Using Excel in Regulated Environments
Jerry Anderson, Director QA
Isis Pharmaceuticals
(Views and opinions herein are from Jerry, not Isis)
References
FDA Lab Information Bulletin 4317: Spreadsheet
Design and Validation for the Multi-User Application
for the Chemistry Laboratory, Part 1
 FDA Lab Information Bulletin 4349: Spreadsheet
Design, Verification, and Validation, Use and Storage
of Single-User Workbook Files in the US FDA
Laboratories, Part 2
 Making Excel Spreadsheets Part 11 Compliant: Tools
and Techniques (FDA News)
 Validation of Spreadsheet Applications –
www.labcompliance.com
 Microsoft Spreadsheet Compliance document –
www.microsoft.com/office

Using Excel in Regulated Environments
2
Using Excel for GxP
Spreadsheets are used heavily in our industry for
GxP purposes
 Lab examples: templates for dissolution, purity,
concentration; ad hoc to supplement lab notebook
 Manufacturing examples: yield; cleaning limits
 Engineering example: calibration log
 QA/QE examples: change control log; metrics and
trending

Using Excel in Regulated Environments
3
Using Excel for GxP

Some companies have their Excel compliance
strategy in place

Procedures for creation, verification/validation, use, change control

All spreadsheets compliant
Some companies have GxP spreadsheets that are
not validated
 Some companies claim to have no GxP
spreadsheets…

Using Excel in Regulated Environments
4
Benefits of Excel
Widely used analytical tool
 Most large companies have enterprise licenses,
therefore everybody already has Excel
 Most users are already familiar with the program
 Much faster calculations versus using paper
 Industry generally accepts that native functionality
works…
 Good calculations created in Excel become good
repeatable procedures

Using Excel in Regulated Environments
5
Issues With Excel
Bad calculations created in Excel become bad
repeatable procedures
 There are many ways to screw up formulas in Excel
 Most Excel users are not familiar with good software
engineering principles
 Everybody already has Excel, so you might have GxP
software applications that you don’t know about
 Many GxP spreadsheets in use today have not been
verified/validated
 Validated spreadsheets are often not under change
control
 Spreadsheets can fall under Part 11

Using Excel in Regulated Environments
6
Industry Generally Accepts That Excel Works…
OK? Cancel???
Using Excel in Regulated Environments
7
Possible Future Issues With Excel?
Using Excel in Regulated Environments
8
Issues With Excel (Found Internally at FDA Labs)
Rounding errors in multi-step calculations
 Rounding differences between Excel formula and
manual verification formula
 Excel equations don’t match analytical method
equations
 Specifications/limits aren’t made clear in Excel
 Spreadsheets aren’t documented
 Spreadsheets aren’t clear for users other than the
author
 Regression analysis calculated with y and x axes
inverted

Using Excel in Regulated Environments
9
Warning Letters and Observations
“There is no documentation covering Excel
application software or any procedures instituted
covering the protection of electronic records or an
established back-up system”
 “Failure to validate computer software… For
example: software such as Excel… is not validated.”
 “Failure to use fully validated computer
spreadsheets to calculate analytical results for inprocess and finished product testing.”
 “QA/QC spreadsheet validation is deficient in that
only a small range of values are being used to
challenge computerized spreadsheet mathematical
calculations.”

Using Excel in Regulated Environments
10
Steps to Spreadsheet Compliance
Determine the spreadsheet type: managed, single
use, multiple use
 Spreadsheet type determines whether to control,
verify, or validate
 Use good software engineering practices when
building
 Procedures for verification, validation, use, and
control
 Security/access controls
 Change control
 Special measures if Part 11 applies
 Use of add-on tools

Using Excel in Regulated Environments
11
Classifications of GXP Spreadsheets

Type 1: Managed spreadsheet

Type 2: Single Use spreadsheet

Type 3: Repetitive Use spreadsheet
Using Excel in Regulated Environments
12
Type 1: Managed Spreadsheets
Used to simply log/store/track data
 Contains no math functions/formulas
 May require data verification, but does not require
validation
 Does require controls (e.g. security, procedure for
use/change)



Example: a change control log

Records change control number, requestor, description, dates, etc.

