Should simple excel risk assessment templates be validated? Template calculates risk class and priority only say. Can it simply be approved as part of the Risk Assessment procedure approval?
Yes, It is better, to validate the risk assesment sheet for verify the relibility and reproducibilty.
Regards,
I have not seen these validated yet. As much as I like making work for all of us consultants, it seems a bit over the top. We’re only talking about multiplying a few numbers together.
We have a web of Office templates for our GAMP4 and GAMP5 programme. They are not validated. We’ve deployed them across the world at Top 10 pharma. The topic has never even come up.
I agree with acharyar. I’ve yet to come across an instance of the inability of tools to properly multiply simple integers and even if it did muck up a calculation, the likelihood that it would be caught is quite high.
We have numerous clients that have used Excel templates that automatically calculate the risk values and, at least to date, FDA has never pressed for validation.
Sorry but I can’t believe what I am reading here. Risk management is far out the most important activity in designing safe and effective products. Imagine that you are working on a medical device with health risks and the patient gets severely injured, or worse, dies because a risk was not correctly quantified due to a spreadsheet calculation flaw and therefore not mitigated to an acceptable risk. How will you explain that to the FDA, or more important, to the patient or family of the patient.
Forget about the FDA. If you want to operate in an industry such as the Medical Device industry, your focus should be to protect the patient and not how you can minimize the validation effort.
1 Like
[quote=aristoteles]Sorry but I can’t believe what I am reading here. Risk management is far out the most important activity in designing safe and effective products. Imagine that you are working on a medical device with health risks and the patient gets severely injured, or worse, dies because a risk was not correctly quantified due to a spreadsheet calculation flaw and therefore not mitigated to an acceptable risk. How will you explain that to the FDA, or more important, to the patient or family of the patient.
Forget about the FDA. If you want to operate in an industry such as the Medical Device industry, your focus should be to protect the patient and not how you can minimize the validation effort.[/quote] Sorry, I agree with the others…way over the top. Validation? Absolutely, over the top. Of course check that it works…but there is an output from this that is reviewed. I would never waste, yes I said waste, my time with a non-value added function of validating a risk assessment spreadsheet. I don’t even know how you could even justify this to your management.
I don’t know how you could justify to your management an adverse event … let’s say blindness. Oh but you would check that it works … and I assume that you would document that activity.
This is why I like the aviation industry where the FAA inspector joins the QA guy on a plane ride to check if all risk mitigations are working. It’s amazing to see how people’s attitude change if the risks are imposed on them.
Sorry, but I do not agree with over-validation.
For example, I do not check that every single multiplication instruction is correct in my PLC or SCADA application - the validation is more than enough - that is the vendors’ job not mine (i.e., the application is fully tested but not at the microcode level). Nor do I check that every single thing inside my spreadsheet is correct. That is okay - this is not the space program - I would expect that these things would be verified there. The space program or Boeing or even the ancient air traffic control system in most countries is tested to a higher standard than medicines. We use different programming languages in the systems including redundant systems way above anything you would see in a pharmaceutical factory. The two simply cannot be compared. No pharmaceutical client has the funds to test like Boeing or Airbus. We should just remember that in most other industries there is barely any testing at all beyond some simple commissioning.
We have a tendency to do too much. Checking that Excel can multiply three numbers is an example of that flaw. Again that is Microsoft’s job not mine
By ‘I’ a mean the industry at large has I design systems not validate them. But I do dislike when the validation itself is overdone.
[quote=acharyar]Sorry, but I do not agree with over-validation.
For example, I do not check that every single multiplication instruction is correct in my PLC or SCADA application - the validation is more than enough - that is the vendors’ job not mine (i.e., the application is fully tested but not at the microcode level). Nor do I check that every single thing inside my spreadsheet is correct. That is okay - this is not the space program - I would expect that these things would be verified there. The space program or Boeing or even the ancient air traffic control system in most countries is tested to a higher standard than medicines. We use different programming languages in the systems including redundant systems way above anything you would see in a pharmaceutical factory. The two simply cannot be compared. No pharmaceutical client has the funds to test like Boeing or Airbus. We should just remember that in most other industries there is barely any testing at all beyond some simple commissioning.
