Skip to main content

Deterministic In-Browser Spreadsheet Qualification

Order Dossier (€149 + VAT)

Which standard is your spreadsheet used under?

Choosing a tab changes the examples, the sample workbook and the clause references on this page. The Dossier format is the same.

For accredited inspection bodies, testing and calibration laboratories, and medical device manufacturers

ISO/IEC 17020:2026 · Clause 7.5, control of data and information

ISO/IEC 17025:2017 · Clause 7.11, control of data and information management

ISO 13485:2016 · Clauses 4.1.6, 7.5.6 and 7.6, software validation proportionate to risk

The spreadsheet validation template that fills itself in.

A validation template gives you headings and 30–40 hours of tables to fill in by hand. NormXL does the work instead, in about three minutes. It reads your Excel workbook inside your browser and recalculates every formula with an independent engine. It tests every decision cell at its limits, audits locks and buried constants, and seals the file with SHA-256. Then it writes the 20+ page Dossier your assessor or auditor expects: requirements, risk assessment, IQ, OQ, boundary tests and release record. 0 KB of your workbook uploaded. €149 + VAT.

Wall thickness, pressure rating, proof load, remaining life: the calculators your transition assessment will ask about.

Calibration curves, uncertainty budgets and results against limits, benchmarked against NIST StRD.

Lot release, Cpk, test-method and ageing calculators, validated in proportion to their risk.

  • Every formula recalculated, not just listed
  • Test vectors your engineer can check by hand
  • A SHA-256 seal your assessor can verify with one command
Order Your Validation Dossier — €149 + VAT

€149 + VAT per spreadsheet · 0 KB of your workbook uploaded

Download Sample 24-Page Dossier (PDF)

No installation · No admin rights · Runs in your browser's sandbox · No AI, no cloud · 0 KB of your workbook uploaded

From blank template to completed DossierOn the left, a blank validation template whose test table is empty, with 30 to 40 hours of work remaining. After NormXL runs in the browser, the same table on the right is filled in with executed tests, including two failed tests, and the workbook's SHA-256 fingerprint in the header.Typical validation template (.docx)OQ Test Script30–40 h remainingTest IDInputPass/FailInitialsExpected resultActual result0 tests executedNormXL · runsin your browserrecalculatetest limitsaudit locks &constantssealSHA-256 28a815ee…8ac260d1OQ Test ScriptTest IDInputPass/FailInitialsExpected resultActual resultOQ-014C33=4.72, D33=4.62Test failedACTIONNO ACTIONstored difference 0.099999999999999645OQ-015tmTest passed4.50535714285714314.5053571428571431OQ-016UT reading = "N/A"Test failedREJECTACCEPTFrom blank template to completed DossierOn the left, a blank validation template whose test table is empty, with 30 to 40 hours of work remaining. After NormXL runs in the browser, the same table on the right is filled in with executed tests, including two failed tests, and the workbook's SHA-256 fingerprint in the header.Typical validation template (.docx)OQ Test Script30–40 h remainingTest IDInputPass/FailInitialsExpected resultActual result0 tests executedNormXL · runs in your browserrecalculatetest limitsaudit locks & constantssealSHA-256 28a815ee…8ac260d1OQ Test ScriptTest IDInputPass/FailInitialsExpected resultActual resultOQ-014C33=4.72,D33=4.62Test failedACTIONNO ACTIONstored difference 0.099999999999999645OQ-015tmTest passed4.50535714285714314.5053571428571431OQ-016UT reading ="N/A"Test failedREJECTACCEPT
  • =IF(10.2-10.1>=0.1,"ACTION","NO ACTION") → NO ACTION
  • LRE = −log₁₀(|x − c| / |c|)
  • SHA-256(workbook.xlsx)
  • t = P·D / [2(S·E·W + P·Y)]
  • t = P·R / (S·E − 0.6·P)
  • RL = (tactual − trequired) / CR
  • LRE = −log₁₀(|x − c| / |c|)
  • AU = TU − w
  • uc(y) = √Σ(ci·u(xi))²
  • Cpk = min[(USL − x̄)/3σ, (x̄ − LSL)/3σ]
  • AAF = Q₁₀((TAA − TRT)/10)
  • LoD = LoB + cp·sL

Your formulas, recalculated by an independent engine and tested where they decide.

Structured for the bodies that assess and audit you

  • UK — UKAS
  • Australia — NATA
  • Netherlands — RvA
  • Nordics — Swedac · DANAK · NA · FINAS
  • DACH — DAkkS · TÜV SÜD
  • UK — UKAS
  • Australia — NATA
  • Netherlands — RvA
  • Nordics — Swedac · DANAK · NA · FINAS
  • Germany — DAkkS
  • UK — UKAS
  • Australia — NATA
  • Netherlands — RvA
  • Nordics — Swedac · DANAK · NA · FINAS
  • Poland — PCA
  • Germany — DAkkS
  • UK — BSI · MHRA · UK Responsible Person
  • Europe — BSI · TÜV SÜD · DEKRA (EU MDR / IVDR)
  • Australia — TGA · MDSAP
  • Canada — Health Canada · MDSAP
  • Global export — FDA QMSR-aligned

Structured for the assessments of UKAS, NATA, RvA, Swedac, DANAK, Norsk akkreditering, FINAS and DAkkS, and for the audits of European Notified Bodies and MDSAP Auditing Organisations.

See the full country–authority matrix
Country / regionISO/IEC 17020 (inspection)ISO/IEC 17025 (laboratories)ISO 13485 (medical devices)
United KingdomUKAS · HSE statutory examinations (LOLER, PSSR)UKASBSI (UK Approved Body 0086) · MHRA · UK Responsible Person
AustraliaNATANATATGA · MDSAP
NetherlandsRvARvAEU Notified Bodies (EU MDR / IVDR)
SwedenSwedacSwedacEU Notified Bodies
DenmarkDANAKDANAKEU Notified Bodies
NorwayNorsk akkreditering (NA)Norsk akkreditering (NA)EU/EEA Notified Bodies
FinlandFINASFINASEU Notified Bodies
GermanyDAkkSDAkkSTÜV SÜD · DEKRA · other Notified Bodies
Austria · SwitzerlandAkkreditierung Austria · SASAkkreditierung Austria · SASEU Notified Bodies · Swissmedic framework
PolandPCAPCAEU Notified Bodies
Canada——Health Canada · MDSAP
Global exportILAC MRA signatories (Global ACI)ILAC MRA signatories (Global ACI)MDSAP · FDA QMSR-aligned

In the UK? See the UK Compliance Hub →

Named only to identify the accreditation and regulatory frameworks NormXL dossiers are structured for. NormXL is independent and is not affiliated with, endorsed by or approved by any of these organisations.

