1Is Excel allowed in GMP?
Yes, under control. The US drug CGMP regulations allow computers and related systems “that will perform a function satisfactorily” to be used in manufacture, provided they are routinely checked under a written programme, and they require the input and output of formulas and data to be checked for accuracy.¹ EU GMP Annex 11 applies to “all forms of computerised systems” used in GMP-regulated activities,² and EMA’s GMP questions and answers on Annex 11 deal with spreadsheets directly: their templates, their accuracy checks and their validation.³
What regulators object to is an uncontrolled spreadsheet. In a December 2019 warning letter, FDA cited a firm that “failed to validate the Excel spreadsheet used to perform the assay calculation”. The investigator found an incorrect formula for averaging an internal standard’s peak area; the firm’s own review then found a transcription error in another result, for a batch already released. FDA wrote that the firm had not assessed the impact of “using data from unvalidated, unsecured spreadsheets for critical CGMP functions”.⁴
2How much validation a spreadsheet needs.
The depth follows the intended use and the risk. Annex 11 bases the extent of validation on “a justified and documented risk assessment”,² and FDA’s data integrity guidance treats each CGMP workflow on a computer system as an intended use to validate, to an extent “commensurate with the risk”.⁵ FDA’s Computer Software Assurance guidance for medical device manufacturers uses a spreadsheet as its example. Using basic entry functions to document a curing process’s time and temperature readings is low risk, and a vendor assessment with correct installation and configuration may be enough. A custom formula that calculates statistics to monitor whether the process is performing suitably may need further validation by the manufacturer.⁶
| How the spreadsheet is used | What the guidance expects |
|---|---|
| Recording values with basic entry functions | Low process risk in FDA’s example; vendor assessment, installation and configuration may be sufficient.⁶ |
| Formulas that calculate a result you rely on | Formulas and algorithms verified for correctness;³ input and output checked for accuracy, with the program and validation data on record.¹ |
| Custom code, such as Visual Basic for Applications macros | Validation under Annex 11 section 4 “is required at least” for these.³ |
| A template reused for each batch or test | Checked for accuracy and reliability, and stored under version control.³ |
| Graphing data held in a controlled system, with other controls in place | Not high process risk in FDA’s example; documented exploratory testing.⁶ |
3What validating a spreadsheet involves.
- List it. Annex 11 expects an up-to-date inventory of systems and their GMP functionality,² and PIC/S expects that inventory to record each system’s criticality and validation status.⁷
- State what it must do. User requirements describe the functions you rely on and rest on a documented risk assessment.²
- Verify the logic. Formulas and other algorithms should be verified for correctness, and sheets with custom code validated.³ Annex 11 asks for test scenarios that consider parameter limits, data limits and error handling.²
- Build the controls in. EMA expects calculations and files to be secured so formulas cannot be accidentally overwritten, and entry of the wrong data type, such as text in a numeric field, to be prevented or to raise an error. It encourages boundary checks.³ Critical data entered by hand needs an additional accuracy check, by a second person or by validated electronic means.²
- Record the evidence. FDA’s example record names the intended use, the risk analysis, the version tested, the test type and goal, each objective’s result and the deviation found.⁶
- Keep it validated. Changes go through change control, and the system is evaluated periodically to confirm it remains in a valid state.²
Results still need review. Drug laboratory records must include every calculation performed and a second person’s review for accuracy and completeness,⁸ and PIC/S expects that review to verify the calculations used and, where possible, check the original data.⁷
4Is Excel Part 11 compliant?
Part 11 sets its controls on “persons who use closed systems”: validation, accurate and complete copies, protection for retrieval, limited access, secure computer-generated time-stamped audit trails, and authority checks.⁹ Compliance is a property of a spreadsheet together with its controls and procedures, not of the product. FDA’s 2003 guidance says it intends to exercise enforcement discretion over the Part 11 requirements for validation and audit trails, but the predicate rules still apply, and it recommends basing validation on “a justified and documented risk assessment”.¹⁰
Whether Part 11 applies depends on which record you rely on. FDA reads it narrowly: when you use a computer to print a record, the paper meets the predicate rules and you rely on the paper, Part 11 is generally not triggered. If you rely on the electronic file, it is. FDA recommends deciding which in advance for each record and documenting it, for example in an SOP.¹⁰ FDA counts a spreadsheet whose formulas or entries a user can change as a dynamic record, and an electronic copy is a true copy only if it preserves the content and meaning of the original, including its metadata.⁵
PIC/S accepts that some very simple systems lack appropriate audit trails, but expects alternative arrangements to verify the data, such as administrative procedures and secondary checks. It discourages hybrid systems of electronic data supplemented by paper records and says they “should be replaced whenever possible”.⁷
5How it runs in Seal.
