Spreadsheet Validation and Part11

COMPUTER SYSTEM VALIDATION (CSV) 21 CFR PART 11
1

Hi all,

A question regarding 21CFR11 and spreadsheets.

If I procedurally prohibit a spreadsheet created from an Excel template, and / or add some VB to automatically print and close without saving. Can I assume that 21CFR11 does not apply the the spreadsheet and that in fact it’s being used simply as a replacement for a calculator.

Obviously the spreadsheet will be validated, with security applied to any calculations within the sheet.

Thanks

Bob

2

Hi Bob,

First of all what is the calculation used for?

If the calculations result is transferred to another sheet, is it independently verified on review?

Regards

3

[quote=gokeeffe]Hi Bob,

First of all what is the calculation used for?

If the calculations result is transferred to another sheet, is it independently verified on review?

Regards[/quote]

Hi there,

The sheets will be used for lab assays. Data is manually entered and a result given, which will be recorded on a assay result form. The entered data is backed up and stored within the application of the instrument. Data entered is second person verified.

Thanks

Bob

4

Hi Bob,

You say in the first post that the sheet will be validated anyway so if that is the case are you going to comply with Part 11 anyway?

How does the second person verify do they use the same excel sheet to redo the calculation?

Rgs

5

[quote=gokeeffe]Hi Bob,

You say in the first post that the sheet will be validated anyway so if that is the case are you going to comply with Part 11 anyway?

How does the second person verify do they use the same excel sheet to redo the calculation?

Rgs[/quote]

Well not really, there are three basic elements to part11, procedural controls, validation and a set of functional requirements which the system must perform.

What I’m asking is if my spreadsheets would be considered under the umbrella of part 11, if I do not save the excel file containing the data? The spreadsheet needs validating regardless of part 11 applicability.

Does this make sense?

Bob

6

My gut feeling is that it isn’t, as the results are transferred to another record which acts as the primary record, and this

get a second review to verify the calculation.

After saying that as this excel generates critical data, it may well be.

I would like to hear more inputs on this, and I cannot be certain either way.

Part 11…oh the joys!!!

7

Bruce Berrest

• [COLOR=#000000]I’ll comment here, not on your forum. Feel free to share my comments there.

You said “You say in the first post that the sheet will be validated anyway so if that is the case are you going to comply with Part 11 anyway?”

That’s not neccessarily true. Validation in and of itself does not constitute Part 11 compliance, as there is a validation burden in the predicate rules. See 21 CFR Part 211.68(b). Validation is required independent of Part 11.

If we accept that a spreadsheet in which (a very simple bit of) VB code is utilized to disable “Save” and “Save As”, no electronic records are created, therefore Part 11 does not apply. I’d argue that a procedural control is insufficient, since a technical control, is available.

As for requiring a second person to check the spreasdsheet results, see 21 CFR Part 211.68(c). Spreadsheet validation can satisfy that, so there is no need to recheck the calculations, just have to check the transcription of data from the lab instrument from which the data was acquired into the spreadsheet. And if that process is automated and validated, don’t have to recheck that either.

In the end, I’d agree with the poster, Bob.[/color]

8

Helen Johnston

• [COLOR=#000000]Feel free to pass this on as well.

I agree that as this is not the initial recording of raw data and no data is being kept, then it can be put out of scope for part 11.

When we were investigating spreadsheets and validation we concluded that you could not use them in a part 11 compliant manner without add-ons (of which there are a couple commercially available).

You could make calculation templates where the calculations were validated and the template was version controlled (e.g. stored in a folder with limited write access, last modified date time & size recorded in the validation documentation). As you describe, users would enter results and print the sheet showing the results they entered and the calculated result.

We concluded that such a spreadsheet was a ‘Cat 5’ system and I developed a condensed set of documentation for just such scenarios. The decision to shut the place down came just before we were going to roll the new templates out so I haven’t been able to find out if they would have worked in real life.

Helen[/color]

9

Bruce Berrest

• [COLOR=#000000]@Helen I see such spreadsheets Category 4, since using Excel formulas for calculations, no matter how complex, requires no custom code that alters Excel’s base functionality. Why would you call them Cat 5?

GAMP5 is quite literal about definitions of software category. Here are Category 4 and 5 definitions from GAMP 5. These are from Table M4.1

  1. Configured: Software, often very complex, that can be configured by the user to meet the specific needs of the user’s business process. Software Code is not altered.

  2. Software custom designed and coded to suit the business process.[/color]

10

Helen Johnston

• [COLOR=#000000]I can see where you are coming from but there are two points to my logic:

  1. The original poster mentioned using VB, that is code and firmly puts him in the cat 5 camp.
    I admit that I was taking the definition beyond that to sheets without VB so that leads me to point 2:
  2. If you look at the functions that there are in excel and compare it to the functions you can call in programing or scripting languages (SQL, Java, SAS etc.). Statistical functions, control functions, mathematical functions… Is excel closer to an environment you develop an application in or a system you configure? On balance I feel it is closer to an environment than a system you configure.
    Another way to look at it is for a system you are ‘configuring’ to meet certain requirements, there is probably only one way to configure it e.g. one set of options that will give your security roles the access as specified. If you are ‘developing’ to meet certain requirements then there may be many ways to develop it that all meet that need. Again, for me, excel feels more like a development environment than a configuration.

There are many, many examples of spreadsheets that people have ‘thrown together’ within and outside the GxP area that contain errors that can lead to people making the wrong decision. I think that the rigour of Cat 5 is justified – but it can be greatly streamlined and reduced in volume. E.g. I think things like a ‘code review’ of the sheet by someone other than the author will spot >= where there should be a > and similar errors.

I’m not sure if I care that much if people call spreadsheets with calculations Cat 4 or Cat 5. I think the important thing is to recognise that it IS important to ensure that spreadsheets are doing the right calculations and have appropriate controls on their use without overburdening the business with validation efforts.

H[/color]

11

We would like to introduce you to iXLc which is a Spreadsheet Management Tool. Spreadsheets are used extensively by several departments of Life Sciences companies to perform or support GxP regulated activities. Some of the major concerns while using spreadsheets in such regulated environments are:

Enforcement of user access and availability of the latest version or specific templates of the spreadsheet.
Configuration of security within the template and spreadsheet to ensure that users cannot modify formulas, static text and specified cells within a spreadsheet.
Use of electronic signatures for reporting results and data. Authorised approvals in a paperless environment.
Audit trail of comments and review/approval cycle for spreadsheets.
Ensure that the printed copies of the spreadsheets contain the necessary information (Printer by User, Date/Time Stamp, and Current Status).Compliance with USFDA -21 CFR Part 11and EU Annexure 11.
iXLc has been specifically designed and implemented to addresses all these concerns keeping in mind the requirements and regulations of the life sciences industry.

Regards,
Sabyasachi
sabyasachi@ivyworks.net