See what an assessor would see in your spreadsheet, without it leaving this tab

Drop a calculation workbook, or try the sample for your standard. The scan runs in your browser. For your own file, the browser computes its SHA-256 fingerprint and a quick count of formulas, locks and constants locally, and nothing is sent anywhere. The sample shows the findings a full Dossier documents.

Drop your .xlsx or .xlsm template here

100% client-side · 0 KB of your workbook transferred

or use the sample workbook for ISO/IEC 17020:2026ISO/IEC 17025:2017ISO 13485:2016

Check it yourself: open your browser's network monitor (F12 → Network) and drop a file. Nothing is transmitted.

  • Reading the Office Open XML package locally…
  • Computing SHA-256 of the exact bytes…
  • Rebuilding 41 formulas from their syntax trees…
  • Testing decision cells at their limits…
  • Auditing locks, protection and constants…
  • Reading the Office Open XML package locally…
  • Computing SHA-256 of the exact bytes…
  • Rebuilding 19 formulas from their syntax trees…
  • Testing decision cells at their limits…
  • Auditing locks, protection and constants…
  • Reading the Office Open XML package locally…
  • Computing SHA-256 of the exact bytes…
  • Rebuilding 3 formulas from their syntax trees…
  • Testing decision cells at their limits…
  • Auditing locks, protection and constants…

B31.3_Wall_Thickness_Sample.xlsx SAMPLE WORKBOOK

SHA-256 28a815ee b5a86f43 6546c770 2ea8702f f1fc66cb 77d15a42 d511af50 8ac260d1

41 formula cells · 8 unique formulas · 2 worksheets · computed in this tab

3 assessor red flags · 2 more findings

  1. Calc!F33 IEEE 754 precision drift

    Calc!F33 =IF(C33-D33>=0.1,"ACTION","NO ACTION") (CML-04: 4.72 mm → 4.62 mm)

    The wall loss is exactly 0.10 mm on paper. Excel stores 0.099999999999999645, so the cell returns NO ACTION at your 0.10 mm action threshold.

  2. Calc (sheet) + Inputs!C9 Unlocked formula cells

    Sheet Calc is not protected: all 41 formula cells can be overtyped, and nothing would change colour.

    Inputs!C9 (quality factor E) has no data validation and accepts any value.

  3. G14 · H22 · H23 · F30:F41 Buried hard-coded constants

    4 numeric literals with no source, in 15 formulas: 0.4 (Y coefficient) in Calc!G14 · 1.5 (corrosion allowance) in Calc!H22 · 0.875 (mill under-tolerance) in Calc!H23 · 0.1 (action threshold) in Calc!F30:F41.

    When the material, the temperature or your procedure changes, these values don't.

Also found

Display ≠ decision: Calc!H22 prints the minimum wall as 4.5 mm and stores 4.5053571428571431. G35 compares the stored value, so CML-06's 4.50 mm reading is rejected while the sheet shows 4.5 against 4.5.

Text accepted as a reading: "N/A" for CML-07 returns ACCEPT in Calc!G36. MIN(D30:D41) skips it, and its wall-loss and interval-action cells show #VALUE!.

Ran in this tab · 0 requests carrying workbook data · 0 KB of your workbook uploaded

Ozone_Monitor_Calibration_Norris.xlsx SAMPLE WORKBOOK

SHA-256 49f01f7c 616e721c ee25cfa3 4f1bc4fa f27e2f76 ad5bff52 4515c57f d66639cb

19 formula cells · 9 unique formulas · 7 worksheets · computed in this tab

3 assessor red flags · 3 more findings

  1. Check!F9 IEEE 754 precision drift

    Check!F9 =IF(ABS(B9-C9)>=0.1,"RECALIBRATE","OK"): a span-check reading of 10.2 against a reference of 10.1 is exactly 0.1 apart on paper, yet Excel returns OK.

  2. Curve!D4:D14 Unlocked formula cells

    The 11 formula cells in Curve!D4:D14 are unlocked and the sheet is not protected. The calibration curve can be overwritten without trace.

  3. Budget!E9 Buried hard-coded constants

    Budget!E9 =STDEV.S(C4:C8)/SQRT(5)*2.776 hard-codes five replicates and the t-factor for four degrees of freedom. Add a sixth replicate and the expanded uncertainty is silently wrong.

Also found

Report!G12 decides conformity on the unrounded result while the report prints one decimal place (a result of 10.04 prints as "10.0" against a 10.0 limit and is declared non-conforming) · Import!C2:C37 is read by position · six "<0.05" entries in Results!C2:C40 are skipped by AVERAGE(), which averages 33 of 39 results.

Ran in this tab · 0 requests carrying workbook data · 0 KB of your workbook uploaded

Cpk_LotRelease_Sample.xlsx SAMPLE WORKBOOK

SHA-256 b12ca05d fa31e275 054bc638 2adeeefe 515bd608 8efb4ea1 3aa7eab5 71463fe7

3 formula cells · 1 worksheet · computed in this tab

3 assessor red flags · 2 more findings

  1. Release!G4:G5 IEEE 754 precision drift

    Release!G4 shows Cpk 1.33 and stores 1.3299999999999794 (x̄ 10.0001 mm, s 0.0100 mm, Ø 10.00 ± 0.04 mm). =IF(G4>=1.33,"RELEASE","HOLD") holds a lot that is exactly 1.33 on paper.

  2. Release (sheet) Unlocked formula cells

    Sheet Release is not protected: the Cpk and release formulas can be overtyped.

  3. Release!G4:G5 Buried hard-coded constants

    USL 10.04 and LSL 9.96 are typed into the Cpk formula, and 1.33 into the release rule. A drawing revision will never reach them.