Provides reference for next unique change control number
DANGER AREAS: change control number autogeneration; cycle time calculator
Using Excel in Regulated Environments
13
Type 2: Single Use Spreadsheets
Created for a one-time use purpose
 Often created ad hoc to support analyses
 Typically contains functions and formulas, but not
macros
 Verified at time of use
 Once verified, may be saved for future use by an
analyst



If not validated, must be verified again at time of subsequent use
DANGER AREAS: lack of formal control; stored
method parameters
Using Excel in Regulated Environments
14
Verification of Type 2 Single Use Spreadsheets
Analyst creates, tests, and populates one or more
sheets containing raw data, calculations, results
 Analyst performs the first verification of calculations
and results
 Analyst prints the spreadsheet
 Second analyst verifies the printout



Check data, calculations, results

Calculation check can be hand, calculator, new spreadsheet
Minor errors may be attributable to rounding
differences

Watch significant digits on raw data

First analyst should communicate his rounding strategy
Using Excel in Regulated Environments
15
Verification of Type 2 Single Use Spreadsheets

Both the original electronic spreadsheet and the
printed report should be preserved and controlled

Spreadsheets that receive this 100% verification by a
second party do not require validation
documentation
Using Excel in Regulated Environments
16
Type 3: Repetitive Use Spreadsheets
Written for common use by multiple users
 Stored as a template
 Typically contains functions and formulas, and may
contain macros (recorded or written in VBA)
 Proactively validated before release to users
 Validated read-only template workbook made
available via shared drive, Citrix, EDMS, CD, etc.


DANGER AREAS: storing and using ‘local copy;’
changing validated spreadsheet during/prior to use;
storing data over time
Using Excel in Regulated Environments
17
Developing Spreadsheets
The design of managed spreadsheets will naturally
follow the structure of the data that’s being tracked
 Single use spreadsheets should be designed to
make sense to the owner/user and the verifier



If they are to be saved for future uses, more care should be put
into the design
Multiple use spreadsheets should be designed to
make sense to any future user, and to ease the
validation/documentation effort
Using Excel in Regulated Environments
18
Principles of Spreadsheet Development


Objectives:

Guaranteed correctness: errors should be obvious

Adaptability: make the ‘program’ easy to maintain and change over
time
Treat spreadsheet development like computer
programming

Functional decomposition: break big calculations into small chunks

Stage-by-stage component testing



Unit testing; build testing
Modularity: separate raw data, calculations, and results
A vertical flow through the method (one or two
screens wide) is easy to follow due to the nature of a
PC interface
Using Excel in Regulated Environments
19
Principles of Spreadsheet Development


Workbook organization:

Documentation sheet: title, author, purpose, prerequisites, table of
contents, assumptions, etc.

Data: raw data input sheet

Calculations: one or more sheets as required to process the data

Results: calculated/derived data and summary of calculations

Your mileage may vary… It’s possible to build a single page
spreadsheet that looks good and makes total sense
Clear formulas:

Spread complex formulas across multiple cells

If appropriate, use text in adjacent cells or cell comments to
explain how the calculations work
Using Excel in Regulated Environments
20
Principles of Spreadsheet Development


Lock all cells except those being used for data input

Color code input cells and result cells

Conditional formatting can use color to highlight pass/fail
Password protect worksheets to keep cells locked


Review tab  Protect Sheet to lock all but data entry cells and
protect structure of worksheet
Password protect workbooks to prevent changes to
workbook structure

Review tab  Protect Workbook
Using Excel in Regulated Environments
21
Principles of Spreadsheet Development


Include automatic checks

Tables of data: sum of column totals = sum of row totals

Dropdown lists for restricting data entry

Excel Data Validation to restrict data entry: data types, range of
values, list of values (Data tab  Data Validation)

IFERROR function to deal with dividing by zero, etc.

=ROUND(E31/D4*100, 1)

=IFERROR(ROUND(E31/D4*100, 1),“Error”)
Plan when to use all digits, when to round, and to
how many significant digits to use/present
Using Excel in Regulated Environments
22
When To Validate
Validation is required when a spreadsheet is
intended for multiple uses by multiple users, and will
not be 100% verified again at the time of use
 Even single use spreadsheets are candidates for
validation if they’re really complex, or use VBA


Should I validate:

If I create a single use spreadsheet and it is 100% verified?

If I decide to save that spreadsheet as a template, and use it again
later?

If I decide to save it as a department-wide multi-use spreadsheet?
Using Excel in Regulated Environments
23
Validation of Repetitive Use Spreadsheets
1.
2.
3.
4.
5.
6.

