Published on 01/08/2026

Compliance Risks Associated with Spreadsheet Change Control in the Indian Pharmaceutical Sector

Why This Schedule M Topic Matters

The Revised Schedule M of the Drug and Cosmetic Rules outlines stringent guidelines for Good Manufacturing Practices (GMP) in India, which includes expectations around data integrity and quality controls. Given that spreadsheets are widely used for data management in pharmaceutical operations—from GMP documentation to data recording—they represent a critical point of compliance risk. Failure to control spreadsheet changes adequately can lead to disparities in documentation and operational data, impacting product quality, compliance, and ultimately patient safety.

Common Compliance Weakness

Compliance weaknesses linked to spreadsheet change control often stem from several core issues:

• Lack of Version Control: Without clear versioning, it is challenging to track changes, leading to misuse of outdated data.
• Uncontrolled Access: Spreadsheets that lack appropriate access controls can be altered by unauthorized personnel.
• Inadequate Change Documentation: Changes that are not properly documented can disrupt traceability and accountability.
• Formula and Function Vulnerabilities: If formulas are not adequately protected, alterations can go unnoticed, skewing results.

Better GMP / Schedule M Approach

A more effective GMP approach includes a well-defined spreadsheet change control policy that complies with Revised Schedule M expectations. This should encompass:

• Implementing rigorous access controls to restrict modifications to authorized personnel only.
• Establishing a clear version control system wherein each modification is logged with timestamps and user identification.
• Employing formula protection measures to ensure critical calculations remain unaltered.
• Maintaining a robust audit trail that captures all changes, allowing for easy tracking and review.

Risk-Based Control Considerations

In line with risk-based GMP principles, it is essential to perform a risk assessment that evaluates the potential impact of spreadsheet modifications. Considerations should include:

• Data Criticality: Assess if data generated from the spreadsheet is critical for regulatory compliance.
• Potential for Error: Evaluate the likelihood of errors occurring due to unintended changes.
• Mitigation Strategies: Develop strategies to mitigate identified risks, such as regular audits and training sessions.

Documentation, Training and CAPA Strategy

To ensure compliance with Schedule M, organizations must promote a culture of data integrity through comprehensive documentation and training, supplemented by corrective and preventive actions (CAPA) when issues arise. Strategies include:

• Creating detailed Standard Operating Procedures (SOPs) for spreadsheet use and change control.
• Providing regular training sessions for staff on the importance of spreadsheet integrity and data handling practices.
• Implementing a robust CAPA process to address and document findings from any non-compliance issues related to spreadsheets.

Inspection Relevance

CDSCO inspections are likely to focus heavily on data integrity and compliance with GMP standards related to documentation. Spreadsheets can become a focal point during audits, and failure to demonstrate robust change control mechanisms can lead to significant compliance violations. Inspectors will likely review how changes are documented, access controls enforced, and the overall impact of spreadsheet errors on product quality and safety.

Evidence and Effectiveness Check

To ensure that spreadsheet change control measures are effective, regular checks should be put in place. Evidence of compliance can be established through:

• Retaining documented change records in a format that is easily accessible for review.
• Conducting routine audits of spreadsheet practices and controls.
• Performing independent reviews of critical spreadsheets used in production or quality control.

QA Review Questions

Below are key questions for Quality Assurance teams to consider regarding spreadsheet change control compliance:

• How is version control implemented within spreadsheets used for critical data management?
• What access controls are in place to prevent unauthorized changes?
• Are all changes clearly documented and tracked in accordance with SOPs?
• What measures are taken to protect the integrity of key formulas and calculations?
• How frequently are spreadsheets audited for compliance with GMP requirements?

Practical Example or Sample Wording

For practical application, consider the following sample wording for a policy on spreadsheet change control:

“All changes to authorized spreadsheets must be documented in the change log, which includes the date of modification, the identity of the person making the change, a description of the change, and the reason for the change. Any unauthorized modifications will be subject to investigation under the CAPA program.”

Conclusion

Spreadsheet change control is a fundamental aspect of maintaining compliance with Revised Schedule M in the Indian pharmaceutical industry. By identifying common compliance risks and implementing strategic controls, organizations can enhance their data integrity practices, ensure compliance, and ultimately protect product quality and patient safety. Regular training, thorough documentation, and ongoing effectiveness checks will strengthen the overall GMP framework and prepare your organization for successful inspections.