's a structured information system.
Accessibility — Information must be "accessible" and "in a simple format that is easy to understand and written in plain English." This means anyone reviewing it — your co-Accountable Person, a BSR inspector, a new building manager taking over — should be able to find what they need without decoding your spreadsheet conventions.
Digital storage: regulation 7 of the Management of Safety Risks Regulations 2023 requires golden thread information to be kept in an electronic format and secure from unauthorised access. This isn't optional. Paper records alone don't meet the standard.
Shareability — The Principal Accountable Person must be able to provide information to the BSR when requested. If your records are scattered across personal devices, you have a problem.
The Real Risk: Not Fines, But Criminal Liability
This isn't a box-ticking exercise with a small penalty for non-compliance. Under Section 99 of the Building Safety Act, failure to comply with a compliance notice is a criminal offence. If the BSR inspects your building, finds your Golden Thread information inadequate, issues a compliance notice, and you can't fix it — that's a criminal matter.
A person who, without reasonable excuse, contravenes a compliance notice commits an offence.
(Building Safety Act 2022, s.99(5))
The BSR doesn't need to prove something went wrong with the building. The offence is failing, without reasonable excuse, to do what the compliance notice requires. A spreadsheet with broken formulas, missing version history, and no audit trail is the kind of record that leads to a notice in the first place.
What "Good" Looks Like
A compliant Golden Thread system doesn't need to be complicated. It needs to be:
- Structured — Information organised by type (fire risk assessment actions, checks, issues, documents) with consistent fields, not freeform spreadsheet tabs
- Linked — Every action connected to its evidence, every issue linked to its resolution, every check tied to its completion record
- Auditable — A timestamped log of every change, visible to anyone who needs it, impossible to quietly edit away
- Accessible — Controlled permissions so the right people see the right information, with the ability to share with the BSR on request
- Current — Updated in real time as work happens, not when someone remembers to update the spreadsheet
A building with 35 of 40 fire risk assessment actions complete — each with linked evidence, contractor details, and completion dates — where the remaining 5 show assigned contractors and target dates, demonstrates active management. That same information in a spreadsheet, even if accurate today, can't prove it was accurate yesterday.
How to Make the Switch
If you're currently running compliance on spreadsheets, the move to a proper system is less painful than you think:
-
Audit your current state — List every spreadsheet, shared drive folder, and email chain that holds building safety information. You'll likely find it's more scattered than you realised.
-
Map to Golden Thread categories — Match your existing data to the categories required by the 2024 Regulations: fire risk assessments, safety case information, structural details, maintenance records, resident information.
-
Choose a purpose-built platform — Generic project management tools (Trello, Asana, Monday) are better than spreadsheets but still weren't designed for building safety compliance. You need version control, audit trails, evidence linking, and BSR-ready reporting.
-
Migrate systematically — Start with the highest-risk area (usually fire risk assessment actions), import existing data, and build the habit of recording in the new system. Don't try to move everything at once.
-
Close the spreadsheet — The hardest step. As long as the spreadsheet exists alongside the new system, people will default to what's familiar. Set a cutover date and stick to it.
Frequently Asked Questions
Do spreadsheets meet Golden Thread requirements under the Building Safety Act?
No. Section 88 of the Building Safety Act 2022 and regulation 7 of the Higher-Risk Buildings (Management of Safety Risks etc) (England) Regulations 2023 require golden thread information to be kept up to date, in an electronic format, secure from unauthorised access, and changed only under procedures that record who made each change and when. Spreadsheets lack version control, audit trails, and access management, so they do not satisfy these requirements.
What does the Golden Thread require in practice?
The Golden Thread requires you to create and maintain accurate, up-to-date building safety information throughout the building's lifecycle. This includes fire risk assessments, safety case reports, structural information, and maintenance records. Information must be stored digitally, kept in plain English, and be accessible to those who need it.
What is an electronic facility for Golden Thread information?
"Electronic facility" is the term regulation 31 of the Building (Higher-Risk Buildings Procedures) (England) Regulations 2023 uses for the system a client must keep to hold the golden thread information during building work, including work to an existing higher-risk building. For an occupied building, the standards are in regulation 7 of the Higher-Risk Buildings (Management of Safety Risks etc) (England) Regulations 2023: an electronic format that can be transferred without data loss, accurate and intelligible, promptly accessible to people entitled to request it, secure from unauthorised access, and only changed under procedures that record who made the change and when.
Can I be penalised for keeping building safety records in spreadsheets?
If the Building Safety Regulator determines that your record-keeping does not meet the requirements of Section 88 of the Building Safety Act, they can issue a compliance notice. Failure to comply with a compliance notice is a criminal offence under Section 99 of the Act.
How do I move from spreadsheets to a compliant digital system?
Start by auditing what information you currently hold and where the gaps are. Then choose a purpose-built compliance platform that meets Golden Thread requirements — including version control, access management, and audit trails. Migrate your existing records, verify completeness, and establish processes for keeping information current.
Further Reading
- Golden Thread in Practice: Building a Digital Audit Trail -- what a compliant audit trail looks like in practice
- Golden Thread Building Safety: The Complete Guide
- BSA Compliance Checklist
- Fire Risk Assessment Tracking: What Every Building Manager Must Document
- PEEPs Deadline April 2026: 5 Steps to Get Ready Now
- Higher-Risk Buildings: Definition and Criteria -- check whether your building falls under the BSA regime
- Resident Engagement Strategy -- meeting your BSA resident engagement obligations
- Safety Case Report Guide -- preparing your Safety Case Report for BSR submission
- Brocade vs BlockPro -- how Brocade compares to spreadsheet-based alternatives
- Building Safety Act Software -- purpose-built compliance software for higher-risk buildings
- Service Charge Software UK -- automated leaseholder demands, resident portal, and Section 20 tracking in one system
This article is for informational purposes. For building-specific advice, consult a qualified fire safety professional.
Book a demo to see how Brocade handles Golden Thread compliance ->