A spreadsheet used to track deviations, calculate a result, or maintain a traceability matrix is convenient, familiar, and almost always missing the structural controls Part 11 expects, an audit trail, access restriction, and protection against silent editing.
Nobody sets out to build a GxP relevant process on a spreadsheet. It usually starts as a temporary workaround, a quick calculation, a stopgap tracker, and becomes permanent because it works well enough and nobody circles back to replace it before it becomes load bearing.
No audit trail by default, anyone with the file can edit any cell without a record of who changed what, and version control usually means a filename with a date in it, which is easy to lose track of and trivially easy to overwrite by accident.
Start by inventorying which spreadsheets are actually being used for GxP relevant purposes, since this is often larger than compliance leadership expects. For each one, decide deliberately, replace it with a proper system, or add compensating controls, restricted access, a documented review process, that close the gap while a longer term fix is planned.
A short walkthrough of how GxPForge keeps traceability current as your team works, instead of reconstructing it before a release.
Book a demo