Sample Content

Purpose

The purpose of this document is to provide guidelines for a suitable approach for the qualification of Excel spreadsheets used in direct, or in-direct, GxP related activities at all GMP facilities.

Scope

The procedure applies to the initial qualification and re-qualification of Excel spreadsheets, designed and used for making quality based decisions in GxP environments at the GMP facility. These areas include but are not limited to:

• Quality Operations
• Manufacturing Operations
• Development
• Planning
• Regulatory Affairs

The scope does not include those spreadsheets which are single use only (prepared for a specific, one off tasks) or those which are used for organisation of personal, or departmental work plans. These should be verified at each time of use as appropriate.

References

• Good Automated manufacturing Practice Guide (GAMP), Version 4, ISPE
• David Harrison and David A Howard, A Pragmatic Approach to the Validation of Excel Spreadsheets, Pharma IT Journal, Vol1 No.4 October 2007

Introduction

Spreadsheets can be used to record and manipulate (change, delete, add) GxP data and as such need to be managed to ensure the continued integrity and security of that data.  While some are no more than fancy calculators others are embedded with special features and use intricate logic in the form of Macros that are in effect computer programs.

Spreadsheets can be classified into GAMP categories depending on use and contents of the spreadsheet.  This will impact the level of validation effort that is applicable just as with other computerized systems.  Spreadsheets which fall into GAMP Category 3 guidelines (Table 1) do not require full validation activities but should be held under appropriate security conditions.

Table 1 GAMP Categories for Spreadsheets

3. used solely to produce paper documents
4. more complex such as those that incorporate templates
5. uses macros, lookup tables &/or sophisticated logic

Spreadsheets which have calculations that are fully explained on the spreadsheet and which undergo verification with each use do not need to be fully validated, however where there are templates for the spreadsheets appropriate security conditions, including password protection should be provided.

This guidance outlines steps that shall be followed to request, approve, develop, test, implement, maintain and support a controlled spreadsheet application.

Validation of a Spreadsheet Application

Functional Requirements Development

Spreadsheet applications may be developed by individuals (e.g., laboratory analysts) who have been qualified by training or experience as a Spreadsheet Application Developer.

The Functional Requirements Document incorporating user requirements and functional specifications shall be written by the developer. These should be approved prior to initial design but may be developed retrospectively after a prototype spreadsheet has been prepared.

The Functional Requirements Document should contain applicable sections to describe:

• The intended purpose of the spreadsheet application (such as to calculate results, to re-order results for Management Reports, etc.).
• The formulas that will be included in the spreadsheet application, including logical formulas used for branching or for calculations.
• A description of macros that will be included.
• A description of any column or row rearrangements/sorting that will be required to format a new report from included data.
• A description of the report that will be generated.
• A statement defining electronic storage requirements for the executed spreadsheet application (results).
• Where applicable, issues such as data formats and numerical precision, numeric rules such as rounding or floating points, flagging of limits, boundary conditions, filters or outliers.
• Performance requirements for the application and program (i.e., calculations or reports within X seconds, applications/program availability, etc.).
• Workflow needs such as the source of the data, a statement regarding raw data, and “who will perform what actions and make what decisions based on what data and criteria” may be required.

Review and Approval of Functional Requirements

The functional requirements should be submitted to the Validation Manager for technical approval, to Quality Assurance for regulatory compliance, the Local Area Network Manager (if applicable) and to the Area Manager for overall approval.