TL;DR: The Building Safety Act doesn't just say "keep records." It requires a digital Golden Thread of building safety information — accessible, version-controlled, and audit-ready. Spreadsheets fail on every count. If you're managing a higher-risk building with Excel files and shared drives, you're not compliant, and the Building Safety Regulator has the power to act.
Read the complete Golden Thread guide ->
The Spreadsheet You Trust Is a Liability
You know the one. It started as a quick tracker — maybe for fire risk assessment actions, maybe for fire door inspections. Someone added a tab for contractor details. Another tab for resident contact information. A few macros to calculate overdue items. It's grown into the thing your entire compliance operation depends on.
Here's the problem: that spreadsheet is doing a job it was never designed for, and the Building Safety Act 2022 has made that a legal issue, not just an operational one.
Section 88 of the Building Safety Act 2022 places a duty on Accountable Persons to create, maintain, and share building safety information in a prescribed format. The Higher-Risk Buildings (Keeping and Provision of Information etc.) (England) Regulations 2024 spell out exactly what that means. And the Higher-Risk Buildings Procedures Regulations 2023 go further — requiring an "electronic facility" for storing and managing Golden Thread information with controlled access.
A spreadsheet on someone's laptop is not an electronic facility. A shared Excel file on OneDrive is not an electronic facility. Let's look at why.
Five Ways Spreadsheets Fail the Golden Thread
1. No Version Control
The Golden Thread must be accurate and up to date. When three people edit the same spreadsheet, which version is current? When someone overwrites a formula or deletes a row, there's no record of what changed, when, or why.
A building with 40 fire risk assessment actions needs a clear history: when was each action raised, who was assigned, what evidence was uploaded, and when was it signed off? In a spreadsheet, that history lives in people's memories. In a compliance notice scenario, memories don't count.
2. No Audit Trail
The BSR can request your Golden Thread information at any time. When they do, they want to see not just the current state but how you got there. Every decision, every update, every piece of evidence — linked and traceable.
Spreadsheets don't log who changed cell B47 on Tuesday. They don't record that a contractor uploaded a fire stopping certificate on 14 March. They don't prove that you reviewed and actioned your fire risk assessment within the required timeframe. A purpose-built compliance system timestamps every change with the user's identity — creating a tamper-proof chain that holds up when the BSR asks "show me how you managed this." You can say you did all these things. A spreadsheet just can't prove it.
3. No Access Control
The Regulations require that Golden Thread information is accessible to those who need it — and only to those who need it. That means controlled access, not "anyone with the link can edit."
Think about what's in your compliance spreadsheet: resident names, contact details, flat-specific vulnerability information for PEEPs. Under GDPR, that data needs protection. Under the BSA, it needs to be shareable with the BSR on request. A spreadsheet gives you neither proper protection nor structured sharing.
4. No Evidence Linking
A spreadsheet can say "Action 12: Replace fire door, Flat 4B — Complete." But where's the evidence? The contractor's completion photo is in an email. The invoice is in a shared drive. The sign-off is a text message. Nothing is linked. Nothing is findable under pressure.
The Golden Thread requires information to be stored "in a simple format that is easy to understand." A scavenger hunt across email, WhatsApp, and shared drives is not simple. In a compliant system, evidence is attached directly to the action it relates to — a contractor uploads a completion photo via a magic link, and it's automatically linked to the fire risk assessment action, timestamped, and visible in the audit trail. No chasing. No filing. When the BSR asks for evidence of how you're managing fire safety risks, it's one click away.
5. No Structured Reporting
Your Safety Case Report needs to demonstrate that you're actively managing building safety risks. That means showing what's overdue, what's in progress, and what's been completed — with evidence.
Building that picture from a spreadsheet means hours of manual work: filtering, cross-referencing tabs, chasing people for updates, hoping the data is current. And the moment you export it, it's already out of date. A compliance platform with a live dashboard — showing overdue items, in-progress work, and completed actions with evidence — generates this view in real time. Some platforms can even auto-generate Safety Case Report PDFs from live compliance data, pulling together fire risk assessment actions, checks, issues, and documents into the structured format the BSR expects.
Compare Brocade to spreadsheet tracking ->
What the Law Actually Requires
Let's be specific about what the Golden Thread demands, because "keep good records" undersells it:
Information scope — The Higher-Risk Buildings Regulations 2024 require you to maintain summaries of fire risk assessments, safety case reports, structural information, maintenance records, and resident engagement strategies. This isn't one spreadsheet tab. It's a structured information system.
