Lacking integrity?

This is a pressing problem for many data controllers and quality managers highlighted by Terry Madigan, Senior GDP Inspector, MHRA I don’t believe it! – Terry Madigan, MHRA. There is some MHRA guidance which I will not repeat but should be reviewed MHRA Data Integrity Guidance. For now, let’s see what we can do today.

There have been several incidents demonstrating that the use of Excel can be non-compliant with the ALCOA+ Data Integrity principles. Read these to understand the problems: The Conversation: Excel errors and Jon Taylor: Improving data integrity and BBC: Excel, using Microsoft’s tool More specifically, you could look at the effect similar issues have on pharmaceutical companies in the US. Astrix: Enforcement Trends for FDA Data Integrity.

After reading these you may wonder if your use of spreadsheets can ever be compliant. Maybe you should stop the use of Excel altogether. Great idea, but not so easy in practice. A typical pharmaceutical wholesaler may have 10, 20 or more different Excel sheets being used by staff. Mostly these are trackers to keep an eye on what is happening and alert them to when they might be missing a target. Is this use acceptable? Maybe or maybe not. Let’s look in more detail at a five-step approach to achieving and demonstrating compliance.

A Five-step approach to managing the risk from use of spreadsheets

Step One: The single most important thing to do is to understand exactly when and how these are used in your organisation. Survey all staff to find out what spreadsheets they use and give yourself full visibility. Now that you know how these are used in your organisation you can begin to apply Quality Risk Management principles in line with GxP.

Step Two: Consider all aspects of the ALCOA+ Data Integrity principles. My suggestion for assessing the information held/processed applies the accepted ALCOA+ Data Integrity principles specifically to the use of Excel spreadsheets in a pragmatic way. Talk to staff using the spreadsheets and make notes on each of these aspects to help you with the next stage where you determine criticality and, hence, risk:

(A) Attributable: Is it always possible to establish who made each entry to the document, and when?

(L) Legible: Are all entries within the spreadsheet visible, including when printed or saved as a pdf?

(C) Contemporaneous: Is it each entry made at the time it takes place?

(O) Original: Is this the only location of that information or is the information held elsewhere as a ‘primary’ copy?

(A) Accurate: Does the information reflect the final information to be used or are there estimates, expectations, temporary figures/statements?

(C) Complete: Is the information meaningful as it stands or is complete information held elsewhere as a ‘primary’ copy?

(C) Consistent: Is the use of language, numbering and dates consistent and can always be interpreted in the same way? Check the cell format for suitability. Is the information organised in some way that can demonstrate when it is complete e.g. chronologically?

(E) Enduring: How long will this information be kept? Has consideration been given to the need to access the information in the future and how this would be done?

(A) Available: Can all relevant members of staff access the information when needed, now and in the future? Is it deleted or over-written at some point?

Step Three: Now determine the criticality of the information held and how this information is recorded, manipulated, saved and retrieved. You may need to define levels of criticality e.g. 1 to 5 (where 1 is low). You should now consider the risk in continuing to use the spreadsheet in that way. You may need to define several levels of risk e.g. 1 to 5 (where 1 is low). Use these to determine an Assessment level (Try using Low, Low to Medium, Medium, Medium to High, High)

Step Four: Now you will have a better understanding of each situation. You can now determine the course of action to follow. These are suggested actions for different assessment levels:

• Assessment level = Low (risk is low and there is no critical data and no critical information processes)
  Accept the risk. Use of the Excel sheet may continue with regular oversight.
  Assessment level = Low to Medium – reduce the risk. Consider some tips for better ways to improve Data Integrity. Focus on the points you have identified rather than randomly following tips.
  [A note on validation: You will need to validate the spreadsheet. The MHRA guidance MHRA Data Integrity Guidance offers some advice but does not tell you how to validate the system: “Computerised systems should comply with regulatory requirements and associated guidance. These should be validated for their intended purpose which requires an understanding of the computerised system’s function within a process. For this reason, the acceptance of vendor supplied validation data in isolation of system configuration and users intended use is not acceptable. In isolation from the intended process or end-user IT infrastructure, vendor testing is likely to be limited to functional verification only and may not fulfil the requirements for performance qualification. Functional verification demonstrates that the required information is consistently and completely presented. Validation for intended purpose ensures that the steps for generating the custom report accurately reflect those described in the data checking SOP and that the report output is consistent with the procedural steps for performing the subsequent review.”]
• Assessment level = Medium
  After consideration, you decide you must continue to use the spreadsheet. Mitigate the risk by limiting how the document is used and controlled. See above for validation.
• Assessment level = Medium to High
  After consideration you decide changing the way you use the spreadsheet will not reduce the risk sufficiently. Mitigate the risk by limiting how the document is used and controlled.
• Assessment level = High
  Find a different way to process the data/information.

Step Five: Record what you have done in the Quality System. The inspector will want to see how you made your decisions. Monitor the ongoing use of spreadsheets. Build your knowledge of what data your organisation holds and how it is handled. Your aim should be to develop a Data Integrity focus within your existing Quality Assurance processes. Ensure the old ways do not creep back.

Summary

This guidance is intended to address the use of spreadsheets such as Excel. Data Integrity requirements extend far beyond this. This guidance will, however, challenge your mindset and allow you to tackle a particularly problematic area in bite-sized chunks.

Looking for more help?

Here at SeerPharmaUK we are pleased to offer a ‘Principles of Computer Systems Validation’ Course run by Ian Lucas, our expert from SeerPharma in the APAC region.

Computer Systems Validation

SeerPharmaUK can now offer a full Computer Systems Validation service for your company. The service applies expertise in computerised systems with the expertise of former MHRA inspectors. Together these will focus on the diverse uses of software and hardware and how information is passed between them. Management processes to support these are also addressed, giving you confidence that computerised systems, and more specifically, your data and processes are compliant.