Data generated from unqualified and uncontrolled Excel spreadsheets
Loss of Data Integrity • Spreadsheet Compliance
For example, your firm failed to have adequate procedures for the use of computerized systems used in the QC laboratory. At the time of the inspections, your QC laboratory personnel shared the same username and password for the operating systems and analytical software on each workstation in the QC laboratory.
In addition, no computer lock mechanism had been configured to prevent unauthorized access to the operating system. The investigator noticed that the current QC computer users are able to delete data acquired. In addition, the investigator found that there is no audit trail or trace in the operating system to document deletions.
Additionally, at the Aarti Drug Limited facility (FEI 3009688205), the investigator noticed that the use of the Excel® spreadsheets in analytical calculations are neither controlled nor protected from modifications or deletion. The investigator noticed that the calculation for residual solvent for [redacted] uses an Excel spreadsheet that has not been qualified. We are concerned about the data generated by your QC laboratory from non-qualified and uncontrolled Excel spreadsheets.
Compania Internacional de Comercio, S.A. de C.V. （2012年6月13日）
No verification of the accuracy of Excel spreadsheets
Pharmaceutical Manufacturer Software Validation Inadequate Spreadsheet
Specific violations observed during the inspection include, but are not limited, to the following:
1. Your firm has not established appropriate controls designed to assure that laboratory records include all data secured in the course of each test, including graphs, charts, and spectra from laboratory instrumentation, properly identified to show the specific component, drug product container, closure, in-process material, or drug product, and lot tested [21 CFR 211.194 (a)(4)].
Specifically, the inspection revealed that your firm has not established written procedures to control and account for electronically generated worksheets used by analysts to record analytical test results.
Analysts in your QC laboratory print an uncontrolled number of worksheets from computers throughout the QC laboratory without supervision.
For example,
a) The investigator found a certificate of analysis (COA) for (b)(4) oz, lot number (b)(4), dated January 19, 2011, in a trash container in the office used by QC personnel. This COA reported an assay value for (b)(4) of (b)(4)%. A second COA, dated January 21, 2011, filed with the analytical package for lot (b)(4), reported an assay value of (b)(4)%.
b) An analytical worksheet for (b)(4)oz, lot (b)(4), dated January 21, 2011, with no approval signature, was found in a trash container in the office used by QC personnel. This analytical worksheet shows calculations of content uniformity for active ingredient (b)(4) of (b)(4)%. The COA dated January 21, 2011 filed with the analytical package reports a content uniformity (CU) value of (b)(4)%. The CU value in the reference COA represents the analytical testing performed on a single in-process sample after the product has been (b)(4).”
Aubrey Inc. （2011年5月16日）
Did not validate use of an Excel Spreadsheet
Failure to Validate Software Medical Device Manufacturer Spreadsheet
Failure to validate software used as part of production or the quality system for its intended use according to an established protocol, as required by 21 CFR 820.70(i)
For example,
your firm did not validate use of an Excel spreadsheet used to calculate the Moisture Vapor Transmission Rate (MVTR) per test procedure [redacted] Revision B.
オリジナルのワーニングレター
Advanced Testing Laboratory, Inc. 2010年10月12日
Spreadsheet data entry cells not locked
Inadequate/Missing Procedures Loss of Data Integrity Pharmaceutical Manufacturer Spreadsheet
5.b. We observed 8 of 9 worksheets where one or more tabs with formula cells were not locked.
These worksheets were used for analyzing raw data from drug component and product samples, including [redacted].
Your firm’s SOP 100-G-0110, “Creation and Use of Templates,” stated that cells, in which data is entered, must be locked within their electronic template.”
オリジナルのワーニングレター
Medefil, Incorporated （2010年6月10日）
No Procedures for Controlling Laboratory Worksheets
Medical Device Manufacturer No Procedure for CAPA Spreadsheet
a. Your firm has no procedures for controlling laboratory worksheets including changes to worksheets, issuance of laboratory worksheets, and reconciliation of laboratory worksheets.
b. The worksheet “Internal Communication – Batch Release Information” by the warehouse, which is used to identify released product, was created after [redacted] documented release of finished product for Heparin I.V. Flush Syringes and Normal Saline I.V. Flush Syringes prior to obtaining media fill results. This sheet is used to communicate batch release information to warehouse operations. Use of this sheet is not documented in any Medefil procedure nor is control over this sheet documented.
オリジナルのワーニングレター
Capricorn Pharma, Inc. （2010年4月20日）
Spreadsheet Formulas are Unlocked
Loss of Data Integrity Pharmaceutical Manufacturer Software Validation Inadequate
Your firm has failed to exercise appropriate controls over computer or related systems to assure that changes in master production and control records, or other records, are instituted only by authorized personnel [21 C.F.R § 211.68(b)].
a) Your firm’s laboratory analysts have the ability to access and delete raw chromatographic data located on the [redacted] of [redacted] used to conduct HPLC testing. Due to this unrestrictive access, there is no assurance that laboratory records and raw data are accurate and valid.
b) Your firm’s laboratory analysts have the ability to access and modify the formulas in the Excel spreadsheets used to calculate assay results for Guaifenesin and [redacted] drug products. Due to this unrestricted access, there is no assurance that the formulas in the Excel spreadsheets are accurate and valid.
Your response appears to be adequate, but the effectiveness of the security features on your laboratory equipment will be verified at the next inspection.”