Accessibility — Information must be "accessible" and "in a simple format that is easy to understand and written in plain English." This means anyone reviewing it — your co-Accountable Person, a BSR inspector, a new building manager taking over — should be able to find what they need without decoding your spreadsheet conventions.
Digital storage — The Procedures Regulations 2023 explicitly require an "electronic facility" with procedures for access. This isn't optional. Paper records and local files don't meet the standard.
Shareability — The Principal Accountable Person must be able to provide information to the BSR when requested. If your records are scattered across personal devices, you have a problem.
The Real Risk: Not Fines, But Criminal Liability
This isn't a box-ticking exercise with a small penalty for non-compliance. Under Section 99 of the Building Safety Act, failure to comply with a compliance notice is a criminal offence. If the BSR inspects your building, finds your Golden Thread information inadequate, issues a compliance notice, and you can't fix it — that's a criminal matter.
The BSR doesn't need to prove something went wrong with the building. They need to prove you weren't keeping information as required. A spreadsheet with broken formulas, missing version history, and no audit trail is evidence of exactly that.
What "Good" Looks Like
A compliant Golden Thread system doesn't need to be complicated. It needs to be:
- Structured — Information organised by type (fire risk assessment actions, checks, issues, documents) with consistent fields, not freeform spreadsheet tabs
- Linked — Every action connected to its evidence, every issue linked to its resolution, every check tied to its completion record
- Auditable — A timestamped log of every change, visible to anyone who needs it, impossible to quietly edit away
- Accessible — Controlled permissions so the right people see the right information, with the ability to share with the BSR on request
- Current — Updated in real time as work happens, not when someone remembers to update the spreadsheet
A building with 35 of 40 fire risk assessment actions complete — each with linked evidence, contractor details, and completion dates — where the remaining 5 show assigned contractors and target dates, demonstrates active management. That same information in a spreadsheet, even if accurate today, can't prove it was accurate yesterday.
How to Make the Switch
If you're currently running compliance on spreadsheets, the move to a proper system is less painful than you think:
-
Audit your current state — List every spreadsheet, shared drive folder, and email chain that holds building safety information. You'll likely find it's more scattered than you realised.
-
Map to Golden Thread categories — Match your existing data to the categories required by the 2024 Regulations: fire risk assessments, safety case information, structural details, maintenance records, resident information.
-
Choose a purpose-built platform — Generic project management tools (Trello, Asana, Monday) are better than spreadsheets but still weren't designed for building safety compliance. You need version control, audit trails, evidence linking, and BSR-ready reporting.
-
Migrate systematically — Start with the highest-risk area (usually fire risk assessment actions), import existing data, and build the habit of recording in the new system. Don't try to move everything at once.
-
Close the spreadsheet — The hardest step. As long as the spreadsheet exists alongside the new system, people will default to what's familiar. Set a cutover date and stick to it.
Questions
Do spreadsheets meet Golden Thread requirements under the Building Safety Act?
No. The Building Safety Act 2022 and the Higher-Risk Buildings (Keeping and Provision of Information etc.) (England) Regulations 2024 require an electronic facility that maintains accessible, up-to-date building safety information with controlled access. Spreadsheets lack version control, audit trails, and access management, so they do not satisfy these requirements.
What does the Golden Thread require in practice?
The Golden Thread requires you to create and maintain accurate, up-to-date building safety information throughout the building's lifecycle. This includes fire risk assessments, safety case reports, structural information, and maintenance records. Information must be stored digitally, kept in plain English, and be accessible to those who need it.
What is an electronic facility for Golden Thread information?
An electronic facility is a digital system for storing and managing Golden Thread information, as required by the Higher-Risk Buildings Procedures Regulations 2023. It must support controlled access, version management, and the ability to share information with the Building Safety Regulator on request.
Can I be penalised for keeping building safety records in spreadsheets?
If the Building Safety Regulator determines that your record-keeping does not meet the requirements of Section 88 of the Building Safety Act, they can issue a compliance notice. Failure to comply with a compliance notice is a criminal offence under Section 99 of the Act.
How do I move from spreadsheets to a compliant digital system?
Start by auditing what information you currently hold and where the gaps are. Then choose a purpose-built compliance platform that meets Golden Thread requirements — including version control, access management, and audit trails. Migrate your existing records, verify completeness, and establish processes for keeping information current.
Further Reading
- Golden Thread Building Safety: The Complete Guide
- BSA Compliance Checklist
- Fire Risk Assessment Tracking: What Every Building Manager Must Document
- PEEPs Deadline April 2026: 5 Steps to Get Ready Now
This article is for informational purposes. For building-specific advice, consult a qualified fire safety professional.
Book a demo to see how Brocade handles Golden Thread compliance ->