A spreadsheet has one modified-date, and it belongs to the file
A workbook keeps one timestamp: the last time the file was saved. It does not belong to any cell. Open CAPA_tracker_FINAL_v3.xlsx and you can see the values, the formulas and who last saved it. You cannot see who typed row 14, what row 14 said before, or whether the overdue formula in column H is the one that was approved or the one somebody pasted over it in March. When a second copy sits in a Downloads folder with two extra rows, and a third went out as an email attachment for approval, the site has three files and no record.
That is the mechanism behind most spreadsheet findings. The finding is never "they used Excel". It is that the quality record has no original, no author and no history the site can produce. The same mechanism applies to a training matrix, a deviation log, a change tracker or a supplier list. Document control is the same problem on a procedure; this post is the problem on the operating list.
Working file versus system of record
The useful distinction is not "Excel versus eQMS". It is what the file is for.
| Working file | System of record |
|---|---|
| A calculation you can reconstruct from the raw data | The place current status lives |
| A personal analysis, discarded after the decision | The place people approve against |
| A one-off extract from a governed system | The thing an inspector is handed |
| One author, short life, no one else depends on it | Shared, enduring, the site's memory of the work |
Excel is excellent at the left column. The Complere vs spreadsheets page is the short version of that split. This post is the longer one: what the regulations require once a workbook crosses to the right, how ALCOA+ fails inside a file that still looks tidy, and why the cost of "free" shows up as QA labour rather than a licence.
A spreadsheet used informally is not non-compliant. Once it is the operational system of record, it has to carry weight it was never built to carry.
What the regulations ask of a workbook that holds GxP data
None of the texts names Excel. Read together, they name a computerized system that creates or holds GxP records, and they ask the same things of it whether the interface is a form, a LIMS screen, or a workbook.
| Requirement | Where it sits | What it means for a spreadsheet |
|---|---|---|
| Only authorised people change records; input and output checked for accuracy; backup secure from alteration, erasure or loss | 21 CFR §211.68(b) | A shared file with "edit" for the department does not limit who can change a formula. Paste-over is an output that nobody checked. |
| Equipment (including computers) checked for proper performance; records of those checks kept | §211.68(a) | If the workbook calculates a release result, the calculation is in scope. "It is just Excel" is not a performance check. |
| Complete data from each test, including calculations, with who performed the test and a second-person review | §211.194(a)(4), (5), (7), (8) | A result typed into a sheet from an instrument printout, printout discarded, is not complete data. A formula nobody verified is not a reviewed calculation. |
| Validation; accurate complete copies; retrieval through retention; access limited to authorised individuals; computer-generated time-stamped audit trail that does not obscure prior values | 21 CFR §11.10(a)–(e) | These apply when the spreadsheet is the electronic record under a predicate rule. Native Excel does not produce §11.10(e). |
| Electronic worksheets version-controlled; changes documented and verified; data transferred onto a worksheet not altered, with an audit trail of the transfer | MHRA GxP data integrity guide §6.8 (March 2018) | Saving File_v4.xlsx next to File_v3.xlsx is not version control. A silent paste from LIMS into a sheet is a transfer with no trail. |
| Multiple users: who entered a value, whether it was overwritten, when it was entered; formulae defined, tested, protected, and re-confirmed in data-integrity review | MHRA Inspectorate, I don't believe it! (25 May 2018) | This is the inspector's own language for why a shared workbook fails ALCOA one letter at a time. |
Part 11 is not a spreadsheet regulation; it is an electronic-record regulation. If the predicate rule requires the record and you keep it in a workbook, §11.10 is in play. §211.68(b) does not wait for Part 11: authorised changes and checked input/output already describe the unlocked formula cell.
FDA has not been subtle about the lab version. ABC Testing (2019) cited missing software validation for Excel spreadsheets used to calculate assay results. Adamson Analytical Laboratories (2021) cited unvalidated worksheets whose cell formulas produced negative log reductions. The letters are about calculations used to support quality decisions, not about a Microsoft licence.
