For this edition of Call in for a Coffee we take a closer look at validating spreadsheets using GAMP5 as a basis to address the increased awareness of manufactures in the region;

Why and where are they used?
Many companies use spreadsheets to help process or collect data from laboratory equipment, to assist with the calculations necessary for In Process Controls and finished product testing. Common spreadsheet packages provide powerful functionality with ease of use and user friendly interfaces. A good example of such use is to manage machine production data sent from a PLC to a PC and converted to spreadsheet form then retained as part of the batch record.

Issues with spreadsheets are typically that little or no specification and verification documentation may be available, changes may have been made or occurred without following formal change control procedures leading to an unknown status of the
system and data integrity.

A high area of importance with spreadsheets is with regard to security and maintenance- including the backup and archiving of data. Usually these are not difficult problems to solve but users may not realize that they are using un-validated computer systems.

What can go wrong?
These observations by the USA FDA are typical examples of problems we have seen in Asia.

483 citation

“Manual data input into Excel software to calculate HPLC results was not checked. Changes to standard calculation parameters were not tracked or noted by users or by supervision.”

Warning Letter

Failure to use fully validated spreadsheets to calculate analytical results for in-process and finished product testing [21 CFR 211.165(e)]

 Warning Letter

There is no documentation covering Excel application software, or any procedures instituted covering the protection of electronic records or and established back-up systems.

Many regulatory inspectors are strongly aware of the vulnerability of spreadsheets. And due to their prevalent and well accepted use across the entire business world, spreadsheets may be considered an easy target to focus attention on their use with handling GxP data.

The purpose of validation is to ensure and demonstrate fitness for use. This means that documented evidence must exist to support the usage spreadsheet.

Where to start?
 By considering the approach we discussed for Retrospective Validation a similar easy to follow path may be described:

1) Determine the scope and depth of the validation:
For this we use an important tool as described in GAMP, – risk assessment.

Risk Assessment:

- The first step is a Risk Assessment which should be used to determine the GxP aspects and the complexity of the spreadsheet application (GAMP Category) this is used to define the scope and depth of the verification (scope of testing). Spreadsheets may be GAMP category 3, 4 or 5 depending on the use of non-standard functionality or custom programming.

The conclusion of the risk assessment should be documented in the Validation Plan.

2) Responsibilities & Planning
- A Validation Plan should be produced that documents the activities determined by the assessments above. Importantly the Validation Plan should state who is responsible for completing the activities.

Activities include:-
- Specification and verification documentation
- Test results
- Change Control procedure
- Maintenance procedure including backup
- Operating procedures and Security Controls
- Periodic reviews
- Validation report

3) Requirements, Specification (& Design)
It is necessary to sufficiently detail the requirements of the spreadsheet and for a complex application a design is required.
- System documents should be considered live and kept up-to-date using typical change control procedure to make required draft, reviews and approvals.

In the case of insufficient or no system documentation being available, a current and up-to-date package should be developed. Minimally this package should state the critical requirements, (in addition a complex application requires a functional design) and the required operating procedures.

4) Verification & Reporting
- Formal verification of the spreadsheet requirements (and functionality) is required.
- Verification is formal testing of the system to document its fitness for use against the system requirements and design. The Risk Assessment
is used to highlight which functions, areas and
requirements need to be verified.

A category 3 spreadsheet application requires a simple specification and verification definition of the use of the standard functionality. This may be by performing positive testing of the outputs against inputs.

A category 4 application requires additional specification and verification information of the required configuration. This testing should ensure the correct parameterization has been performed and that the required behavior is achieved by functional level testing.

A category 5 spreadsheet application requires explicit design definition and rigorous verification of the custom development. This may include verification of the boundaries of inputs and positive/negative testing of the designed functionality

- Upon completion of the verification activities the results and final approved state of the system should be described in a Validation Report.

5) Maintaining the validated state
- Importantly once the verification has been completed and approved via Validation Report the spreadsheet is considered fit for use, however it must be kept in the validated state.
- This is managed by applying typical change control and configuration management procedures:
- Changes should be assessed by considering the impact of the change (Risk Assessment), applying the changes, carrying out any verification required for the change and lastly the change must be documented.
- Security control is a special and critical issue for spreadsheets and must be put in place and managed by Operating Procedures. A typical example is to implement read-only access for users and reviewers of data and write access only under strict control.

Conclusions & Considerations
The validation of spreadsheets handling GxP data is of high importance for all PIC/S countries and suppliers to those countries and it need not be a large effort to bring these spreadsheets into compliance. We at Factorytalk are committed to assistance with predefined and achievable benefits.

Free Consultation
GAMP5 and CSV maybe new to some people and customers may have questions; we will provide satisfying, understandable answers.

Simply contact Factorytalk and Call for a Coffee for a free consultation.

We are located at :
Factorytalk Co., Ltd.
12th Floor, Liberty Square
287 Silom Road
Bangrak, Bangkok
10500 Thailand
Telephone : +66 (2) 630-4525      
Facsimile : +66 (2) 630-4527

Factorytalk Pte Ltd
25 International Business Park,
#04-106-107A,
German Centre,
Singapore 609916
Telephone :  +65 6562 7634       
Facsimile : +65 6562 7635

E-mail Address :
contact@factory-talk.com