Spreadsheets in a GxP Environment

I have them, you have them, and chances are they are used in more ways than you know. The spreadsheet is a powerful tool and really ubiquitous. As such, spreadsheets are used in many ways in the GxP environment, which means they need to meet their intended use and be appropriately controlled. Spreadsheets must perform accurately and consistently, maintain data integrity, and comply with regulatory standards such as health agency guidelines and the GxPs.

That said, it can also be really easy to over-control spreadsheets. It is important to recognize that there is no one-size-fits-all approach.

It is important to build a risk-based approach from a clear definition of the scope and purpose of an individual spreadsheet. This includes identifying the intended use, the type of data a spreadsheet will handle, and the specific calculations or data manipulations it will perform.

I recommend an approach that breaks the spreadsheet down into three major categories. This should also apply to similar tools, such as Jira, Smartsheet, or what-have-you.

    Spreadsheet FunctionalityLevel of verification
    Used like typewriters or simple calculators. They are intended to produce an approved document. Signatories should make any calculations or formulas visible or explicitly describe them and verify that they are correct. The paper printout or electronic version, managed through an electronic document management system, is the GxP record.Control with appropriate procedural governance. The final output may be retained as a record or have an appropriate checked-by-step in another document.
    A low level of complexity (few or no conditional statements, smaller number of cells) and do not use Visual Basic Application programs, macros, automation, or other forms of code.Control through the document lifecycle. Each use is a record.
    A high level of complexity (many conditional statements, external calls or writing to an external database, or linked to other spreadsheets, larger number of cells), using Visual Basic Application, macros, or automation, and multiple users and departments.Treat under a GAMP5 approach for configuration or even customization (Category 4 or 5)
    Requirements by Spreadsheet complexity

    For spreadsheets, the GxP risk classification and GxP functional risk assessment should be performed to include both the spreadsheet functionality and the associated infrastructure components, as applicable (e.g., network drive/storage location).

    For qualification, there should be a succinct template to drive activities. This should address the following parts.

    1. Scope and Purpose

    The validation process begins with a clear definition of the spreadsheet’s scope and purpose. This includes identifying its intended use, the type of data it will handle, and the specific calculations or data manipulations it will perform.

    2. User Requirements and Functional Specifications

    Develop detailed user requirements and functional specifications by outlining what the spreadsheet must do, ensuring that it meets all user needs and regulatory requirements. This step specifies the data inputs, outputs, formulas, and any macros or other automation the spreadsheet will utilize.

    3. Design Qualification

    Ensure that the spreadsheet design aligns with the user requirements and functional specifications. This includes setting up the spreadsheet layout, formulas, and any macros or scripts. The design should prevent common errors such as incorrect data entry and formula misapplication.

    4. Risk Assessment

    Conduct a risk assessment to identify and evaluate potential risks associated with the spreadsheet. This includes assessing the impact of spreadsheet errors on the final results and determining the likelihood of such errors occurring. Mitigation strategies should be developed for identified risks.

    5. Data Integrity and Security

    Implement measures to ensure data integrity and security. This includes setting up access controls, using data validation features to limit data entry errors, and ensuring that data storage and handling comply with regulatory requirements.

    6. Testing (IQ, OQ, PQ)

    • IQ tests the proper installation and configuration of the spreadsheet.
    • OQ ensures the spreadsheet operates as designed under specified conditions.
    • PQ verifies that the spreadsheet consistently produces correct outputs under real-world conditions.

    Remember, all one template; don’t get into multiple documents that each regurgitate all the same stuff.

    Lifecycle Approach

    Spreadsheets should have appropriate procedural guidance and training.

    They should be under risk-based periodic review.

    Task Decomposition

    http://smbc-comics.com/comic/break-it-down
    Task Analysis

    Task decomposition is a systematic approach to breaking down a complex task into smaller, more manageable components. A more detailed version of task analysis helps organize work, improve understanding, and facilitate effective execution.

    Step 1: Understand the Task

    The first step in task decomposition is to fully understand the task at hand. This involves defining the main objective, identifying the final deliverables, and recognizing all the requirements and constraints associated with the task.