Also found

The lot-record value in Release!G7 prints 1.33 for a held lot · Whether s in C6 is a within-subgroup or an overall standard deviation decides whether G4 is Cpk or Ppk, and the workbook doesn't say.

Ran in this tab · 0 requests carrying workbook data · 0 KB of your workbook uploaded

This scan ran in your browser. Your workbook was not uploaded, logged or stored.

Generate the full Dossier — €149 + VAT Preview the first three pages of the sample Dossier →

Why a blank validation template is the most expensive free download in quality management

Search for "spreadsheet validation template" and you will find Word and Excel protocol kits priced anywhere from free to about €500. They give you the headings: User Requirements, Risk Assessment, IQ, OQ, Test Script, Expected Result, Actual Result, Signature. They do not give you a single expected result. A template is a promise to do 30 to 40 hours of work.

Assessors and auditors are not grading your headings. They are asking three questions:

  1. Show me how you proved this formula calculates correctly, including at the limits.
  2. Show me that nobody can change it without you knowing.
  3. Show me that the file in use today is the file you validated.

A template answers none of them. Evidence does.

Someone still has to do the work behind the headings:

  • inventory every formula;
  • work out by hand what each one should return;
  • decide which inputs to test at which limits;
  • check every cell lock;
  • find every constant typed into a formula;
  • take the screenshots.

For a typical engineering or laboratory calculation spreadsheet, that is 30 to 40 hours of a specialist's time. The resulting test covers only the cells someone thought to check.

That matters, because spreadsheets are rarely as clean as they look. Raymond Panko's widely cited review of spreadsheet-error research found errors in most of the operational spreadsheets that were audited, with typical error rates in the order of 1 to 5 per cent of formula cells. In a workbook with 400 formulas, that is not a theoretical risk.

Then an engineer changes one formula, and the whole hand-built document describes a spreadsheet that no longer exists.

NormXL fills in the protocol by doing the work:

  • every formula recalculated independently;
  • every decision cell tested at its limit and one step either side;
  • every lock, constant and data-validation rule listed;
  • the whole record bound to the exact file by its SHA-256 fingerprint.

You review it, complete the intended-use statement that only you can write, and sign. That is the part of validation that needs your judgement. The rest is arithmetic and typing, and arithmetic and typing are what software is for.

What a complete spreadsheet validation protocol contains, and who fills it in

Protocol sectionA blank template gives youNormXL fills in
§1 User requirements & scopeA heading and a paragraph to writeInputs, outputs and decision cells detected from the file; your intended use and rounding rule, captured in a few questions
§2 Risk assessment & traceabilityAn empty matrixEvery output classified by its effect on the result; every requirement traced to the tests that cover it
§3 Installation qualification"Record software version"File identity and SHA-256, the application that last saved the file, every formula, every constant, links, hidden sheets and calculation settings
§4 Operational qualificationBlank expected and actual columnsExpected values from an independent engine, Excel's stored values, and the difference, for every recalculated cell
§5 Negative & boundary tests"Describe challenge tests"Generated vectors at every limit, plus text, blanks, zeros and negatives in every input, with the observed result
§6 Precision & protectionNot in most templatesDisplay versus decision at every comparison; the lock and protection map
§7 Release & version controlA signature blockRe-validation triggers, the version log and your approval block, bound to the file's fingerprint
Blank validation templateExternal validation consultantNormXL
Cost per spreadsheet€0–€500 for the template, plus 30–40 h of your time€2,000–€5,000 (about €3,000 is typical)€149 + VAT
Time to evidence1–3 weeks of interrupted work4–8 weeks, including procurementAbout 3 minutes, plus your review
Who works out the expected resultsYou, by handThe consultant, by handAn independent engine, for every formula cell; any exception is listed
Boundary and negative testsWhatever you think ofDepends on the consultantAt every acceptance limit, plus text, blanks, zeros and negatives
Display versus decision precisionRarely checkedSometimesEvery decision cell
Locks, protection and buried constantsManual, partialManual, sampledEvery cell, listed
Proof of which file was validatedA file name and a dateA file name and a dateSHA-256 fingerprint on every page
Client data leaves your premisesNoYes, under NDANo: 0 KB of your workbook uploaded
Re-validation after a changeDo it againA new quoteIncluded on the Annual Register
What the assessor can verifyYour word and your screenshotsThe consultant's report and reputationEvery number: by hand, or with one command
Risk if an assessor or auditor samples itGaps you didn't know to look forDepends on the scope you paid forEvery limitation listed in the Dossier, so nothing is hidden

Illustrative ranges from published price lists and typical consultancy rates (€1,300–€1,800 a day). Prices exclude VAT.

The cost ledger and the template illusionThree ways to validate a spreadsheet: a blank template costing up to €500 plus 30 to 40 hours of your own work over one to three weeks; an external consultant at €2,000 to €5,000 over four to eight weeks; or NormXL at €149 plus VAT in about three minutes plus your review.priceyour effortelapsedevery formula recalculatedboundary & negative testsdecision-cell precisionSHA-256 identityworkbook stays on site Blank template€0–€50030–40 h1–3 weeks Consultant€2,000–€5,000briefings, access, reviews4–8 weeks NormXL SHA-256€149 + VAT≈ 3 min + 30–60 min reviewthe same sitting dependsIllustrative ranges · VAT excluded except where shownThe cost ledger and the template illusionThree ways to validate a spreadsheet: a blank template costing up to €500 plus 30 to 40 hours of your own work over one to three weeks; an external consultant at €2,000 to €5,000 over four to eight weeks; or NormXL at €149 plus VAT in about three minutes plus your review. Blank templateprice€0–€500your effort30–40 helapsed1–3 weeksevery formula recalculated boundary & negative tests decision-cell precision SHA-256 identity workbook stays on site Consultantprice€2,000–€5,000your effortbriefings, access, reviewselapsed4–8 weeksevery formula recalculated boundary & negative tests decision-cell precision SHA-256 identity workbook stays on site NormXL SHA-256price€149 + VATyour effort≈ 3 min + 30–60 min reviewelapsedthe same sittingevery formula recalculated boundary & negative tests decision-cell precision SHA-256 identity workbook stays on site dependsIllustrative ranges ·VAT excluded except where shown

Excel is commercial software. Your workbook is your configuration.

