{"id":5343,"date":"2024-12-10T20:44:26","date_gmt":"2024-12-10T20:44:26","guid":{"rendered":"https:\/\/complyguru.com\/en-ie\/?p=5343"},"modified":"2025-01-24T12:41:33","modified_gmt":"2025-01-24T12:41:33","slug":"practicalities-of-performing-spreadsheet-validation-under-iso-13485","status":"publish","type":"post","link":"https:\/\/complyguru.com\/en-ie\/practicalities-of-performing-spreadsheet-validation-under-iso-13485\/","title":{"rendered":"Practicalities of performing Spreadsheet Validation"},"content":{"rendered":"

When we last left off at Spreadsheet Validation (part 1<\/a>), we had covered the various standard and regulatory requirements that apply to spreadsheet validation and the types of spreadsheets that require validation.<\/p>\n

Now, as promised, part 2.<\/p>\n

Spreadsheet Validation under ISO 13485<\/h2>\n

Starting with determining criticality classification, we will also examine the relationship that exists between criticality classification and likelihood or occurrence of failure (Complexity Classification) and how this contributes to the risk assessment of the spreadsheet under validation to determine the level of validation required.<\/p>\n

Finally, the approach to spreadsheet validation will round out the topic and hopefully illuminate the process for you, the reader!<\/p>\n

Criticality Classification<\/h3>\n

Criticality Classification starts with understanding the risk management process associated with the spreadsheet validation.\u00a0 We do, after all, work in an industry where \u201cproportionate to risk\u201d is ingrained in our very fiber.<\/p>\n

So much so, that ISO 13485<\/a> specifically mentions ISO 14971 in Section 3 \u2013 Terms and Definitions and again at Clause 7.1 where an organization is required to have one or more processes for risk management established, implemented and maintained as part of their Quality Management System (QMS).<\/p>\n

The risk process should look loosely familiar to you all: Identification, Evaluation, Classification.<\/p>\n

Once these three steps have been completed, its time to Mitigate.<\/p>\n

Identification involves determining and documenting the hazards associated with the use of the spreadsheet, Evaluation is determining the severity of the identified hazard, Classification means categorizing the risk according to severity and finally Mitigation represents performing activities that reduce the severity or the likelihood of the risk.<\/p>\n

Criticality Classification is broken into three level \u2013 Low, Medium and High.\u00a0 Sounds easy, right.<\/p>\n

But sounding easy is not exactly useful unless you understand what is involved in each of the levels.<\/p>\n

High Criticality represents direct impact to patient safety, product quality, or the integrity of the associated data.<\/p>\n

Medium Criticality corresponds to an indirect impact to patient safety, product quality, or the integrity of the associated data, and to absolutely nobody\u2019s surprise.<\/p>\n

Low Criticality signifies no impact to patient safety, product quality, or the integrity of the associated data.\u00a0 Let\u2019s break down this understanding further.<\/p>\n

What type of information falls into each of these categories?<\/h3>\n

High Criticality includes:<\/p>\n