    Step 2: Break Down the Task

    Once the task is clearly understood, the next step is to break it down into smaller, more manageable parts. This can be done by identifying the major components or phases of the task and then further dividing these into subtasks.

    Techniques for Breaking Down Tasks:

    • Hierarchical Task Analysis (HTA): This involves creating a hierarchy of tasks, starting with the main task at the top and breaking it down into subtasks and further into individual actions.
    • Functional Decomposition: Focus on dividing the task based on different functions or processes involved.
    • Object-Oriented Decomposition: Used primarily in software development, where tasks are divided based on the objects or data involved.

    Step 3: Sequence the Tasks

    Determine the logical order in which the subtasks should be completed. This involves identifying dependencies between tasks, where some tasks must precede others.

    Step 4: Assign Resources and Estimate Time

    Assign the appropriate resources to each subtask, including personnel, tools, and materials. Additionally, estimate the time required to complete each subtask. This helps in scheduling and resource allocation.

    Step 5: Prioritize Tasks

    Not all tasks are equally important. Prioritize tasks based on their impact on the overall project, their urgency, and their dependencies.

    Step 6: Monitor and Adjust

    Once the decomposition and planning are in place, the execution phase begins. It’s important to monitor the progress of tasks, check adherence to timelines, and make adjustments as necessary. This might involve re-prioritizing tasks or re-allocating resources to address any bottlenecks or delays.

    Step 7: Documentation and Feedback

    Document the entire process and gather feedback. This documentation will serve as a valuable reference for future projects, and feedback can help in refining the decomposition process.

    Task decomposition is a dynamic process that may require iterative adjustments. Used well, it is a powerful tool in the quality toolbox.

    Curiosity

    To foster a culture of adaptability, engagement, and high performance on your team, you need to demonstrate consistent curiosity about your employees, yourself, and your organization. Here’s how:

    • Curiosity about employees. Organizations are a collection of the mindsets, attitudes, and values of the people that work within them. To shape your team’s culture, you need to understand people’s values and motivations. Talk to employees directly, formally survey them, or engage in focus groups about the team’s culture to tap into your collective wisdom.
    • Curiosity about yourself. As your culture evolves, you must too. Reflect with open-mindedness on your own role. Ask yourself: How have I evolved over time within this team and this organization? The better you understand your own position in the culture, the better suited you’ll be to lead and shape it.
    • Curiosity about the organization. Great leaders don’t just shape culture once—they stay curious about the changing nature of their companies and contexts over time. How have your organization’s mission, vision, and values changed? How has the personnel changed? And how have all of these factors affected the culture along the way? The more you understand your cultural context, the better equipped you’ll be to navigate it.
    • Curiosity about the domain: What are the changes in your field? What is current research? Regulatory shifts? Best practices? The more you understand the external landscape, the better equipped you are to establish a vision of excellence.
    Happy little boy holding glass with soap foam by David Pereiras from Noun Project (CC BY-NC-ND 2.0)

    ISO 9000 and 10000 Series and Quality Culture

    At the SQA’s Quality College, I presented a workshop on Quality Culture. In interests of time, I glossed over the ISOs and wanted to come back and treat them in more detail.

    ISO 9000 is a set of international standards on quality management and quality assurance developed to help companies effectively document the quality system elements needed to maintain an efficient quality system. Designed to be general in approach, they are not specific to any one industry and can be applied to organizations of any size.

    There are some 25 series 9000 standards, with the core for this topic being:

    • ISO 9000 Quality management systems -Fundamentals and vocabulary
    • ISO 9001 Quality management systems – Requirements
    • ISO 9004 Managing for the sustained success of an organization – A quality management approach

    The ISO 10000 series supports standards in the ISO 9000 series with more specific guidelines, there are several here relevant to the question of Quality Culture:

    • ISO 10010 Quality management — Guidance to understand, evaluate and improve organizational quality culture
    • ISO 10015 Quality Management – Guidelines for competence management and people development Training
    • ISO 10018 Quality Management – Guidelines on People Involvement and Competence