Every standard you work to separates the application from what you build in it. Excel used within its designed application range can be leveraged as off-the-shelf software. Your formulas, look-ups, limits and decisions cannot: they are configuration, and configuration has to be validated for its intended use before you rely on it, and again after it changes.

ISO/IEC 17025:2017 · Clause 7.11

Note 2 to Clause 7.11.2 treats commercial software in general use as sufficiently validated. The same clause requires laboratory configuration, and any change to it, to be authorised, documented and validated before implementation. Clause 7.11.6 requires calculations and data transfers to be checked "in an appropriate and systematic manner".

ISO/IEC 17020:2026 · Clause 7.5

The 2026 edition gives the control of data and information a standalone clause. Systems that handle inspection data have to be validated for their intended use before use, re-validated before changes are implemented, and protected against unauthorised access, tampering and loss.

ISO 13485:2016 · Clauses 4.1.6, 7.5.6 and 7.6

Software used in the quality system, in production and in monitoring and measurement is validated before initial use and, as appropriate, after changes, with an approach "proportionate to the risk associated with the use of the software".

In GAMP® 5 terms, the vocabulary most validation specialists share: Excel as installed is Category 3 · a template with your formulas and limits is commonly treated as Category 4 · custom VBA moves it towards Category 5. The second edition treats these categories as a continuum, not boxes.

Five traps that are invisible on screen, and obvious to an assessor or auditor

None of these is a bug in Excel. Each is a property of how spreadsheets store, display and protect numbers, and each one turns into a finding when nobody has tested for it. The example under each trap changes with the standard you selected above.

Trap 1 · The displayed value is not the value that decided

Excel stores numbers as IEEE 754 binary64 values. It displays at most 15 significant digits, and it rounds whatever you format, but only on screen. Two different things go wrong here.

Display rounding hides a real result. A cell formatted to two decimals shows 10.00 for a stored 10.004. If the decision compares the stored value, the printed record and the decision disagree. If it compares a rounded value, the rounding rule is buried in a cell format that nobody validated. Cell formatting is not a decision rule.

The binary residue flips results that sit exactly on a limit. Excel hides most residues: type =0.1+0.2=0.3 and Excel returns TRUE, because it compares numbers to about 15 significant digits. But a subtraction that cancels most of the digits can push the residue past that tolerance. Then a result that is exactly on the limit on paper falls on the wrong side:

=IF(10.2-10.1>=0.1,"ACTION","NO ACTION") → NO ACTION (widen the format: Excel shows 0.0999999999999996)

We tested twenty pairs of values exactly 0.1 apart in Microsoft Excel 16.0. Fourteen of the twenty returned NO ACTION. With a fixed reporting resolution, results land exactly on limits all the time. Without an explicit rounding rule, the binary residue decides those cases instead of your documented decision rule, in whichever direction the bits happen to fall.

Test: =IF(a-b>=0.1,"ACTION","NO ACTION") for 10.2−10.1, 3.3−3.2, 25.4−25.3, 37.6−37.5, 12.7−12.6, 5.3−5.2, 100.3−100.2, 0.3−0.2, 1.3−1.2, 2.3−2.2, 8.2−8.1, 4.6−4.5, 6.4−6.3, 9.7−9.6, 15.2−15.1, 0.2−0.1, 20.4−20.3, 7.9−7.8, 11.5−11.4 and 9.5−9.4. NO ACTION for all except 37.6−37.5, 0.3−0.2, 1.3−1.2, 6.4−6.3, 0.2−0.1 and 7.9−7.8. Microsoft Excel 16.0, default settings, 2 November 2026. A strict IEEE 754 evaluation gives fifteen: Excel's comparison tolerance rescues 0.3−0.2. That difference is why NormXL evaluates every decision both ways.

ISO/IEC 17020:2026

A minimum wall stored as 4.5053571428571431 mm prints as 4.5 mm. Compare rounded values and a 4.46 mm pipe is accepted; compare stored values and a 4.50 mm reading is rejected while the report says it meets the minimum.

ISO/IEC 17025:2017

A gravimetric result of exactly 35.0 mg/L is stored as 35.000000000025011 and fails a ≤ 35 mg/L limit while displaying "35.00".

ISO 13485:2016

A Cpk that is exactly 1.33 on paper is stored as 1.3299999999999794, so =IF(C_pk>=1.33,"RELEASE","HOLD") holds a capable lot.

What NormXL does:

  • evaluates every decision cell under Excel's conventions and in strict IEEE 754;
  • prints both operands to 17 significant digits;
  • records the rounding function, the side it applies to and the number of places kept;
  • flags every decision that depends on digits beyond the displayed precision.

Trap 2 · Unlocked calculation cells, and no evidence of tampering

In Excel every cell is formatted "Locked" by default, and the setting does nothing until sheet protection is switched on. In most working templates protection is off "for convenience". One keystroke replaces a formula with a typed number that looks exactly like a result, and nothing on screen changes colour. Sheet protection also guards only against accidents: it is not tamper evidence.

ISO/IEC 17020:2026

A joint efficiency of 0.85 overtyped with 1.00 in an unlocked cell raises a vessel's calculated pressure rating by 17.6 %: "derate" becomes "fit for service".

ISO/IEC 17025:2017

One cell in the calibration-curve block overtyped with a number: every later result uses it, and the curve still looks fine.

ISO 13485:2016

USL and LSL in unlocked cells: a release criterion changes with one keystroke and no change record.

What NormXL does:

  • maps the locked and hidden status of every formula cell, and the protection of each sheet and of the workbook structure;
  • flags formula ranges where one cell has become a typed value;
  • binds the whole Dossier to the file's SHA-256, which does make change evident.

Trap 3 · Constants buried inside formulas

=C5*C6/(2*(C7*C8*C9+C5*0.4))+1.5, =STDEV.S(C4:C8)/SQRT(5)*2.776, =730/2^((55-22)/10). Every number typed into a formula is a design decision without a label, a source or an owner. When the code edition, the uncertainty budget or the test protocol changes, the input cells get updated and the literals don't.