Validation procedure
Validation plan
Specifications
Development and development testing
Validation testing
Validation report and attached documentation
Good news: 2 – 6 can be captured on a single form
Using Excel in Regulated Environments
24
1. Validation Procedure
An SOP that guides the verification/validation/use of
all GxP spreadsheets
 As with any other form of validation, the SOP should
be in place and approved before validation begins
 Specifies how all steps (planning, specification,
development, testing, reporting) should be carried
out
 Specifies roles and responsibilities

Using Excel in Regulated Environments
25
2. Validation Plan
States what will be done, scope, tasks, and
responsibilities for validation of a particular
spreadsheet
 Typically defines the limits of the validation, e.g. for a
particular analytical method

Using Excel in Regulated Environments
26
3. Specifications
May be combined ‘requirements’ captured in a block
on a form (e.g. for ‘simple’ formulas)
 May also be full URS/FRS/DS documentation (e.g. for
large-scale VBA programming)
 Should include definition of use and parameters
(formulas and range of values) from the analytical
method

Using Excel in Regulated Environments
27
4. Development

Follow the principles of spreadsheet development
outlined earlier


This will make your validation job much easier because your
spreadsheet will be easy to understand, test, and document
The developer should perform unit and structural
testing prior to releasing the spreadsheet for
validation testing
Using Excel in Regulated Environments
28
5. Validation Testing
Performed by someone other than the developer
 Walk through and verify the spreadsheet design
(structural testing)
 Use the spreadsheet as intended (functional testing)


Using test data, check for expected results

Test data should include boundary values, incorrect data types,
empty fields, out-of-range values

Verify spreadsheet formulas by performing manual calculations
and comparing the manual results to the spreadsheet results
Using Excel in Regulated Environments
29
6. Validation Report
Summarize the results of the validation effort and
formal testing
 Attach screen shots of the testing results
 Attach a printout of the spreadsheet with ‘view
formulas’ turned on


Formulas tab  Show formulas
Using Excel in Regulated Environments
30
‘View Formulas = Off
Using Excel in Regulated Environments
31
‘View Formulas’ = On
Using Excel in Regulated Environments
32
Testing
Verify cell locking, color coding
 Verify password protection
 Verify the correct formulas were used, and that they
work correctly
 Verify units of measurement
 Verify rounding and presentation
 Use sufficient input data sets during testing


Expected data, boundary data, unexpected data
Using Excel in Regulated Environments
33
Built-In Auditing Tools
Using Excel in Regulated Environments
34
Other Tools


Power Utility Pack: Excel add-in tools

Spreadsheet auditing and reporting tools

Heavily relied on in specification examples in FDA lab bulletins
Finsbury

Tools for spreadsheet auditing, verification, documentation, audit
trails, electronic signatures
Using Excel in Regulated Environments
35
Security

Multi-use templates and populated spreadsheets
should be stored on a read-only file share

Makes for easy but secure access, prevents inadvertent changes,
and assures regular backup

Another possibility: store spreadsheets with a secure application
such as an EDMS
Use Excel to password protect workbooks to prevent
changes to workbook structure
 Use Excel to protect individual worksheets to
prevent changes to formulas

Using Excel in Regulated Environments
36
Change Control

Validated spreadsheets should be placed under
formal change control like any other validated
computer system
Using Excel in Regulated Environments
37
Part 11 Compliance Methods


The biggest issue with Part 11 compliance is the lack
of audit trails

Changes to formulas, macros, formatting…

… But mainly, changes to persistent data
Possibilities

Procedural workarounds (e.g. paper audit trails)
Access controls (e.g. protected worksheets; read-only storage;
monitored check out & check in of spreadsheets)
 External document management systems
 Don’t store data accumulated over time
 Third-party tool (like Finsbury)

Using Excel in Regulated Environments
38
Automated Tools For Part 11 Compliance

Your EDMS (or possibly LIMS) system


Versioning, access control, audit trail of changes (clunky!),
electronic approvals
Finsbury DaCS (formerly Compassoft, formerly
Wimmer Systems)

Security and Part 11 compliance added into Excel

Versioning, access control, audit trails, electronic signatures
Using Excel in Regulated Environments
39
Automated Tools For Part 11 Compliance

Agilent Enterprise Content Manager


Versioning, data integrity, cell locking, differencing tool, cell-by-cell
audit trail
NuGenesis application control module: differencing

Versioning, access control, audit trail of cell and configuration
changes, electronic signatures
Using Excel in Regulated Environments
40
Interactive Opportunity
Attendees will describe spreadsheets in use at their
companies
 The class will determine whether they are GxP, the
appropriate compliance approach, whether Part 11
applies, and methods for Part 11 compliance

Using Excel in Regulated Environments
41
Questions?
Using Excel in Regulated Environments
42