How ALCOA+ fails inside a tidy workbook
ALCOA+ in practice maps each attribute to a clause. A shared spreadsheet fails several at once, which is why it attracts findings even when every cell is filled in.
| Attribute | How a shared workbook typically fails |
|---|---|
| Attributable | The file is opened as a department share. Excel records "Edited by" at file level, not who changed cell D14, and not under a unique identity. |
| Legible | A later save overwrites the previous value. There is nothing left to read. |
| Contemporaneous | A row is back-filled on Friday for work done on Monday. The file's modified date is Friday. Nothing inside the cell says otherwise. |
| Original | Three copies exist. The "official" one is the one printed for the binder. The unofficial one on the shared drive had the failing result. |
| Accurate | A formula was overwritten by a hard-coded number, or a rounding step sits in a macro nobody tested. The sheet still "runs". |
| Complete | Linked emails, a training tracker, and the change record live in other files. The story of one CAPA is four exports. |
| Consistent | Two copies disagree and both look current. |
| Enduring | A personal copy in Downloads is the only place a row survives after someone "cleaned up" the shared file. |
| Available | Retrieval means finding the right filename among FINAL, FINAL_v2, and FINAL_USE_THIS. |
MHRA's GDP inspector put the first five of those in one paragraph in 2018, aimed at spreadsheets: with multiple users it may be impossible to tell who entered a value, whether it was overwritten, and when; without version control there may be different versions in use; formulae can be corrupted without anyone noticing. PIC/S PI 041-1 (in force 1 July 2021) applies the same ALCOA tests to paper, electronic and hybrid records.
Where a workbook breaks while it still opens and calculates
Seven mechanisms. Each leaves a file that opens, calculates and looks maintained.
1. The unofficial copy is where the truth was
Original data recorded in an uncontrolled spreadsheet on a shared drive, then transcribed onto an "official" form, is a well-worn inspection story. The unofficial file is the original. The official form is a copy, and if they disagree the site has a data-integrity problem it created for itself. FDA's data-integrity Q&A treats the first capture as the original; a transcription is not an upgrade.
2. The formula is the method, and nobody validated it
A cell formula that calculates assay, log reduction, overdue days or a risk score is a test method implemented in software. §211.68(a) asks for documented checks that the equipment performs properly. §211.194(a)(5) asks for a complete record of calculations. A workbook whose formulas have never been specified, tested across the range, or protected is an unvalidated method that still prints a number. The Adamson letter is this failure with the arithmetic showing: negative log reductions from unvalidated cell formulas.
3. Anyone who can open it can change the logic
§211.68(b) is about authorised personnel changing records. In a shared workbook the authorisation model is usually "everyone in the folder". Unlocking a sheet for data entry unlocks the formulas unless someone designed it not to. One paste of a value over a formula is silent. The sheet still displays a result.
4. Version history is a filename
_v3, _FINAL, _JK and an email attachment are not a revision history. There is no effective date, no withdrawn copy, and no way to answer "which file was in force on 12 June". That is the same gap document control has when the laminate on the line is two revisions behind the system. MHRA says electronic worksheets should be version-controlled and changes verified; a new filename is neither.
5. Approval lives in the inbox
A manager replies "ok" to an attached workbook. Six months later the attachment is not the file on the drive. The approval was never on the record, never dated against a version, never retained with it.
6. Training, change and the tracker don't share a story
A procedure revision sits in the document system, the training matrix in a workbook, the change request in a third file. "Were they trained on the revision in force?" means joining three lists by hand. Deviation, CAPA and change fail the same way when records don't link.
7. There is no trail to review
Why audit trails fail is about digital systems whose trails are off or never read. A native spreadsheet is simpler: there is no computer-generated cell-level trail that meets §11.10(e). File-level "last modified" is not who, what, when, and why. Track Changes is not an independent trail.
Download the spreadsheet-risk self-assessment and score the workbooks that still hold GxP data against those breaks. A file that opens and calculates can still fail every row.
