When the first PC’s came out, the application of choice was spreadsheet software. (Actually, for many it was the application that drove the purchasing of the PCs.)
We are talking VisiCalc and Lotus 1-2-3 on TRS-80, Osbourne ‘luggables’ and the 8086 chip IBM compatible machines now lost in the mists of time. (This was pre-Macintosh by the way, it only arrived in 1984.)
The ability to enter those rows and columns of digits, with easy correction and automatic recalculation was a gift from above to the numbers people. They were so easy to use, what could go wrong?
Fast forward 35+ years and here we are. They are indeed a gift – to the FDA.
Let’s quote a recently posted warning letter (DEC 2015) on ‘uncontrolled spreadsheets’ from a facility with a prestigious parent company. . [Note: (b)(4) signifies an FDA redaction of company confidential material.]
On August 28, 2014, FDA investigators identified instances of non-contemporaneous documentation of batch production activities. Two uncontrolled Excel spreadsheets were used to record discrepancies and certain in-process drug quality data. This data was initially missing in the batch manufacturing record. Your firm later entered this data into batch records and backdated them
For example, according to a March 2, 2013 entry in one spreadsheet, you did not perform (b)(4) testing as required after (b)(4) operations of (b)(4) mg batch (b)(4). Despite this notation, the associated “In Process Sample Analysis Sheet” documents (b)(4) testing results from February 22, 2013.
What Could Go Wrong?
That’s what can go wrong – ease of use prompts people in the GxP world to use a ‘quick and dirty spreadsheet’ (recognize the phrase?) to just get the job done. If it does it well, that spreadsheet gets reused – even shared, and therein lies the problem.
Just because it’s quick and easy doesn’t equate to quality or compliant work. People forget that, essentially, a spreadsheet is still a PROGRAM. Yes, it’s just based on a COTS package, let’s say Office. That makes it a GAMP Class 3 but it still requires design, testing and control. Users tend to add on an extra feature or two, a timesaver here or there and soon it’s a GAMP Class 5 due to the customization.
But It Works!
Why? Just because a spreadsheet works, does it cover all the data? Do the formulae actually read the full range you entered? Are the cells designed to accept and display/ retain the proper number of significant decimals? ‘ridiculous’ you think, that could never happen!
If that’s your reaction, may I suggest you need to get out more. Simple, quick and easy don’t equate to the kind of rigor the GxP regulated industry requires. It can also lend itself to other activities which are not to be endorsed. These images come from a recently released untitled letter (April 2016) from CDER
Be Controlled
If spreadsheets are programs, they need to be controlled under your company SDLC. If that frightens you, please remember that a good SDLC is scalable – it’s not everything, every time.
The spread sheet requires a basic development framework followed by reasonable controls.
- Develop a Spreadsheet SOP that recognizes them as controlled documents; specifies output that includes a title, date printed and user; provides a location to store the master spreadsheet copies and a separate place to access the approved copies.
- Risk Assess Spreadsheets designate levels of effort by type.
- A Few Examples – Simple – Typewriter/Calculator with data entered, results verified, printed out and wet signed Enhanced
- Multiple formulae and/or macros – results are exported and sheet is stored electronically but never printed.
- E-signed – Enhanced Spreadsheet is filled, reviewed and e-signed for submittal requiring a third-party add-in
- Design Specification that includes the reason for the spreadsheet, an unmasked copy of each formula and description of each data field type.
- Test Evidence that shows the ability to generate a correct set of results according to required calculations and the required format.
- Apply Controls that include locking all fields not needed for data entry and password protection on the sheet itself.
Part 11 Compliance
Just as the SDLC process needs to be scalable, so do the controls. A number of companies proudly provide intricate ‘Part 11 compliant controls’ for spreadsheets. I would suggest that companies consider the approach US FDA took to labeling.
There was much agony ten plus years ago over the idea that these electronic documents needed an audit trail to show every iteration of every change.
FDAs position was simple – we have the current approved label, send us the final version of the next label. We’ll do the comparison. The key is to know what version of the qualified spreadsheet is current and have it available.
If that sounds too difficult, consider that alternative from a 2013 warning letter below (full reference.)
Additionally, at the NNNN facility (FEI NNNNN), the investigator noticed that the use of the Excel® spreadsheets in analytical calculations are neither controlled nor protected from modifications or deletion. The investigator noticed that the calculation for residual solvent for (b)(4) uses an Excel spreadsheet that has not been qualified. We are concerned about the data generated by your QC laboratory from non-qualified and uncontrolled Excel spreadsheets.
In response to this letter, provide a retrospective evaluation of the analytical values reported where such Excel spreadsheets have been used. EOD
About Azzur IT
Azzur IT is an Azzur Group Company providing a broad range of services, including IT Quality & Compliance auditing services; computer system validation (CSV); application selection, implementation, integration and project management services; IT infrastructure, operations & data center assessment; risk-based data integrity assessment; compliance remediation projects; SOX consulting; process improvement and change management.