オリジナルのワーニングレター
Phoenix Bio-Tech Corporation （2009年10月5日）
Failure to Validate Spreadsheets
Computer System Failure to Validate Software Medical Device Manufacturer
3. Failure to validate computer software for its intended use according to an established protocol when computers or automated data processing systems are used as part of production or the quality system, as required by 21 CFR 820.70(i).
For example, when requested, no validation information or protocols were provided for the[redacted] software which is used for product complaints, CAPA requests/actions, preventive action request/actions, and creating quality logs.
We have reviewed your responses and have concluded that they are inadequate because a copy of your revised procedures and the Excel spreadsheet validation protocols/procedures and reports were not provided. It is unclear how you plan to document quality system records that were previously documented in the [redacted] system.”
Hill Dermaceuticals, Inc. （2009年4月27日）
Spreadsheet Calculations not Verified or Documented
Inadequate/Missing Procedure Pharmaceutical Manufacturer Software Validation Inadequate Spreadsheet
The notebook does not document reference to the spreadsheet calculation used to generate the results. In addition, the assay results generated by the spreadsheet were not verified for accuracy.
Your response dated February 16, 2009, states that you have established procedures to ensure that calculations of method validation studies are recorded.
The Records Management SOP, Section 5.7.4.7, states that the procedures shall define what and how data is to be recorded in respective logbooks.
However, this SOP omits instructions to include in the notebook the reference to the spreadsheet calculation used to generate the results, as well as the raw data and calculations. In addition, you continued to release products based on assay results generated by the spreadsheet that have not been verified for accuracy.
Quantimetrix Corporation （2007年5月17日）
Computer systems not validated
Computer System Failure to Validate Software Medical Device Manufacturer Spreadsheet
14) Software used as part of the production quality system was not validated for its intended use according to an established protocol [21 C.F.R. 820.70(i)]. Specifically,
(a) Spreadsheets intended to check for outliers and calculate mean, SC, % CV, value assignments for finished devices.
(b) Complaint handling software
(c) Quantrol database program”
TOSOH AIA, Inc. （2007年5月9日）
Failure to Validate MS Excel Spreadsheets
Computer System No Audit Trail Password Controls Missing Software Validation Inadequate Spreadsheet
the method for tracking (i.e. Microsoft Excel) the number of samples placed in the incubator was unauthenticated.
3. Failure to adequately validate the intended use of this PC and its software, as required by 21 CFR 820.70(i).
For example: the dedicated PC [redacted] attached to the [redacted] was not secure in that access to the data on [redacted] was not granted by a unique username and password or equivalent method; there as no documentation associated with the electronic data for whom was responsible for collection of the analytical results as several quality control personnel have access to the [redacted] no software changes in the study data could be detected as there was no audit trail capability; and finally, the electronic data did not correlate with the paper records.
Eldon Biologicals A/S （2003年12月23日）
Failure to Create Validation and CAPA Procedures (g4452d)
Computer System Failure to Validate Software Medical Device Manufacturer No Procedure for CAPA Spreadsheet
2. Failure to establish and maintain adequate procedures for implementing corrective and preventive action, as required by 21 CFR 820.100(a) and (b). For-example:
a. The procedure titled corrective Action Handling [redacted] was not approved and implemented to address corrective and preventive action and no established procedure was found to have been in place.
b. Microsoft 2000 Excel spreadsheet software used manufacturing has not been validated for the purpose of generating a worksheet for formulation of reagents. No documentation was found to establish or verify corrections made to the program.
A report dated November 11, 2002 on non-conforming material on [redacted] was filed and a possible cause for the [redacted] was given; however no documentation was provided to verify or validate the adequacy of the corrective and preventive actions.
Problems were recorded relating to the use of the new dosing/dispensing machine [redacted]; however no documentation/evidence was provided to verify or validate the adequacy of the corrective and preventive actions.”
EP MedSystems （2001年7月10日）
MS Access and MS Excel Not Validated
Database Failure to Validate Software Medical Device Manufacturer
Your firm failed to validate several computer databases that are used for quality functions including your Access database, your [redacted] software, and your MS Excel spreadsheet program as required by 21 CFR 820.70(i).
Sani-Pure Food Laboratories （2000年6月14日）
QC/QA Spreadsheets not Validated
Failure to Validate Software No Audit Trail Password Controls Missing Pharmaceutical Manufacturer Spreadsheet
b) There are no data to demonstrate that the quality control/quality assurance spreadsheets used for tracking and trending various quality metrics have been properly validated (installation qualification, operational qualification, and performance qualification) and are performing as intended.
2) Responses to Observations 3, 13 and 14 are considered inadequate because several pertinent documents which were referenced in your response were not submitted to the FDA including:
i) Spreadsheets used for Quality Control and Quality Assurance including tracking and trending which were included in a list of items for validation.”
MS-Excelに関する483フォームによる指摘
BioQuality, Vol. 14(9): Use of Uncontrolled Excel Spreadsheet
Tags: No Procedure for CAPA Password Controls Missing Spreadsheet
Uncontrolled Excel spreadsheetis used for:
• issuance of deviation numbers
• tracking deviations to closure
• trending deviation data
This has resulted in:
• CAPAs not always being linked to associated deviations
• Deviation priority levels not always being consistent
Validation of QC lab software failed to demonstrate adequate security:
• Analysts have the ability to overwrite original data
• No individual user names and passwords limiting access to the system
Comment