In Seal a calculation is part of the step that uses it, so its result stays with the batch, and selected tests run on each change prepared for review. The comparison with paper and spreadsheets sets the two approaches side by side, and the validation guide describes how each change is specified, tested and approved.
Where a workbook stays in use, Neil for Microsoft Excel reads its cells and formulas and returns each formula with the cells it reads, the formulas to check and why, and questions for the sheet’s owner. The connection is read-only until you accept edits, and Neil cannot save the file. Workbooks in an agreed fixed layout can be imported into Seal records through Seal’s API or Scripts.
References
- 121 CFR 211.68, Automatic, mechanical, and electronic equipment, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 68 (read 6 November 2026) - 2EudraLex Volume 4, Annex 11: Computerised Systems, European Commission, revision 1, in operation from 30 June 2011, principle and sections 1, 4.3, 4.4, 4.7, 6, 10 and 11. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 3Guidance on good manufacturing practice and good distribution practice: questions and answers, EU GMP guide annexes, Annex 11: Computerised systems, questions 1 to 3, EMA, February 2011. https:/
/ www. ema. europa. eu/ en/ human- regulatory- overview/ research- development/ compliance- research- development/ good- manufacturing- practice/ guidance- good- manufacturing- practice- good- distribution- practice- questions- answers (read 6 November 2026) - 4Warning Letter 320-20-10, Tismor Health and Wellness Pty Limited, FDA, 5 December 2019. https:/
/ www. fda. gov/ inspections- compliance- enforcement- and- criminal- investigations/ warning- letters/ tismor- health- and- wellness- pty- limited- 588104- 12052019 (read 6 November 2026) - 5Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018, questions 1.d, 3 and 9. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 6Computer Software Assurance for Production and Quality Management System Software, Guidance for Industry and FDA Staff, FDA, 3 February 2026, sections V.A(1) and V.A(6). https:/
/ www. fda. gov/ media/ 188844/ download (read 6 November 2026) - 7PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, PIC/S, 1 July 2021, sections 8.8, 9.3, 9.6 and 9.10. https:/
/ picscheme. org/ docview/ 4234 (read 6 November 2026) - 821 CFR 211.194(a)(5) and (a)(8), Laboratory records, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 194 (read 6 November 2026) - 921 CFR 11.10, Controls for closed systems, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- A/ part- 11/ subpart- B/ section- 11. 10 (read 6 November 2026) - 10Guidance for Industry: Part 11, Electronic Records; Electronic Signatures, Scope and Application, FDA, August 2003, sections III.B and III.C. https:/
/ www. fda. gov/ media/ 75414/ download (read 6 November 2026)
AQuestions and answers
Do we have to validate every spreadsheet?
Only the ones used for GMP work, and not all to the same depth. List them, assess what each one is relied on for, and validate in proportion: a sheet that records readings needs much less than one whose formulas produce a release result, and a sheet with macros is validated under Annex 11 section 4.
Is locking the cells enough?
No. Protecting formulas from being overwritten is one control. The formulas still have to be verified, inputs checked for the wrong data type and out-of-range values, templates kept under version control and changes made through change control.
Can we print the spreadsheet and sign the printout?
Yes, if the printout meets the record requirements and is the record you rely on; FDA then generally doesn’t apply Part 11. Decide that in advance for each record and write it into the procedure. The calculation behind the printout still has to be correct, so the spreadsheet is still validated.
Does a GMP spreadsheet need an audit trail?
If the electronic file is the record you rely on, Part 11 asks for secure, computer-generated, time-stamped audit trails. FDA has said it will use enforcement discretion on that requirement, but the predicate rules’ own record requirements still apply. Where a simple system can’t provide one, PIC/S expects alternative controls such as administrative procedures and second-person checks, and encourages moving to software that has audit trails.
What happens when someone changes a validated spreadsheet?
It goes through change control. Assess what the change affects, re-verify the changed formulas and anything that depends on them, and release the new version before it is used. The change record joins the validation documentation.