Compliance
When Your Spreadsheet Starts Making GMP Decisions
Once a spreadsheet calculates pass or fail, status, or trend, it is no longer just a register. A practical look at what validation, evidence, and audit questions change once formulas start deciding GMP outcomes.
Most GMP spreadsheets start life as simple registers. Somewhere along the way, a formula gets added to save someone the trouble of checking a result against a specification by hand. That formula is usually welcomed as a convenience. It rarely gets treated as the moment the spreadsheet changed category.
This article is a practical interpretation of that scenario, not a validation protocol or a determination that any specific spreadsheet is compliant. Your organisation's own risk assessment and quality system remain the controlling references.
The scenario
Building on the calibration register example, imagine the same spreadsheet now also contains:
- Calibration values
- Specification limits
- Pass/fail calculations
- Equipment status calculations
- Trending data
A typical formula looks like this:
=IF(ABS(Result-Target)<=Tolerance,"PASS","FAIL")
Simple to write, and easy to trust once it has "always worked." But this formula is now making a GMP decision that a person previously made by comparing numbers manually.
The spreadsheet trap
Many organisations still describe a spreadsheet like this as "just Excel." In practice, it now determines:
- Equipment status (in calibration or out of calibration)
- Compliance status against specification
- Whether an investigation should be triggered
- Whether a batch, process, or piece of equipment is reviewed further
In our maturity model for GMP spreadsheets, this is a decision-support spreadsheet: Level 2. It is no longer acting as a register. It is acting as a small GMP application, built without the requirements, risk assessment, or testing that would normally accompany one.
Why validation expectations increase
Once a formula decides pass or fail, the questions an assessment needs to answer expand:
- Requirements: what is the formula supposed to do, and under what conditions?
- Risk assessment: what happens if the formula is wrong, and how would the organisation notice?
- Formula verification: has the formula been checked against known, expected results?
- Boundary testing: what happens at the edge of tolerance, with a blank cell, a negative number, or a rounding difference?
- Traceability: can a specific pass/fail decision be traced back to the values and formula version that produced it?
What an auditor might ask
A reasonable inspector or auditor reviewing a spreadsheet like this may ask:
- How were these formulae verified?
- How do you know the results are accurate?
- How are the specification limits controlled, and who can change them?
- What happens if someone edits the formula by mistake, and how would you know?
- Can you show me the version history for this file?
These are fair questions. A spreadsheet performing a GMP calculation deserves the same scrutiny that any other tool making that decision would receive.
The hidden cost
The cost of this stage is rarely visible on a project plan. It shows up as ongoing effort:
- Review effort, checking that formulas have not silently changed.
- Periodic review, re-confirming the spreadsheet still does what it was built to do.
- Retesting, whenever a specification limit, tolerance, or formula structure changes.
- Change control burden, tracking who changed what, and when, in a tool that was never designed for that purpose.
This effort accumulates quietly, and it tends to be highest for the spreadsheets that are relied on most.
A more proportionate path
The goal is not to panic and rebuild every spreadsheet with a formula in it. It is to recognise that a decision-support spreadsheet needs a different level of evidence than a register, and to decide, deliberately, whether Excel remains the right platform for that decision once the ongoing effort is counted. The Spreadsheet Trap: Why SharePoint Can Be Easier to Validate Than Excel compares that ongoing effort directly using the same calibration example.
If your spreadsheet can determine pass or fail status, it may require significantly more validation than you expect. A GMP spreadsheet assessment can help classify the risk and identify what evidence is genuinely needed.
Book a discovery call to discuss a spreadsheet that has started making GMP decisions.