In general: whether to validate and whether Part 11 applies are two
very different questions, and should be assessed separately.
Question: Should we validate? FDA’s current thinking is that
computer validation shouldn’t be driven by Part 11, but should
instead be driven by both predicate rule requirements (there aren’t
many of these in the pharma world, of course) and the regulated
firm’s risk assessment. Using the previous example of a training
records management system: there’s no Part 211 drug GMP predicate
rule requirement for training records, much less for validation of
training or the training records system, therefore a ‘liberal’ could
make a case that ISOtrain or a similar system need not be
validated. A ‘conservative’ would argue that we’re using records in
the system to prove a GxP point, therefore of course the system must
be validated.
My position: Mostly conservative. I find it hard to make a good
argument for not validating a computer that’s going to store GxP-ish
records or help make GxP-ish decisions. However, I do advocate
using system risk (mostly driven by impact on product/patient) to
determine how much validation work will be required.
Question: Should we require Part 11 controls? FDA’s current
thinking is reflected in the 2003 guidance: if the record is
required by predicate rule and used in electronic form, OR is signed
electronically to meet a predicate rule signature requirement, OR is
submitted electronically to FDA, Part 11 applies. Some folks,
including some on this thread, are ‘conservative’ to the point of
continuing to apply Part 11 to all GxP records, and that’s fine:
it’ll cost them more money, but they certainly won’t get into any
regulatory trouble.
My position: I’m more ‘liberal’ on Part 11 than on validation. To
use the above system example: I’ll validate my training system, and
if Part 11 controls come with the software I’ll turn 'em on, but I
won’t go out of my way to add Part 11 compliance if it’s not already
built in. The records just aren’t required by predicate rule (FDA
has recently made their position on training records clear).
(Note: some folks in the regulated industry fought hard to get FDA
to limit Part 11’s scope to records explicitly required by predicate
rules, e.g. batch records, and they were successful. Please,
everyone: you can help by not muddying the waters for the
newcomers. You might continue to personally apply Part 11 to all
GxP systems at your company, but please don’t tell other folks that
they have to as well.)
None of the above really addresses the original question:
If a spreadsheet has no electronic records because it
does not save data and there are no electronic signatures,
what regulatory bodies dictate it’s validation?
To paraphrase “My Cousin Vinnie’s” girlfriend, "That’s a difficult
question to answer because of the way the question is constructed."
You don’t make the validation decision based on whether an e-record
or an e-signature is created; those are Part 11 issues. Instead,
you make the validation decision based on what the spreadsheet is
doing and how the result will be used.
My position: A spreadsheet that’s used simply to track/store GxP
information and that uses no functions (e.g. math calculations, date
calculations) or macros need not be validated. It might need to be
officially ‘controlled,’ and certainly protected against
unauthorized access.
A spreadsheet that makes (for lack of a better term) GxP
calculations should be validated. This is true even if the data
won’t be saved as an e-record. You validate to prove that the
functionality you’re stringing together works correctly; this is no
different from the need to validate a JMP or SAS analytical
program. (There are additional considerations involved if you plan
to store either the template or the data for future use, but that’s
not what was asked.)