Validation of computer software (MS Excel, Word)

[Alfred88]

Dear all:
I am just curious if you have a dedicated department to do all the software validation for you (cGMP/GLP). Have you done validation for MS Word, and Excel, or just some validation for spreadsheets/worksheets (to be opened in e.g Open Office) to meet FDA's expectations.

The reason I am asking is because FDA has issued a Warning letter as follows:

(...) there was no software validation. No procedures are established to validate for its intended purpose the Microsoft Word or Microsoft Excel software (....)
(...)off-the-shelf software must be validated for its intended purpose(...)

The url is here: http://www.fda.gov/foi/warning_letters/s6338c.htm

And no COTS (commercial off the shelf) software package is perfect. Even MS Excel 2007 has its share of flaws:

What's 77.1 x 850? Don't ask Excel 2007
The flaw presents itself when multiplying two numbers whose product equals 65,535. Fire up your favorite calculator and multiply 850 by 77.1. Through the magic of zeros and ones, you'll quickly get an answer of 65,535. Those using the Excel 2007, however, will be told the total is 100,000. The program similarly fails when multiplying 11 other sets of numbers, including 5.1*12850, 10.2*6425 and 20.4*3212.5

See the article here: http://www.theregister.co.uk/2007/09/26/excel_2007_bug/

Any thought to remedy the deficiencies and to meet new FDA's expectations would be appreciated.

[DR]

My (limited) understanding:

True validation of a given software package requires (among other things) a source code audit. MS is not willing to reveal the source code to their applications, so you are limited in its use. For every spreadsheet or macro driven Word report, you are left with no alternative other than to either:
1) lock down the document so that its inputs are strictly limited
2) demonstrate that for reasonable inputs, you get the intended outputs and that for unreasonable inputs, you generate errors or unreasonable outputs (easy to catch, really unreasonable outputs, not just text/number errors).
3) Demonstrate that you have procedures in place for the generation, testing and management of said documents.
*and/or*
4) Review the output of all MS application generated documents with as much scrutiny as you would manual notebook entries and document same.

Since this is a huge pain in the rear, most labs that produce reviewable data use validated CDS software and adhere to vendor provided usage guidelines so that it operates only within validated parameters.

[Dan]

There was no group/department that validated Excel or Word files/spreadsheets where I have been. Usually, it is the people who design the file that get to validate it, with guidance from QA.

The validation procedures used are basically what DR has outlined. The only thing I would add is to make sure that you have proper control of each version of the file and use change control reports for those new versions.

I spoke with an FDA representative once who recommended that there be an SOP in place for the process. With the SOP, you wouldn't need a validation protocol for each file/macro/spreadsheet but you must have a validation report for each validation performed.

You can get further info at LabCompliance:

http://www.labcompliance.com/

By the way, I think that Microsoft has issued a patch to fix that bug in Excel 2007.

Regards,
Dan

[Fat Jonny]

We have validated custom in-house excel macros which turn raw data txt file outputs into pretty cal curves, tables, and graphs, but I think validating excel as a whole is a little OTT (even by our QA's standards ) and validating Word just seems pointless to me?

Just make sure you have document control which restricts/locks files once they are finalised, and use "track changes" in word when making edits/corrections.

For validated excel macros/spreadsheets, all cells are locked with the exception of those cells that need custom input.