Unvalidated Spreadsheets
QC calculations and batch computations live in Excel files with no validation, no version control, and no access restriction. One broken formula, and the data behind it is indefensible.
Home / CSV Validation
Service · Computer System Validation
CSV for the systems quality actually runs on.
Your batch records, lab results, and environmental data live in software — spreadsheets, LIMS, monitoring platforms, ERP. If that software was never validated and its audit trails are never reviewed, your records are assertions, not evidence. We bring a risk-based GAMP 5 approach sized for mid-size manufacturers: enough rigor to satisfy an inspector, none of the enterprise overhead.
WHY NOW
Software is where records go to die.
Inspectors increasingly start at the keyboard, not the clipboard. These are the pressure points we assess first.
21 CFR Part 11Electronic records and signatures: the controls every computerized system holding regulated records must demonstrate — validation, audit trails, access, and authority checks.
GAMP 5The risk-based framework: validation effort scaled to product risk and system complexity. High-risk custom functions get rigor; low-risk commodity tools get leverage.
SpreadsheetsThe most common unvalidated system in any plant — QC calculations, stability data, batch computations running on files nobody owns, versions, or backs up.
WHERE IT BREAKS
The four system failures we see most.
Different plants, same pattern. Each one turns defensible records into findings.
LIMS and Monitoring Software Never Validated
The laboratory and environmental-monitoring systems were installed, configured, and put to work — but requirements were never written and testing never documented. The system works; the proof doesn't exist.
Audit Trails Enabled, Never Reviewed
Part 11 requires audit trails to be reviewed, not merely switched on. Nobody looks at them until an inspector asks who changed a result — and then nobody can answer.
Software Changes With No Control
Updates, patches, and configuration changes go live without impact assessment or re-testing. The validated state, if it ever existed, quietly expired months ago.
OUR METHOD
A risk-based CSV lifecycle, right-sized.
We follow the GAMP 5 lifecycle — plan, specify, build, verify, operate — scaled to your systems and your risk. No hundred-page protocols for a temperature logger.
System Inventory & GxP Impact
We catalog every computerized system touching quality records, assess GxP impact, and categorize by risk — so validation effort lands where the exposure is.
Requirements & Test Strategy
User requirements written in plain language, risk assessments that justify the testing depth, and traceability from requirement to test to result.
Scripted Testing & Evidence
Protocol-driven testing of configuration, security, audit trails, alarms, and calculations — with discrepancies investigated and resolved, not glossed over.
Lifecycle Controls
Access management, audit-trail review routines, backup and recovery verification, change control, and periodic review — the controls that keep the validated state alive.
WHERE IT APPLIES
One method, five industries.
Cannabis is our home base — the method was built there first. The same evidence discipline serves each industry below, mapped to its own regulations.
Food & Beverage
Preventive controls, supplier verification, environmental monitoring, and traceability under 21 CFR Part 117 and FSMA.
Dietary Supplements
Component qualification, master manufacturing records, and laboratory controls under 21 CFR Part 111.
Cosmetics
Safety substantiation, GMP records, and adverse-event readiness under MoCRA.
Pet Food
Preventive controls for animal food, supplier programs, and sanitation under 21 CFR Part 507.
QUESTIONS
CSV, answered.
Do our spreadsheets really need validation?
If a spreadsheet creates, calculates, or reports data used in quality decisions, yes — regulators treat it as a computerized system. We inventory them, risk-rank them, and validate the critical ones with locked templates, not bureaucracy.
We bought commercial off-the-shelf software. Isn't vendor testing enough?
Vendor testing proves the product works in general; it does not prove your configuration, your workflows, and your data are correct. We leverage vendor documentation to reduce — not replace — your verification.
What about cloud and SaaS systems?
Cloud systems are validated the same way, with added attention to vendor qualification, data integrity in transit and at rest, backup and recovery, and change notification. Shared responsibility has to be written down, not assumed.
How do you handle 21 CFR Part 11 audit trails?
We verify audit trails are secure, computer-generated, and time-stamped; that original records are preserved; and — the part most plants miss — that someone actually reviews them on a defined schedule.
Can you remediate after a 483 cites our computerized systems?
Yes. System-related 483 observations are a common trigger for our work. We assess the gap, build the missing validation evidence, implement the Part 11 controls, and sequence the response so the follow-up inspection finds closures.
Don't let the first gap be found under pressure.
Start with a free call about your computerized systems — what's validated, what isn't, and what an inspector would find. We'll name your top 3 GMP risks and give you an honest fit assessment. No pressure, no pitch.