Client
Small molecule CDMO
Service
Scope
Spreadsheet inventory, risk assessment and qualification
Trigger
GMP audit finding
Results Snapshot
A small molecule contract manufacturer engaged Terraforme Biosciences after an audit finding highlighted uncontrolled spreadsheet use in GxP workflows. We helped the team move from internal debate to a defensible, risk-based program that regulators and quality teams can stand behind.
- Completed a site-wide inventory of spreadsheet use across production and QC workflows.
- Classified spreadsheets using the GAMP 5 framework, with higher-risk treatment where macros were involved.
- Implemented quick-fix controls for low-risk spreadsheets, reducing validation burden while improving compliance.
- Fully qualified critical production and QC calculators using a computerized system validation approach, from URS through testing and release.
- Delivered an audit-ready response package and embedded ongoing controls into the client’s QMS through SOPs and policy.
Client Context
The client was a small molecule contract development and manufacturing organization (CDMO) operating under GMP, with both manufacturing and QC laboratory functions. Like many regulated sites, teams relied on spreadsheets because they are fast, flexible and familiar, especially for calculations, tracking and intermediate decisions.
The audit finding created urgency, but the bigger challenge was clarity: stakeholders had different views on what “spreadsheet validation” should mean, what level of control was reasonable, and how to respond without creating unnecessary bureaucracy or disrupting operations.
The Challenge
Spreadsheets Are Systems
When spreadsheets manipulate, transform or calculate GxP data, they become computerized systems. Under GAMP 5 they are commonly Category 4, moving toward Category 5 with macros and complex logic.
Document or Software?
Without a consistent rule set, teams either overreact by trying to validate everything, or underreact by treating high-impact calculators as informal tools.
Internal Disagreement
The audit finding forced a decision, but there was disagreement on the right path forward, both in approach and in the wording of the response.
Operational Reality
Any solution had to close the finding without slowing production and QC teams who depend on these tools every day.
What We Did
We worked with the client to move from uncertainty to a structured, risk-based program.
1
Inventory and Mapping
We mapped workflows and inventoried spreadsheet use by function and use case: manufacturing, QC calculations, tracking tools and review aids.
2
Classification and Risk Assessment
Each spreadsheet was categorized under GAMP 5 and risk-assessed for GxP impact, data integrity risk, likelihood of error, detectability and business consequence.
3
Quick Wins
Where possible, spreadsheets were controlled as documents rather than fully validated: locked or printed formula logic, tighter version control and standard templates.
4
Qualification of Critical Calculators
- Collected User Requirements Specifications (URS)
- Confirmed configuration and change control expectations
- Developed protocols and built requirements-to-test traceability
- Locked structure, controlled access and controlled versions
5
Audit Response and Governance
We helped draft a clear, defensible audit response and embedded ongoing governance through QMS policy, SOP updates and training.
The Approach
Our approach balanced compliance expectations with operational reality, grounded in three principles.
Risk-Based Control
Effort focused where spreadsheets had real GxP impact on product quality, release decisions or data integrity, not “validate everything.”
Document vs. Software Boundary
A consistent rule: if a spreadsheet applies automated logic to GxP data and its output drives decisions, it gets a higher level of control.
Sustainable Inside the QMS
Expectations embedded in policies, SOPs and training so the program runs through normal document and change control.
Deliverables
1
Spreadsheet Inventory Register
Tied to workflows and functional owners.
2
GAMP 5 Categorization and Risk Model
Rationale and risk ranking for spreadsheet use cases.
3
Risk Assessments
Templates and completed assessments for every identified tool.
4
Quick Control Package
Versioning, review and documentation approach for low-risk spreadsheets.
5
Qualification Packages
URS, test scripts and evidence, traceability and controlled release for critical calculators.
6
Governance SOP and Policy
Spreadsheet expectations integrated into the QMS.
7
Audit Response and Plan
Support package and implementation plan to close the finding.
8
Training Content
Aligning Quality, Operations and QC on the new expectations.
Lessons Learned
Spreadsheets become regulated systems faster than most teams expect. When they calculate or transform GxP data and drive decisions, intended use, control and evidence matter.
Combine quick wins with targeted validation. Templates, version control, locking and documented logic reduce risk fast; save full qualification for truly critical tools.
Alignment is half the work. Spreadsheets sit between Quality, Operations and IT thinking. A shared framework turns debate into action and makes the audit response easier to defend.
Facing a Spreadsheet or Data Integrity Finding?
We can help you build clarity, reduce risk and close findings with a defensible, sustainable program. Book a free consultation to discuss your goals and timeline.
