08 Feb Pioneers in Spreadsheet Risks
Quick quiz: Who was the first agency to raise concerns about the use of spreadsheets in environments where controlled documents are required?
The banking industry? A Financial Industry regulator? Sen. Paul Sarbanes and Rep. Mike Oxley?
No, it was the UK VAT authorities (HMCE) and the Food & Drug Administration (FDA) in the USA.
In 2000, Ray Butler of Her Majesty’s Customs and Excise (HMCE) was one of the founders of the European Spreadsheet Risk Interest Group (EuSpRIG), and the unique feature of the VAT authorities’ approach was that spreadsheet audit was seen not as a cost but as a means of increasing revenue.
Around the same time, in the USA the FDA were issuing warning letters about the uncontrolled use of spreadsheets. These warnings had compelling force, in that the FDA has the power to immediately shut down a pharmaceutical plant that is not compliant with regulations such as their Title 21 Code of Federal Regulations documents “Current Good Manufacturing Practice” and “Current Good Laboratory Practice”.
Dennis Cantellops of the San Juan District of the FDA issued a “Spreadsheet Design, Verification and Validation, Use and Storage of Single-User Workbook Files in the US FDA Laboratories”, which is still worth reading and the guidance note is available at:
Volume III – 4.5 Development and Validation of Spreadsheets for Calculation of Data
Today, we find that warnings are still sometimes needed, as reported recently by PharmaTechnologist:
“Data integrity issues have landed Italian drugmaker FACTA Farmaceutici with a US FDA warning letter.”
Here’s an extract from the letter itself:
“You stored original data in an ‘unofficial’ and uncontrolled electronic spreadsheet on a shared computer network drive,” the Agency said. “Your analyst stated that original data was first recorded in this ‘unofficial’ spreadsheet and transcribed later to an ‘official’ form. This spreadsheet showed failing results above the limits you established in your procedure, PCH 035 Visible Particle Determination in use prior to September 1, 2014.”
Unlike some Excel certifications which only teach what button to click, the Spreadsheet Safe training and certification programme requires participants to have the skills of checking and cross-checking, but also to be consciously aware of their responsibility, and that of their organsiation, when using spreadsheets.
Spreadsheet Safe Syllabus refereneces:
220.127.116.11 Be aware that spreadsheets may need to be controlled as part of employer or regulatory requirements.
18.104.22.168 Recognise that spreadsheets may be controlled records and subject to archive requirements in legislation.