Version 2.0 · Updated 2026-09-21 · Assessment
Assess the GxP use, formulas, data, protection, independent verification, change control, and periodic review of a spreadsheet.
Adapt this template to your intended use, applicable requirements, and approved procedures.
When to use it
For new, changed, inventoried, or periodically reviewed spreadsheets used in regulated work.
- Controlled workbook and intended decision
- Authoritative formulas, data sources and acceptance limits
- Version/access controls and independently calculated results
Field instructions
- Workbook and owner: Identify the system/service or process, version and accountable roles. Specify the scope and supporting record rather than relying on a product name alone.
- Intended use: Describe the specific task, users, outputs and decisions supported. Identify the assessed environment and limits of reliance.
- GxP record or decision: Name the output or controlled record, its recipient and the decision that relies on it. Include acceptance limits or retention needs where relevant.
- Inputs and sources: Identify authoritative sources, receiving systems and record identifiers. Describe supported formats, units, timing, transformations and error handling.
- Calculations and rules: Identify the approved rule and authoritative source. Include units, identifiers, rounding, missing values and exceptional paths that could change the result.
- Outputs and acceptance limits: Name the output or controlled record, its recipient and the decision that relies on it. Include acceptance limits or retention needs where relevant.
- Formula and input protection: Identify authoritative sources, receiving systems and record identifiers. Describe supported formats, units, timing, transformations and error handling.
- Access and version control: Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
- Independent verification: Identify the independent basis for the expected result and who checked it. Avoid deriving both the actual and expected result from the same unverified logic.
- Boundary and error testing: State what is outside the assessed use or evidence. Explain the consequence and any restriction; do not treat missing information as a pass.
- Change control and incidents: Record the issue, affected functions/records, impact, containment, action owner and resolution or expiry. Link correction and retest evidence; retain unfavorable results.
- Conclusion and periodic review: Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.
Define the specific system, service, change, population, and intended use.
Complete each field from available records and accountable interviews; record unknowns rather than guessing.
Link conclusions to affected GxP functions, failure scenarios, controls, evidence, and approval.
Adapt the structure to the organization’s approved procedures and document-control process.
Completed fictional example
Fictional teaching example; this is not an executed or approved validation record.
Blank template
System / record ID: ____________________
Prepared by / date: ____________________
Required review / approval under local procedure: ____________________
Relevant regulations and guidance
These sources apply within their stated scope. The suggested worksheet fields, test designs and fictional decisions are practitioner recommendations, unless a source requirement is expressly identified. Completing a template does not establish compliance.
Regulatory guidance / GMP guideline · United States · February 2026
Scope: Medical-device manufacturers assuring software used in production or their quality management system.
Relevance: For medical-device production or QMS software, supports selecting assurance activities from intended use, risk and available evidence. It is nonbinding guidance and does not determine other sectors’ obligations.
Status: Final / published · Checked 2026-09-21
Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Read source details and applicability →Regulatory guidance / GMP guideline · European Union · January 2011 revision
Scope: Computerised systems supporting activities in the applicable EU pharmaceutical GMP context.
Relevance: For computerised systems used in EU GMP activities, informs lifecycle, supplier and record controls. Confirm applicability to the actual activity; the example does not establish it.
Status: Final / published · Checked 2026-09-21
The Commission index confirms the January 2011 operative revision. The linked PDF could not be retrieved in this check; retained detailed section mappings need review against an authorized copy.
Read source details and applicability →