Adequate Change Control Key to Sustaining Validation Programs
Excel's ease of use makes it even more important for FDA-regulated life sciences companies to focus on spreadsheet change control, lest they undermine their overall validation efforts, ABB Principal Consultant David Harrison said Oct. 11 at an audioconference sponsored by FDAnews.
"I can't stress this enough," Harrison said. It is "so easy" for companies to overlook change control after they set up an otherwise strong computer system validation (CSV) program, he said.
Failing means that "everything is wasted" if even a small change is not controlled in the CSV program. And it is not uncommon for a pharmaceutical company to house tens of thousands of Excel spreadsheets in its computer system, he noted.
Ironically, it's a bigger problem for FDA-regulated life sciences companies because Excel makes it so easy for users to make changes. LIMS and others are more difficult to change so, in this case, they represent less of a threat to a CSV program, he said.
GxP Spreadsheets
When determining which spreadsheets require validation, Harrison said if the outcome or result of the information in the spreadsheet is used to make GxP decisions, it is probably necessary to validate it. "GxP spreadsheets usually perform an activity as well as report a result," he said.
Getting this right is also a big issue in part because the majority of GxP critical spreadsheets likely fall under the purview of 21 CFR Part 11, Harrison noted, adding that his company's analysis found:
Use of Excel is usually not incidental to the gathering of data; and A GxP spreadsheet that performs an activity or reports a result has to be maintained in electronic form to perform its intended function.
Spreadsheet validation requires several core deliverables, including: validation and project planning, a user requirements spreadsheet, risk assessment, spreadsheet development or reformatting, a functional specification spreadsheet, spreadsheet qualification and testing, and compliance and procedural control maintenance.
Understand User Requirements
The basic foundation of a CSV program is determining the user requirements. The user requirements specification (URS) document should state clearly what you want in terms of functionality as well as process and procedural needs, Harrison said. It should also state why you want and need these specifications.
The URS is the basis for design work and validation, particularly functional testing, he added. A URS is also important because "if it is not specified it won't get done, or if incorrectly specified it will be done incorrectly," he said. And the cost of fixing a change escalates the further the project moves ahead, he said.
Testing spreadsheets is also important, Harrison said. He advised devoting more time to the actual testing rather than composing complex testing scripts. "Use risk-based judgments for any assumptions, [and] be prepared to explain them," he said.
That means being flexible but also consistent. "Document your learning as you go along" and develop a testing guidelines standard operating procedure document.
To order a CD of the audioconference, go to www.fdanews.com/wbi/cds/2475-1.html (http://www.fdanews.com/wbi/cds/2475-1.html). -- Michael Causey