A spreadsheet works for TISAX when you have one site, one scope and one assessment objective. It strains when you add sites, when evidence ages between the self assessment and the audit, or when the three year label comes up for renewal. Automate evidence collection and reminders, and keep scope decisions with people.
What does the process give you to work with?
Per the ENX page we fetched on 18 October 2026, you register as a participant, define at least one scope, pick an approved audit provider, complete a self assessment on the VDA ISA catalogue, undergo an external audit and share results through the ENX portal. Labels last three years, and the catalogue has a newer ISA2027 release. We could not see the catalogue text itself, so confirm its format and scale with your provider.
A workable layout
Scope tab. One row per scope: sites, processes, systems, assessment objective, protection level and the customer who requires it. Many suppliers end up with several scopes over time, and each needs its own row and renewal date.
Controls tab. One row per catalogue question: reference, requirement summary, your answer, your self rating, owner, policy link, evidence link, evidence date, gap and action. Freeze the header row and use data validation for ratings so the filters work.
Evidence tab. An index of files with their source system, date generated and who generated them. The audit depends on records that are current.
Actions tab. Every gap with owner, due date and status, linked back to the controls row.
Renewal tab. Label expiry date per scope, with reminders at twelve, nine and six months. Three years is long enough for a team to forget.
Where does it hold up?
For a single site and a modest number of questions, the sheet is fine and cheap. It forces owners to write answers in plain language, which is what the provider will read first. Sorting by gap and owner gives a clear weekly meeting agenda.
Where does it break?
Version drift. Two people fix the same row in separate copies. Use one shared file with edit history, and never email copies.
Evidence age. A screenshot from the self assessment month may be stale by audit day. Provider and customers care about current records, so a date column that turns red after your chosen number of days is worth building.
Multiple sites and scopes. Each site repeats most of the rows with different owners and evidence. The workbook becomes several workbooks, and consistency suffers.
Cross framework overlap. Customers may also ask for other frameworks. Without a mapping, you answer the same question many times.
When to automate
Move when you have more than one scope, when you re collect the same technical evidence every quarter, when the audit provider finds stale evidence, or when renewal is less than a year away and the sheet needs a full rewrite. Automate the mechanical work: evidence pulls, change detection, reminders and cross framework mapping. Keep decisions about scope, ratings and risk acceptance with named people.
Mistakes to avoid
- Rating yourself by hope. The audit provider checks.
- Evidence with no date.
- Keeping the scope in one person's head.
- Forgetting the renewal until the label is close to ending.
What to do
- Write the scope rows and confirm objectives with each customer.
- Build the controls tab from the catalogue version your provider confirms.
- Fill answers in plain language and link a policy and a record for each.
- Add an evidence date column and a stale flag.
- Run a weekly gap meeting from the actions tab.
- Add the renewal tab with reminders at twelve, nine and six months.
- Decide the trigger for automating, such as a second site.
Quick check
Can the ISA catalogue itself be our tracking sheet?
You can use the catalogue as a base and add your own columns, provided your provider accepts the format. Ask them first.
How often should evidence be refreshed?
The page does not set a number. Ask your audit provider what age of records they accept and set your stale flag to that.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so the repeating evidence in the controls tab can come from connected systems and code instead of screenshots, and monitoring between audits keeps it fresh. Framework mapping reduces repeat answers when customers ask for more than one standard. Technical evidence from scans and SBOMs reflects your real software. Safeguard helps prepare and keep evidence ready, and the independent audit provider decides on the label. See the framework mapping demo.
Sources
- ENX Association, TISAX, fetched 18 October 2026.
Last reviewed: 18 October 2026.
