Q: Do Microsoft Excel documents such as Deviation Logs, SOP number logs, and other supporting spreadsheets need to be validated? Or is it enough just to lock down the cells that shouldn’t be edited or accidentally changed? Then we would control additional editing in a validated document control system.
A: Spreadsheets need to be validated for their intended use. They also need to be controlled in a document management system.
Your validation should be based on what the spreadsheet is doing and what is allowed and not allowed in its use. You should ensure that cells that shouldn’t be changed are truly locked. In addition, ensure spreadsheet access is available only to the correct people and — for changeable cells — you always know who changed what, when (and exactly what was changed). Moreover, as part of your test, you should include the regulatory requirements as well as your business requirements.
[pullquote align=”right” cite=”” link=”” color=”” class=”” size=””]You will not validate Excel itself – just your use for it.[/pullquote]
As always, validation is based on your intended use and the regulatory requirements that govern your use of the spreadsheet. You will NOT be validating Excel itself – just your use for it. Remember also that creating SOPs and training spreadsheet users should be part of your validation.
For additional reference, you might be interested to see how FDA recommends the Development and Validation of Spreadsheets for Calculation of Data to its own laboratories (Volume III, Chapter 4.5 of the FDA ORA Laboratory Manual).
Answered by Janis Olson, Vice President of Regulatory & Quality Services at EduQuest (22 years as an expert FDA investigator and as the FDA regional director of information management resources). Jan also is the co-instructor of EduQuest’s FDA Auditing of Computerized Systems and Part 11/Annex 11 training class.