Using and Validating

Spreadsheets
by

Jacques Bichier
Sr. Project & Research Engineer

1
Use of Spreadsheet
• Popular in our industry for multiple uses
– Process calculations
– Data tabulation, graphing, and analysis
– Design of templates for record keeping
– Electronic record keeping

• Spreadsheet with data that is used to make decisions about

the processing, manufacturing, and/or disposition of food
products must be validated.
• If the spreadsheet data is entered, maintained, displayed,
and/or reviewed in electronic form, then, it must also be
21 CFR Part 11 compliant.

2
Why validate your spreadsheet?
• to provide documented evidence that assures to a high
degree of confidence that the spreadsheet performs its
intended functions accurately and reliably.

3
Spreadsheet 21 CFR Part 11 Compliant?
• Am I using it to record process data electronically?
– e.g.: Headspace records
– e.g.: Fill weight records
• Am I using it to calculate my process that I am running in the
plant?
• Am I using it to calculate my process that is filed with the
FDA? To evaluate a process deviation and determine the
disposition of the batch from the spreadsheet results?

4
Spreadsheet 21 CFR Part 11 Compliant?
• Excel spreadsheet is a very useful tool, but it was not
designed to be 21 CFR Part 11 out of the box.
• To bring a spreadsheet to full compliance will require an IT
staff member and a software developer to engineer a
compliant solution.

• However, there are some steps that you can take to mitigate
non-compliance.

5
Requirements to be compliant:
- Validation
- Accurate and complete copies of records
- Protection of records
- Limited and controlled access
- Audit trails
- Operational systems checks
- Security/Privileges checks
- Training
- SOP for handling electronic records and signatures
- Documentation of specifications and of qualification
challenges
- Control of documentation

6
Example
• Whenever appropriate, I have included a spreadsheet that
calculates the F-value by the General Method.
• The password to access the file and/or to modify its content is
“test”

7
Where should I start?
• Define the scope of the validation work and validate for its
intended use. Do not attempt to validate Excel!
– Focus on the content of the spreadsheet
• CCP
• Process safety
• Risk assessment :
– Low Risk: Unrestricted data entry, label text,
sorting, formatting
– Medium Risk: Restricted data entry, conditional
formatting, alert displays, charts
– High Risk: Calculation, macros, spreadsheet
protection.

8
Where to Start?
– State what you intend to include in the validation plan and
list the deliverables
• Don’t be concern about details at this point, there is
plenty of time for details in the latter stages of the
validation work.
• State what you intend to include in the URS, FS, DS,
IQ, OQ, PQ
• Identify and list the major components and tasks

9
User Requirement Specifications (URS)
• URS: The URS describes captures the essential of what the
spreadsheet is supposed to do:
– Musts:
• Name and version of spreadsheet appear on all
worksheets and print outs
• Generate an audit trail for all data entry or editing
• Spreadsheet is protected by privileges and/or by
protected access (unique username and password for
each user)
• All formulas must be protected
• General Method calculation is accurate.

10
URS (cont…)
– Needs
• Data design requirements: e.g. Data entry and results
are floating values displayed with one decimal place
• E.g.: Data entry should be by typing from a keyboard or
by copying/pasting a time/temperature history from
another file into unlocked cells.
• Access policy (need IT help)
• Configuration of software on your computer as a client
in your organization to access secured files with a
unique username/password combination.
• Configure computer to have a secured folder that
requires a unique username/password combination.

11
URS (cont…)
– Wants:
• E.g.: Data and calculated F-value should be displayed
in a table and in a graph.

12
Functional/Design Specifications (FDS)
• List all worksheets, custom toolbars, add-ins, and charts in
the work book.
• For each worksheet, define the following:
– Data entry fields, data range, labels, allowable values,
conditional formatting, etc…
– Calculations and equations that are programmed in the
cells

13
FDS (cont…)
• Define Macros, Add-Ins, Toolbars, and charts in the
workbook. Define requirements for the titles, labels, datasets,
axis.

