Spreadsheet Validation & 21 CFR 820/13485:2016 Regulations

In the recent years as computers and software have become increasingly vital and complex, the FDA has become more stringent on software, database, and spreadsheet validation; with new regulations upon us other notifying bodies will follow suit. Many companies have received warnings from the FDA about their lack of validation procedures on their data processing systems. Released in March of 2016, ISO 13485:2016 will require the validation of software which will now align with 21 CFR 820. If your company has received warnings from the FDA or you are looking to implement a verification and validation SOP, AlvaMed has the experience and expertise to help.

FDA requirement:

21 CFR 820.70(i) – “When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented.”

ISO 13485:2016:

ISO 13485:2016 explicitly mandates that software used as part of the quality system be validated and subject to change control. The quality system must have procedures to govern and the validation must be documented and maintained.

Why should you validate a spreadsheet?

Spreadsheets and databases are automated data processing systems under regulation 21 CFR Part 820.70(i) and if they are used as part of production or the quality system, they need to be validated for their intended use. 21 CFR Part 11 states that the purpose of validation is to “ensure accuracy, reliability, consistent intended performance, and ability to discern invalid or altered records.” Validation produces documented evidence that the spreadsheet performs its intended use, correctly, and consistently while verification ensures that that correct output is achieved.

When should you validate a spreadsheet?

If the spreadsheet supports a process that is governed by external regulations and quality standard requirements, it should undergo the validation process. There is a common misconception that only spreadsheets with formulas must be validated; however, even if the data processing system (spreadsheet or database) is only keeping a record if it is part of the quality system, it must be validated for its intended use. 

Some Suggested Validation Measures from the FDA:

  • Lock all cells of a spreadsheet, except those for data input.
  • Make spreadsheets read-only, with password protection, so that only authorized users can alter the spreadsheet.
  • Automatically reject data outside valid ranges.
  • Manually verify spreadsheet calculations by entering data at extreme and expected values.
  • Test the spreadsheet by entering nonsensical data.
  • Keep a permanent record of all cell formulas when the spreadsheet has been developed. Document all changes made to the spreadsheet and control using a system of version numbers with documentation.
  • Periodically re-validate spreadsheets. This should include verification of cell formulas and a manual re-verification of spreadsheet calculations.