ISO/IEC 17020:2026

Y = 0.4 (B31.3 Table 304.1.1: ferritic steel up to 482 °C), mill under-tolerance 0.875, corrosion allowance 1.5, gravity 9.81: all typed into wall-thickness formulas.

ISO/IEC 17025:2017

A calibration intercept and slope from last quarter, typed into fifty result formulas; a coverage factor typed as 2 where the effective degrees of freedom need 2.28.

ISO 13485:2016

TRT typed as 22 °C in an ageing formula whose protocol says 25 °C: the chamber time comes out 17 days short.

Not every literal is wrong: the 2 in the B31.3 equation and the 0.6 in ASME's UG-27 are the code's own coefficients. But every undocumented literal is a finding waiting to happen.

What NormXL does: it extracts every numeric literal from every formula into a Constant Ledger, with the cell, the formula, the value and every occurrence, plus an empty "source" column for your reviewer. NormXL does not guess where your constants come from. It makes sure none of them can hide.

Trap 4 · No documented boundary or negative tests

Spreadsheets are tested on the happy path: realistic numbers, typed by someone careful. Production data is not like that:

  • Text such as "N/A" or "<0.05" is skipped by AVERAGE(), which silently changes n.
  • In a comparison, any text ranks above any number, so =IF(B22>=H22,"ACCEPT","REJECT") returns ACCEPT for a reading entered as "N/A".
  • A blank is zero, so =IF(B5<=10,"PASS","FAIL") returns PASS for a missing result.
  • IFERROR() turns a division by zero into a plausible number.
  • Data-validation rules set to "Warning" can be clicked past, and a paste bypasses them entirely.
  • Templates travel between countries, and Excel's regional settings travel with them. A label built with TEXT(value,"0.00") on an English-locale laptop breaks, or formats wrongly, when the same file recalculates on a machine whose decimal separator is a comma, as in the Netherlands, Germany, the Nordics or Poland. We reproduced #VALUE! in Excel 16.0 with Polish regional settings.
ISO/IEC 17020:2026

A corrosion rate of exactly zero: IFERROR(…,999) reports a remaining life of 999 years.

ISO/IEC 17025:2017

Ten replicates with one "OVR": AVERAGE() divides by nine, and the mean falls.

ISO 13485:2016

A tensile sample recorded as "SLIP" silently drops out of the mean; n = 1 makes σ undefined.

What NormXL does: it generates boundary vectors at every acceptance limit and one step either side, and injects text, blanks, zeros, negatives and out-of-range values into every input. The expected and actual results go into a negative and boundary stress-test log.

Trap 5 · No cryptographic provenance

"Calculation_v3_FINAL_new.xlsx, last modified Thursday 16:14" identifies nothing. Copies drift from laptop to laptop, and a "fix" made offline spreads. Years later, after an incident or a complaint, nobody can show which version produced which result.

ISO/IEC 17020:2026

Which version of the calculator produced the report of thorough examination issued in March?

ISO/IEC 17025:2017

Which version of the workbook issued the calibration certificate the customer is now disputing?

ISO 13485:2016

Which version of the release calculator released lot 24-117?

What NormXL does:

  • computes the SHA-256 of the exact bytes before anything else and prints it in every page header of the Dossier;
  • records the generation time in UTC beside it;
  • lets anyone, assessor included, re-hash the file with Get-FileHash, certutil or shasum and confirm that it is the validated version, years later and without NormXL.
One file, three fingerprintsThe same workbook in three states. As validated, its fingerprint matches the Dossier. Opened and saved without changes, its fingerprint changes although the formulas do not. With one constant edited, its fingerprint changes, a rejected 4.50 mm reading becomes accepted, and re-validation is required. Built-in operating-system commands recompute any fingerprint.As validatedB31.3_Wall_Thickness_Sample.xlsxSHA-256 28a815ee…8ac260d1Intended decision: matches theDossierRe-savedSHA-256 85937172…568d80d4Formulas unchanged, fingerprintchanged (save metadata)Observation: not the validated fileOn the Annual Register, NormXL comparesformulas to tell a re-save from a changeEditedSHA-256 862e33d0…2e484e78tm 4.5054 → 4.0054 mmCML-06 (4.50 mm): REJECT → ACCEPTrejected readings 1 → 0Finding: re-validation requiredopened and saved · nothing changedone constant edited: H22 =G14+1.5 → =G14+1.0Get-FileHash .\file.xlsx -Algorithm SHA256 · certutil -hashfile file.xlsx SHA256 · shasum -a 256 file.xlsxAny change to the bytes changes the fingerprint. Whether the change matters is what re-validation answers.One file, three fingerprintsThe same workbook in three states. As validated, its fingerprint matches the Dossier. Opened and saved without changes, its fingerprint changes although the formulas do not. With one constant edited, its fingerprint changes, a rejected 4.50 mm reading becomes accepted, and re-validation is required. Built-in operating-system commands recompute any fingerprint.As validatedB31.3_Wall_Thickness_Sample.xlsxSHA-256 28a815ee…8ac260d1Intended decision: matches the Dossieropened and saved · nothing changedRe-savedSHA-256 85937172…568d80d4Formulas unchanged, fingerprint changed (savemetadata)Observation: not the validated fileOn the Annual Register, NormXL comparesformulas to tell a re-save from a changeone constant edited:H22 =G14+1.5 → =G14+1.0EditedSHA-256 862e33d0…2e484e78tm 4.5054 → 4.0054 mmCML-06 (4.50 mm): REJECT → ACCEPTrejected readings 1 → 0Finding: re-validation requiredGet-FileHash .\file.xlsx -AlgorithmSHA256certutil -hashfile file.xlsx SHA256shasum -a 256 file.xlsxAny change to the bytes changes the fingerprint.Whether the change matters is what re-validationanswers.

One honest caveat: opening a workbook in Excel and saving it changes its bytes, and therefore its fingerprint, even if no formula changed. Keep the validated master read-only in a controlled location, and let users work on copies. On the Annual Register, NormXL compares any new version with the validated baseline at formula level, so a cosmetic re-save can be told apart from a real change.