14
FDS - Calculations
• Describe detailed calculations for all worksheets

15
FDS - Calculations
• - Worksheet 2: F-value calculation in SI units

16
FDS - Calculations
• - Worksheet 3: F-value calculation in US units

17
FDS - Security
• Details secure policies to access and have privileges for the
spreadsheet: company policies, computer policy.
• Typically, spreadsheet are protected in a company network or
a protected folder on a computer, where the access requires a
unique username/password combination.
– e.g.: Active Directory from Microsoft
– e.g.: Active Factory from Rockwell

18
FDS - Security

19
FDS - Security
- Use Encrypt with
Password to restrict
access.
- Define who are the users
that have access to the file.
- Need help from IT to
configure restrictions
- Ability to add digital
signatures.
- Need help from IT to
configure signing
certificates

20
FDS - Security
- Can protect individual
worksheet with password
- Can protect entire workbook
with password
- Protect the workbook after
configuring the audit trail - If the workbook is
with the “History” Tab in protected prior to enabling
Track Changes. This will the Track Changes, the
prevent anyone from History tab cannot be
tampering with the audit created.
trail.

21
FDS – Protection
• Spreadsheet must be protected to enable their ready retrieval
throughout their effective use:
– Backup and recovery SOP
– Disaster recovery SOP
– Data archiving SOP
– Record retention SOP
– Change control SOP (distribute change over 100 laptops)
– Periodic review SOP
– Training SOP

22
FDS – Audit trail
• Excel has a way to generate audit trails automatically.
• Under the Review Tab

23
FDS – Audit trail

• Under Track Changes Tab

24
 FDS – Audit trail
- Details of when, who, and what are recorded in the History Tab and
can be retrieved for inspection.

25
FDS – Audit trail
• As long as the workbook remains protected, the audit trail is
protected.
• Do not use headers or footers because they are not included
in the audit trail.
• Use header rows in the worksheet instead.

26
FDS – Electronic Signatures
• Have user sign memo of understanding that electronic
signature is the legal equivalent of a hand written signature.
• Keep memo signed by each user and his supervisor on file.
• Authentication VS Electronic Signature
• How to generate an electronic signature in Excel

27
FDS – Electronic Signature

28
FDS – Electronic Signature

29
Comments on 21 CFR Part 11 Compliance

• The feature is not really fully compliant with 21 CFR Part 11,
because you lose the audit trail if you need to generate an
electronic signature within the document.
• The amount of audit records is limited to 1,048,576 entries.
• In order to get your spreadsheet with a fully compliant audit
trail/electronic signature, you will need help from a software
developer to code macros and/or work arounds.

30
Comments on 21 CFR Part 11 Compliance

• http://www.ofnisystems.com/products/excelsafe/

• https://www.xybion.com/

• If you must have your spreadsheet in full compliance and you

do not have the skill set to have it done in house, there are
expert in this nitch.

31
FDS – Electronic Signature
• Once you complete your functions on your spreadsheet, print
it to a secured ACROBAT.PDF file that allows to insert
electronic signatures.

32
FDS – Electronic Signature

33
Installation Qualifications (IQ)
• Document test environment for spreadsheet: e.g. your laptop
outside your company network, company desktop on the
network.
• Verify that the file is in the correct location and is protected.
• Verify that the audit trail is setup to the correct retention time.
• Confirm security settings/configuration.

34
 Operational Qualifications (OQ)
• Test that spreadsheet is working as designed.
• Design test protocol to challenge all FDS requirements
• Prepare testing protocol on a tabular format to facilitate
execution and documentation of tests. Reference your test to
the corresponding URS and/or FDS.
Test Type Action Anticipated Actual Pass/Fail Comments
Results Results
Calculation Enter F-value = F-value = Pass / JB Insert screen shot and/or link to
accuracy problem 1 20.1 min 20.1 min file with results.

• Verify that audit trail is properly displayed in a separate

worksheet and that it cannot be modified.
• Verify that a password is required to unprotect the worksheet
and edit them.

35
OQ
• Data entry
– Unlocked cells
– Locked cells
– Verify that the appropriate cells are locked.

• Macros
• Chart

36
Performance Qualifications (PQ)
• Send your spreadsheet to your colleagues to test:
– One that knows the password to access the file
– One that does not know the password to access the
file
– One that has only reading privileges
– One that has editing privileges
– One that made changes or entered new
time/temperature data
• Compare results with a method that has already been
validated.
• Check that all URS are being met.

37
Training
• Train other users
• Challenge any newly trained user that have studied your
documentation and fill any gaps.
• Document training sessions through training records. Keep a
list of proficient users.

38
Document – Document - Document
• If it is not DOCUMENTED, your validation/compliance does
not exist!
• Documentation should be under revision control.
• Controls should be in placed to make sure that the most
recent version of the documentation is always used.
• When you have completed all the tasks listed above, you
spreadsheet is as compliant as it can be to mitigate the
deficiencies in the audit trail and electronic signing.
• You spreadsheet would be validated and secured.

• Ready to bring the outside auditor!?

39
• Questions?

40