Under 21 CFR 11.10 Controls for closed systems, all spreadsheets that are used to facilitate the product and/or quality system decision-making processes need to be within compliance, including requirements for validation, accurate copies and protection of records, limited system access to authorized individuals, audit trails, authority, operational and device checks, training, electronic signatures, and change control.
Examples of spreadsheets used to make quality decisions that need to be validated include tracking logs (internal audits, approved supplier lists, lot release, training) and quality assurance data (CAPAs, NCMRs). Spreadsheets used during design and production activities to collect research, animal lab, and manufacturing data may also fall within the requirement.
In recent years, FDA has stepped up their enforcement of the regulation and as evident through the issuance of an increasing amount of 483s for spreadsheets without proper validation documentation.
A comprehensive spreadsheet validation procedure and methodology is required to ensure compliance with these requirements.
Here are some suggested steps you can take to incorporate these requirements within your quality system:
Implement new procedure for workbook verification and validation: A standard procedure identifying which workbooks need to be controlled and the requirements for completing a thorough validation. Different types of spreadsheets should be considered when creating the procedure including custom macros, sophisticated lookup functions, range operations, simple formulas, forms and other excel operations. The process flow should consider risk when determining the extent of validation required for the workbook.
Maintain workbook inventory log: An inventory log is a comprehensive list of workbooks used at the site. The inventory log will help with identifying the requirements for each worksheet and maintaining the validation status. It is important to identify an owner for the log and complete an annual review of the list, accounting for any updates or changes.
Perform validation testing: The validation documentation and effort may differ based on the risk and complexity of worksheet. The validation process involves the following activities:
- Identifying the verification requirements at the workbook and worksheet level. The requirements include the intended purpose of the workbook, description of any formulas or macros, any computer or performance requirements, locked cells, password protection, etc.
- Defining test cases for each requirement along with the appropriate acceptance criteria.
- Execution of test cases and the creation of a validation report, documenting the objective evidence demonstrating that all acceptance criteria were met.
Annual Review: An annual review of the workbook inventory log should be completed to verify there are no changes to the validation status, as any changes or updates need to be reviewed for potential re-validation activities.
To learn more about how to effectively implement the spreadsheet validation process at your site, feel free to reach out to our Quality Compliance experts at AlvaMed.