Anatomy of a spreadsheet: five trapsOne ordinary wall-thickness sheet with five numbered traps: a hidden binary residue that suppresses an action, an unlocked quality-factor cell, constants typed into a formula, the text N/A accepted as a reading, and no way to prove which version was used, each paired with what NormXL does about it.Calculation_v3_FINAL_new.xlsxC10=C5*C6/(2*(C7*C8*C9+C5*0.4))+1.5ABCD456789101112131415161718Design pressure P5.0Outside diameter D168.3Allowable stress S138Quality factor E1.00Weld factor W1.00Minimum wall tm4.5Previous reading4.72Current reading4.62Wall loss0.10Interval actionNO ACTIONUT readingN/ADecisionACCEPTCalc1Excel shows0.0999999999999996→ NO ACTION2unlocked ·sheet not protected3literals 0.4 and 1.5 ·no source5which version?no fingerprint4"N/A" ranks aboveany number→ ACCEPTWhat NormXL does1evaluates decisions underExcel's rules and strict IEEE 7542maps every lock; seals the filewith SHA-2563lists every literal in the ConstantLedger4injects text, blanks, zeros andnegatives at every input5prints the SHA-256 in everyDossier page headerAnatomy of a spreadsheet: five trapsOne ordinary wall-thickness sheet with five numbered traps: a hidden binary residue that suppresses an action, an unlocked quality-factor cell, constants typed into a formula, the text N/A accepted as a reading, and no way to prove which version was used, each paired with what NormXL does about it.Calculation_v3_FINAL_new.xlsxC10=C5*C6/(2*(C7*C8*C9+C5*0.4))+1.5ABCD456789101112131415161718Design pressure P5.0Outside diameter D168.3Allowable stress S138Quality factor E1.00Weld factor W1.00Minimum wall tm4.5Previous reading4.72Current reading4.62Wall loss0.10Interval actionNO ACTIONUT readingN/ADecisionACCEPTCalc123541Excel shows 0.0999999999999996→ NO ACTION2unlocked · sheet not protected3literals 0.4 and 1.5 · no source4"N/A" ranks above any number → ACCEPT5which version? no fingerprintWhat NormXL does1evaluates decisions under Excel's rules andstrict IEEE 7542maps every lock; seals the file with SHA-2563lists every literal in the Constant Ledger4injects text, blanks, zeros and negatives atevery input5prints the SHA-256 in every Dossier pageheader

NormXL never runs your macros, never uploads your file, and never takes Excel's word for it

Engine A: what your Excel computed. Every saved .xlsx file stores, next to each formula, the value the saving application calculated. NormXL reads those cached values straight from the Office Open XML package, along with the application and version that last saved the file.

Engine B: what the formulas actually say. NormXL rebuilds every formula from its syntax tree and recalculates it in its own engine, written in Rust and compiled to WebAssembly, with statistical functions benchmarked against the NIST Statistical Reference Datasets. It then compares the two engines cell by cell under Excel's own calculation conventions: arithmetic to the last bit, regression statistics as correct significant digits (Log Relative Error). Where those conventions hide a binary residue, the strict IEEE 754 value is printed alongside.

Then it goes where agreement is not enough. Two engines that agree have reproduced the arithmetic. That does not make the decision right at the limit: a Cpk stored as 1.3299999999999794 is reproduced faithfully by both, and still holds the lot. So NormXL:

  • generates boundary vectors at every acceptance limit;
  • injects bad inputs into every input cell;
  • audits display-versus-decision precision, locks, protection, constants, volatile functions and external links;
  • screens VBA statically without ever executing it;
  • seals the result to the file with SHA-256.

Optionally, it writes the test vectors into a challenge copy that your own Excel executes. You drop the saved copy back, and NormXL records your Excel's results next to its own.

  1. 0:00 Drop the workbook. SHA-256 of the exact bytes, computed locally.
  2. 0:05 Parse and recalculate. Every formula rebuilt and recomputed; Excel's cached values compared.
  3. 0:40 Boundary and negative vectors at every limit, in every input.
  4. 1:10 Structure audit: locks, protection, precision, constants, links, VBA (static).
  5. 1:30 You answer a few intended-use questions: what the spreadsheet decides, your rounding rule, reviewer and approver.
  6. ≈3:00 Download the Dossier: PDF for the record, DOCX for your document control.
  7. Then You review and sign under your own procedure, typically 30 to 60 minutes for a calculation template.
The dual-engine flowTwo engines read the same workbook: the values Excel saved, and NormXL's independent recalculation. They are compared cell by cell, then boundary, negative and precision tests run before the Dossier is sealed with SHA-256, all inside the browser.your browser · 0 KB of your workbook leaves it.xlsxEngine A · cached values,as saved by Excel<v>3.0053571428571431</v>Engine B · NormXL recalculation(Rust → WebAssembly) ·NIST StRD-benchmarkedcell by cell, underExcel's conventions ·LRE for statisticswhere agreement is not enoughboundary vectorsnegative injectionsprecision &protection auditDossier ·SHA-25628a815ee…8ac260d1The dual-engine flowTwo engines read the same workbook: the values Excel saved, and NormXL's independent recalculation. They are compared cell by cell, then boundary, negative and precision tests run before the Dossier is sealed with SHA-256, all inside the browser..xlsxEngine A · cached values,as saved by Excel<v>3.0053571428571431</v>Engine B · NormXL recalculation(Rust → WebAssembly) ·NIST StRD-benchmarkedcell by cell, under Excel's conventions ·LRE for statisticswhere agreement is not enoughboundary vectorsnegative injectionsprecision & protection auditDossier ·SHA-25628a815ee…8ac260d1your browser · 0 KB of your workbook leaves it
The three-minute timelineA true-scale timeline of about three minutes from dropping the workbook to downloading the Dossier. The engine works for the first ninety seconds, the user then answers the intended-use questions, and review and signature follow under the user's own procedure.ISO/IEC 17020:20260:00Drop · SHA-2560:05Parse & recalculate · 41 formula cells0:40Boundary & negative vectors1:10Structure audit1:30Intended use · your answers≈3:00Dossier ready · PDF + DOCXNormXL engine 0:00–1:30your answers and the download 1:30–≈3:00Then: review and sign under your procedure (typically 30–60 min)The three-minute timelineA true-scale timeline of about three minutes from dropping the workbook to downloading the Dossier. The engine works for the first ninety seconds, the user then answers the intended-use questions, and review and signature follow under the user's own procedure.ISO/IEC 17020:20260:00Drop · SHA-2560:05Parse & recalculate ·41 formula cells0:40Boundary & negative vectors1:10Structure audit1:30Intended use · your answers≈3:00Dossier ready · PDF + DOCXNormXL engine 0:00–1:30your answers and the download 1:30–≈3:00Then: review and sign under your procedure(typically 30–60 min)
Order Your Validation Dossier — €149 + VAT

100% in-browser · VAT invoice in your organisation’s name · For business customers

What you download: a 20+ page validation record, completed

Not a report about your spreadsheet: a validation record of it, in the structure assessors and auditors already know. The sample runs to 24 pages; Dossiers for your own workbooks run to 20 pages or more, depending on the size of the workbook.

