XLS Systems and data
Excel Spreadsheet Validation
Every calculation that decides a batch deserves backing. A spreadsheet looks like a simple tool. But when it calculates an analytical result, a batch yield or an expiry date, it becomes a regulated computerized system. We validate it so the numbers your process relies on are correct, traceable and auditable.
Signals
When do you need it?
- Your spreadsheets feed release decisionsAssay, dissolution, stability, weighing or yield calculations.
- They contain macros or VBACustom logic that nobody has formally documented or tested.
- Anyone can modify themNo formula protection, version control or change log.
- An auditor asked for evidenceAnd there's no GxP impact assessment or validation report.
Approach
Critical spreadsheets under control
We start with the inventory: not every spreadsheet needs the same treatment. We assess the GxP impact of each one and focus the effort on those that affect product quality or data integrity.
We review formulas, ranges, rounding and edge cases. We test with real data and with data designed to break the calculation. In the end, the spreadsheet is protected, versioned and covered by a change procedure your team can apply on its own.
Validating a spreadsheet isn't bureaucracy. It's making sure the numbers are right, today and in the next version.
How we do it
Service stages
- 01InventorySpreadsheet survey and GxP impact assessment.
- 02CategoryGAMP 5 classification based on complexity and use of macros.
- 03URS / FSRequirements and specification of the calculation logic.
- 04TestingVerification of formulas, limits, protection and access.
- 05VSRReport, release and version change control.
Regulatory framework
What the regulations require, point by point.
These are the references we work with for this service. We apply the ones that fit your market and your type of product.
FDA United States
- 21 CFR Part 11Applies when the spreadsheet creates or stores electronic GxP records.
- Data Integrity and Compliance with CGMP (2018)Controls over editable files and dynamic records.
EU GMP EudraLex Volume 4
- Annex 11End-user applications with GxP impact are computerized systems.
ISPE GAMP 5 Second Edition
- Categorization by complexityFrom simple calculation templates to spreadsheets with macros or VBA, which are treated as custom logic.
- GPG Records & Data IntegrityControls over end-user applications.
ICH Risk
- ICH Q9(R1)Impact assessment as the basis for the validation scope of each spreadsheet.
LATAM and WHO Local and international references
- ANMAT Disposition 4159/2023Requirements for computerized systems at manufacturers.
- WHO TRS 1019, Annex 3Good practices for validation, including computerized systems.
Deliverables
What you get.
Inspection-ready documentation, fully traceable and in your format. And a team trained to maintain it.
- Inventory and GxP impact assessmentWhich spreadsheets affect quality or data integrity, and to what extent.
- GAMP 5 categorizationStrategy based on complexity, use of macros/VBA and criticality.
- Specific Validation PlanScope, owners and acceptance criteria.
- URS and Functional SpecificationUser requirements and documented logic (FS for macros/VBA).
- IQ / OQ / PQ test protocolAdapted to spreadsheets: installation, calculation, limits and security.
- Protection and access controlLocked formulas, defined input cells, permissions.
- Version log and change controlHow to release the next version without losing the validated state.
- Validation summary report (VSR)Formal conclusion and release for GxP use.
FAQ
What clients ask before we start
Do all spreadsheets need to be validated?
No. Only those that impact product quality, patient safety or GxP data integrity. That's why we start with an inventory and an impact assessment.
Is a spreadsheet with macros more complex?
Yes. Macros and VBA are programmed logic: they require a functional specification and deeper testing than a template with simple formulas.
What happens when the spreadsheet needs to change?
We leave you a change control procedure that defines what gets retested depending on the change, so you don't revalidate everything every time.
Works well with
Related services
-
CSV
System validation (CSV)
LIMS, ERP, MES, SCADA or QMS that must prove they do what they claim.- GAMP 5 Second Edition
- 21 CFR Part 11
- EU GMP Annex 11
-
QA·IT
IT quality management
Without an inventory, criticality and QA IT policies, every validation starts from scratch.- GxP inventory
- GAMP 5
- PIC/S PI 011-3
-
SOP
SOP development
SOPs written for compliance that nobody reads, understands or follows.- 21 CFR 211.100
- EU GMP Chapter 4
- ICH Q10
Next step
Be ready for your next
regulatory challenge.
Tell us what you need to validate, qualify or document. In the first conversation we get to know your operation and tell you how we would approach it.