Spreadsheets, small databases, statistics packages and similar small end user applications used for GxP activities are specified and verified to a depth set by their risk, complexity, novelty and intended use, with spreadsheets given special attention because users treat them as part of the desktop and build them without quality procedures. Disposable spreadsheets used like a calculator are recorded as such with the values and result signed and the calculations verified through a printout of the cell formulas or an independent check by someone else; spreadsheets retained as documents are managed as documents with calculations verified and explained, controlled through cell or sheet protection, secure directories or an electronic document management system, or held as a static secure copy as the primary record, and comply with electronic record and signature regulations; spreadsheets used as databases lack edit restrictions and audit trails and are inadvisable where audit trails are needed, with a real database preferred; template applications have their manipulation understood and documented, calculations verified, single-location version control with change management, non-entry cells locked, macros treated as custom software, integration testing of linked sheets, external feeds configured, electronic record controls on saved output and a locked master under version control with numbering, edit and deletion protection considered; desktop databases may need external controls; and other tools are judged by how their data is used. All applications require risk assessment with controls and appropriate specification and verification, with the strategy based on impact, complexity and novelty, security against unauthorized change and change control. The tool is category 1 and the application sits on a continuum from category 3 for simple native calculations verified by another analyst or supervisor, through category 4 for branching logic, to category 5 for macros, nested logic or lookups, with category 4 redefined by complexity. Risk-based controls cover the degree of verification with branching and macros raising rigor and macros challenged in documented functional testing, security at application, data and operating system level using network drives with limited rights and backups, document management systems or unalterable copies and protected save paths, change control with change records describing the change, impact and testing and versions managed in a document system or code library, and control of the category 1 infrastructure under change and configuration management with release notes checked for user-installed software. Six worked examples range from a high-impact simple calculation template needing requirements, third-party verification, security and change control, to a high-impact complex clinical statistics spreadsheet with macros needing a full category 5 approach.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.