PartWhat it containsSample pages
Cover & seal summaryFile name, SHA-256, generation time (UTC), compliance profile, overall status: Released, Released with observations or Not released1
Executive summary & document controlFindings at a glance, scope, limitations, signature block2–3
§1 User requirements & scopeIntended use, decisions the spreadsheet makes, acceptance criteria, declared rounding rule4–5
§2 Risk assessment & traceability matrixEvery output classified by its effect on the result; requirements traced to tests6–7
§3 Installation qualification & formula inventoryFile identity, application that last saved it, every formula, the Constant Ledger, external links, VBA modules8–11
§4 Operational qualification: dual-engine test matrixFor every recalculated cell: inputs, formula as written, Excel's value, NormXL's value, difference12–17
§5 Negative & boundary stress-test logEvery injected vector with expected and actual result18–19
§6 Precision & tamper-resistance auditDisplay versus decision at every comparison; locks, protection, hidden cells20–21
§7 Release & version controlRe-validation triggers, version log, approval22
Appendix AClause cross-reference for your profile: ISO/IEC 17020:2026, ISO/IEC 17025:2017 or ISO 13485:201623
Appendix BAssessor Quick-Verify card: three hand-checkable vectors and re-hash commands24

PDF for the record, with the SHA-256 in every page header. DOCX for your own document control: add your document number, adapt the wording to your SOP, route it through your approval workflow.

NormXL produces evidence; your organisation approves it. The decision on any finding is always the assessor's or auditor's. The Dossier is built to make that decision quick.

Download Sample 24-Page Dossier (PDF)

The sample is produced in the ISO/IEC 17020:2026 profile; the ISO/IEC 17025 and ISO 13485 profiles share its structure.

The 24-page Dossier, explodedThe eleven parts of the 24-page sample Dossier, from cover to assessor quick-verify card, with four pages enlarged: the constant ledger listing four unsourced values, a recalculated cell, two failed boundary tests and a lock map showing an unprotected calculation sheet. The cover status reads Not released.p1Cover & sealp2–3Executive summaryp4–5§1 URS & scopep6–7§2 Risk & traceabilityp8–11§3 IQ & formula inventoryp12–17§4 OQ dual-engine matrixp18–19§5 Negative & boundarylogp20–21§6 Precision & tamperauditp22§7 Release & versioncontrolp23App. A clausecross-referencep24App. B Quick-Verify cardNot released: 3 red flags, 2 more findingsSHA-256 28a815ee…8ac260d1 · ISO/IEC 17020:2026 profileSHA-256 28a815ee…8ac260d1p8–11§3 IQ & formula inventory0.4 · Calc!G14 · source: ____1.5 · Calc!H22 · source: ____0.875 · Calc!H23 · source: ____0.1 · Calc!F30:F41 (12×) · source: ____SHA-256 28a815ee…8ac260d1p12–17§4 OQ dual-engine matrixCalc!G14 · =Inputs!C5*Inputs!C6/(2*(Inputs!C7*Inputs!C9*Inputs!C8+Inputs!C5*0.4)) · Excel 3.0053571428571431 ·NormXL 3.0053571428571431 · Δ 0SHA-256 28a815ee…8ac260d1p18–19§5 Negative & boundary logCML-04 · expected ACTION · actual NO ACTIONTest failedCML-07 "N/A" · expected REJECT · actual ACCEPTTest failedSHA-256 28a815ee…8ac260d1p20–21§6 Precision & tamper auditCalc: not protectedInputs!C9 · no data validationSample in the ISO/IEC 17020:2026 profile. Your chosen profile changes Appendix A and the clause references; the structure is identical.The 24-page Dossier, explodedThe eleven parts of the 24-page sample Dossier, from cover to assessor quick-verify card, with four pages enlarged: the constant ledger listing four unsourced values, a recalculated cell, two failed boundary tests and a lock map showing an unprotected calculation sheet. The cover status reads Not released.Not released: 3 red flags, 2 more findingsSHA-256 28a815ee…8ac260d1 ·ISO/IEC 17020:2026 profilep1Cover & sealp2–3Executivesummaryp4–5§1 URS & scopep6–7§2 Risk &traceabilityp8–11§3 IQ & formulainventoryp12–17§4 OQdual-enginematrixp18–19§5 Negative &boundary logp20–21§6 Precision &tamper auditp22§7 Release &version controlp23App. A clausecross-referencep24App. BQuick-VerifycardSHA-256 28a815ee…8ac260d1p8–11§3 IQ & formula inventory0.4 · Calc!G14 · source: ____1.5 · Calc!H22 · source: ____0.875 · Calc!H23 · source: ____0.1 · Calc!F30:F41 (12×) ·source: ____SHA-256 28a815ee…8ac260d1p12–17§4 OQ dual-engine matrixCalc!G14 ·=Inputs!C5*Inputs!C6/(2*(Inputs!C7*Inputs!C9*Inputs!C8+Inputs!C5*0.4))Excel 3.0053571428571431 ·NormXL 3.0053571428571431 · Δ 0SHA-256 28a815ee…8ac260d1p18–19§5 Negative & boundary logCML-04 · expected ACTION ·actual NO ACTIONTest failedCML-07 "N/A" · expected REJECT ·actual ACCEPTTest failedSHA-256 28a815ee…8ac260d1p20–21§6 Precision & tamper auditCalc: not protectedInputs!C9 · no data validationSample in the ISO/IEC 17020:2026 profile. Yourchosen profile changes Appendix A and the clausereferences; the structure is identical.
Order Your Validation Dossier — €149 + VAT

100% in-browser · VAT invoice in your organisation’s name · For business customers

Your workbook never leaves your browser. Check it yourself.