We have a tendency to do too much. Checking that Excel can multiply three numbers is an example of that flaw. Again that is Microsoft’s job not mine
By ‘I’ a mean the industry at large has I design systems not validate them. But I do dislike when the validation itself is overdone.[/quote]
I am not advocating validating Excel, which is indeed Microsoft’s responsibility. Validating the intended use of a spreadsheet application that is used in the design of a medical device is the responsibility of the medical device manufacturer. It is the law … hence the FDA has issued several warning letters concerning the validation of spreadsheet applications.
The medical device regulator doesn’t want you to over-validate … they want you to perform risk-based validation. So if you can provide a documented risk analysis that supports your decision not to validate, they may accept it. Again, this is all to protect the patient … and that includes you and me.
Folks,
Some food for thought:
A couple of years ago, I noticed an anomoly in Excel. A report of mine sent me a very simple spreadsheet of data. When viewing the data, I noticed that things didn’t add up. I had a column that added 1+1 and got 3 using the simple summing function in Excel. By scrolling up and down, I got the result to change back and forth between 2 and 3. I could print the viewed page with a 2 or 3 depending on which screen I was on. Interestingly though, I could print a 3 when viewing a 2. I had to call in a few witnesses to corroborate the event was happening. We were all in disbelief.
So, aristotoles warning shouldn’t be swept aside so quickly. I’ll give that this was the only occurrence that I ever saw (or was aware of) in two decades of using Excel, however, it happened. Also, I was never able to get that file to repeat the error after closing and reopening the file. However, in speaking with other validation professionals, they agree that systems and software need to be validated for their intended uses, regardless if its a name brand computer or well established software package. You must be in a position to defend yourself. Admittedly, some businesses have higher risk thresholds than others - which one do you work for?
Good thoughts everyone, so back to the group.
Kevin
Hi, I’m new to the group and am implementing a validation program in a small pharma and struggle with the same issues of how much validation is enough or appropriate.
We are implementing a risk-based approach which utilizes a risk assessment. In my opinion validating a risk assessment template is overkill. Validating/Verifying the process and documenting it in an SOP is appropriate, again in my opinion.
[quote=acharyar]Sorry, but I do not agree with over-validation.
For example, I do not check that every single multiplication instruction is correct in my PLC or SCADA application - the validation is more than enough - that is the vendors’ job not mine (i.e., the application is fully tested but not at the microcode level). Nor do I check that every single thing inside my spreadsheet is correct. That is okay - this is not the space program - I would expect that these things would be verified there. The space program or Boeing or even the ancient air traffic control system in most countries is tested to a higher standard than medicines. We use different programming languages in the systems including redundant systems way above anything you would see in a pharmaceutical factory. The two simply cannot be compared. No pharmaceutical client has the funds to test like Boeing or Airbus. We should just remember that in most other industries there is barely any testing at all beyond some simple commissioning.
We have a tendency to do too much. Checking that Excel can multiply three numbers is an example of that flaw. Again that is Microsoft’s job not mine
By ‘I’ a mean the industry at large has I design systems not validate them. But I do dislike when the validation itself is overdone.[/quote]
I do not know how the relulatory body works in NewZealand, but in USA if FDA auditors find that a Excel template used for risk assessment and is not validated then be ready to receive 483 with very strong observations, which will make you first validate the sheet and then revisit all the risk assessments.
Any sheet has to be validated for its intended use per FDA guidelines.
It make sense too, E.g. the sheet is supposed to calculate sum of x, y and z which is x+y+z, what if the author inadvertantly used the formula as x+y-z. I do not think we can held Microsoft responsible for this.