"Excel is bad for compliance" is technically imprecise — the honest answer is more specific, and more useful. Excel can, in narrow cases, be validated for a defined calculation-only purpose. What it consistently fails to do, without extensive and fragile custom controls, is serve as a full system of record for GxP data.
The concrete violation triad
FDA 483 observations regularly cite three specific, related failures in spreadsheet-based systems:
- Uncontrolled spreadsheets — no version lock, meaning multiple copies can exist with no single "current" version.
- Missing audit trails — no tamper-evident record of who changed what, when.
- Undocumented e-signature procedures — approvals via email or verbal sign-off, with no record meeting Part 11's Subpart C requirements.
The "hidden compliance tax" of a patchwork system
A combination of SharePoint, Excel, and Dropbox often feels agile and low-friction day to day — but it carries what's been well described as a hidden compliance tax: the real cost only surfaces when an inspector asks a question the patchwork can't answer quickly, like "show me every open CAPA" or "prove this record wasn't edited after the fact."
Can Excel be validated at all?
Yes, narrowly. A specific spreadsheet template, used for a single defined calculation, with locked formula cells and a documented, tested validation record, can be treated as a validated tool for that specific purpose — this is a legitimate, if limited, use case under a risk-based (GAMP 5) approach. What doesn't scale is treating a general-purpose, unlocked spreadsheet as the system of record for CAPA tracking, calibration schedules, or batch release documentation — the exact uses where audit trail and access control matter most and Excel provides neither by default.
A documented, real-world cost
Manual document tracking without a compliance management system has been estimated at consuming 15-20 hours per week of quality-team time — hours spent searching, reconciling, and manually reconstructing records that a system would simply retrieve.
Ready to see this in your own lab? Book a free ValiCore demo.