The cost that wasn't on the licence
"Free" is a dangerous word in quality, not because the tool has no price tag, but because somebody always pays for it.
The licence for Excel is already on the machine. The cost is the work around the file: confirming which copy is current, rebuilding a history the file cannot produce, keeping a second tracker because nobody trusts the first, chasing signatures after the fact, lining up change, training and the CAPA by hand.
That labour lands on QA. It does not show up as a software line. It shows up as a day that should have gone on the investigation going on rebuilding a file history instead. Email, a shared drive and a separate training workbook feel practical until a revision, a deviation and a "were they trained?" question arrive in the same week.
An inspector does not care that the spreadsheet was free. They care whether the record survives being challenged. If the answer to "who pays for the cleanup?" is the quality team, the tool is not free. A connected system does not make quality free. It makes that cleanup smaller. We did not build Complere to replace one spreadsheet with a fancier spreadsheet. We built it because "free" tools become expensive the moment someone asks for proof.
What gets asked for, and in what order
They do not ask "do you use Excel?" They ask: the list that was current on this date; who changed this value and what it said before; whether the formula was the approved method; which copy is original; who approved this revision; whether operators were trained on the procedure in force. Those are §211.68, §211.194, §11.10 and the MHRA ALCOA list, asked in the order of the work in front of them. A governed system can fail them too. A shared workbook fails them by construction.
Compensating controls, and where they stop
MHRA is not anti-spreadsheet. The same inspectorate note that lists the ALCOA failures also lists the controls that can make a limited use acceptable:
- restrict spreadsheets to non-critical data
- lock cells and sheets so write access is limited to the input positions
- define, test and protect macros and formulae; re-confirm they are not corrupted as part of data-integrity review
- for low-frequency lists (a training matrix revised a few times a year, a supplier authentication log), print, approve, date and manage the paper as the controlled version — and then use that version, not the live file that created it
Those controls are real. They are also a lot of procedure wrapped around a tool that will not help you keep them. A locked template with a validated formula, issued as a controlled document, used by one person, with the output printed and signed, can be a defensible calculation. A multi-user CAPA tracker with email approvals cannot be made defensible by adding more cell protection. The test for any workbook you still rely on is short: can you show, from the file itself, which copy is original, who changed a given cell and what it said before, and whether the formulas are under change control? If not, the file is already the unofficial original, and the QA tax is already being paid.
Computer software assurance and GAMP 5 both scale effort to how much of the logic you wrote yourself. A workbook whose formulas are unique to the site is custom software in that frame: the regulated company owns the specification and the proof they work. "It is only Excel" is the category error. The application is infrastructure. The formulas are the method.
What still belongs in Excel
Keep the left column of the first table. Analysis of an extract, a one-off model, a personal working file that is not the record, a chart you will throw away after the meeting. The test is always the same: if this file disappeared tonight, could you reconstruct the quality decision from a governed record? If yes, Excel is still a working file. If no, it has become the system of record, and the rest of this post applies.
Moving the record does not mean banning the tool. It means the quality decision and its evidence live where history, approval and retrieval are properties of the work, and Excel goes back to thinking on paper.
How Complere holds the quality record
The record lives in one place. Current status is not a filename. When someone asks for the open list, there is one list, and earlier states of it remain readable.
Who did what stays on the action. Edits, reviews and approvals carry the person and the time, with what the record said before, so reconstructing a change means reading the record, not rebuilding it from three sources.
Approval sits on the record, not in a thread. A sign-off is part of the item it applies to. You do not have to find last Thursday's attachment to prove the version that was agreed.
Change, training and the event can be read together. A revision, the people trained on it, and the deviation that used it are linked, so "were they trained on the version in force?" is a question the record can answer.
Excel can go back to being a working file. Extracts and analysis still belong there. The quality decision does not.
Which processes may stay in a workbook, which formulas count as methods and how much assurance each one needs are still the quality unit's calls. The system's job is to keep the work you moved out of the tracker as one record, with its history attached.
