profile

The Daily HaiQu

How do you audit a regulated data processing spreadsheet? Part 1: Before I even open it.

Published about 1 year ago • 1 min read

When you're confronted with a spreadsheet full of data, how do you audit it? where do you start? What kind of things should you be looking for?

Let's say I'm seeing a data processing spreadsheet template for the first time. Before I even open up the spreadsheet, I want to ask a few questions:

  • What exactly am I looking at? Is it the spreadsheet file itself, or a printouts / PDF images of the spreadsheet? If it's an image, is it the complete record?
  • What's the use case for this spreadsheet? What kind of data are we processing? Does it directly affect the safety of a patient, quality of a product, or study data?
  • Does it come from an approved template, or is it a one-off designed around this particular data set?
  • How is the file controlled? Which version am I looking at? Can I tell if it's from the latest approved release?
  • Where did the data come from? Is any of it direct entry of original inputs?
  • Is it transcribed, imported, cut/pasted, or is that part uncontrolled?
  • Were the users trained on filling this spreadsheet with data?
  • Do I have access to the input data?
  • Is there an SOP or instructions governing the use of the spreadsheet?

Until next time, thanks for reading!

– Brendan

p.s. Enjoy this message? Read more at the Hyland Quality Systems website.

The Daily HaiQu

I'm Brendan Hyland. I help regulated facilities transform their software, spreadsheets, workflows and documents from time-consuming, deviation-invoking, regulatory burdens, to the competitive advantage they were meant to be. Join me every week as we take a few minutes to explore, design, test and improve the critical systems we use in our facilities.

Read more from The Daily HaiQu
A reporter interviews a smiling man holding a book.

I’ve seen several quality leaders complain this week about their disappointment with generative AI - they’re not getting the results they expected. And I understand why - context is king! If you just ask AI to write a procedure or generate a quality document, you’ll get generic, mediocre output. Without enough context, AI can only produce something generic based on its training data. But how do you give it that context? By the time you’ve gone back and forth trying to “engineer the prompt” to...

3 days ago • 3 min read
I'm presenting!

I'm excited to be presenting at the 2025 SQA Annual Meeting next week - "Is it the Right Tool for the Job? How QA and Regulatory Professionals can Guide Software Decisions in Regulated Environments" As our familiar software tools become more feature-laden and generalized, it's critical to ensure that software meets clear use cases and basic user requirements. And with generative AI being shoehorned into every platform, defining if and how software is appropriate for the intended use has never...

about 1 month ago • 1 min read

Last time we left off with a cliff-hanger of a question: How do you prove you're you when signing a document? There are several ways I've seen that the 3rd party providers prove that it's you who's signed the document: You clicked a link from an email. You paid for the service with a credit card. You provided some government issued photo ID. Someone, such as a notorized public or your HR department, has verified it's you in person. Obviously these are very different levels of assurance. Then...

about 1 year ago • 1 min read