0 KB of your workbook uploaded

The engine runs as WebAssembly inside your browser's sandbox. The workbook is read into that tab's memory and never transmitted: not the file, not its name, not its hash.

No installation, no admin rights

Nothing for IT to package, allow-list or patch. NormXL runs in the browser your IT team already manages: Edge, Chrome, Firefox or Safari.

No AI, no cloud

No language model reads your formulas, and no server stores your workbook. The same file always produces the same Dossier, which a validation record needs and a text generator cannot promise.

Works offline

Once the page has loaded, disconnect and complete the qualification offline: on a site laptop, in a cleanroom, on a segregated network. A single-file offline edition is available for air-gapped sites.

Built for confidentiality obligations

ISO/IEC 17025 Clause 4.2 and ISO/IEC 17020 Clause 4.2 make you answerable for client information, and many client NDAs forbid third-party processing. With nothing transmitted, there is no processor to assess for your workbook's contents.

Verify it in one minute

Open your browser's network monitor (F12 → Network), drop a file, and watch: no request carries your workbook.

What does leave your browser? Only what you type into the order form (name, organisation, business email, the standard and the package) and standard website analytics if you accept them in the cookie banner. Never the workbook, its file name, its size or its fingerprint.

Read the full Security & 0 KB Upload note for your supplier file →

The air gapThe NormXL engine runs inside the browser on the user's own computer. The workbook is fingerprinted and checked locally, and a dashed boundary shows that no workbook data is sent to the cloud or to an AI service.normxl.comNormXL engine · WebAssembly sandboxworkbook.xlsxSHA-256recalculationSHA-256 · Dossier.pdf0 KB of your workbookno admin rightsworks offline after loadNetwork · 0 requests carrying workbook dataThe air gapThe NormXL engine runs inside the browser on the user's own computer. The workbook is fingerprinted and checked locally, and a dashed boundary shows that no workbook data is sent to the cloud or to an AI service.0 KB of your workbooknormxl.comNormXL engine · WebAssembly sandboxworkbook.xlsxSHA-256recalculationSHA-256 · Dossier.pdfno admin rightsworks offline after loadNetwork ·0 requests carrying workbook data

Is NormXL right for your spreadsheet? Check before you order.

a good fit

  • Calculation templates: inputs in, a result or a decision out, then printed, signed or transferred to a controlled system
  • Excel workbooks in .xlsx or .xlsm
  • Statistical functions such as LINEST, SLOPE, INTERCEPT, TREND, CORREL and STDEV.S: recalculated and benchmarked against NIST StRD
  • Templates copied to many laptops: you validate the master, and anyone can check a copy against its fingerprint
  • Legacy templates whose author has left: the Dossier shows you what the workbook actually does

not a good fit, and we will say so

  • A spreadsheet used as a live, multi-user primary record that needs per-user authentication, reasons for change and an append-only audit trail. That is a job for a LIMS, an eQMS or a validated database.
  • Workbooks whose logic lives mainly in external data connections, Power Query or third-party add-ins. These are flagged and listed as "not independently recalculated".
  • Pure forms with no formulas. There is nothing to validate, and the scan tells you so: zero formula cells.
  • Legacy .xls, .xlsb or .ods files. Re-save them as .xlsx first.
Layer A and Layer BNormXL validates spreadsheets used as calculation templates whose signed output goes into the quality system's archive. Spreadsheets used as live multi-user primary records need a database system with authentication and audit trails instead.Layer A · calculation template validated · locked · SHA-256 seal record (NormXL)printed or exported, signed QMS archive / report registerLayer B · spreadsheet as live primary record needs per-user authentication · reason for change ·append-only audit trail eQMS · LIMS · validated databasethe boundaryNormXL qualifies the calculator. Your QMS keeps the record.Layer A and Layer BNormXL validates spreadsheets used as calculation templates whose signed output goes into the quality system's archive. Spreadsheets used as live multi-user primary records need a database system with authentication and audit trails instead.Layer A · calculation template validated · locked ·SHA-256 seal record (NormXL)printed or exported,signed QMS archive / report registerthe boundaryLayer B · spreadsheet as liveprimary record needs per-user authentication ·reason for change ·append-only audit trail eQMS · LIMS · validated databaseNormXL qualifies the calculator. Your QMS keepsthe record.
Order Your Validation Dossier — €149 + VAT

100% in-browser · VAT invoice in your organisation’s name · For business customers

Priced like a document. Built like a validation.

€149 + VAT is less than one hour of a validation consultant's time at a typical €1,300 day rate. It is priced to sit inside the budget a Quality Manager already controls: no quotation cycle, no demo, no sales call. One spreadsheet before the assessment, or every template in your scope.

Single Dossier

€149 + VAT

one-time · per spreadsheet

One spreadsheet. One complete Validation Dossier, ready for review and signature.

  • 1 calculation spreadsheet (.xlsx or .xlsm)
  • Full Validation Dossier, 20+ pages: PDF for the record, DOCX for your own document control
  • Dual-engine recalculation of every formula cell, with printed test vectors
  • NIST StRD-benchmarked statistical functions (LINEST, SLOPE, INTERCEPT, STDEV.S …)
  • IEEE 754 and display-precision check of every decision cell
  • Cell-lock, protection and hard-coded-constant audit
  • Negative and boundary stress tests with expected and actual results
  • SHA-256 seal record for the exact file you validated
  • Your compliance profile: ISO/IEC 17020 · ISO/IEC 17025 · ISO 13485
  • Generated and downloaded locally. Nothing stored on our servers

Best for Closing one finding, or proving one template before an assessment or audit.

Validate 1 Spreadsheet · €149 + VAT
4 Single Dossiers = €596 + VAT

Annual Quality Register

€490 + VAT

per year · up to 20 spreadsheets

Four Single Dossiers cost €596 + VAT. The Register covers up to 20 for €490 + VAT (€24.50 per spreadsheet at full use).

Your calculation-template inventory, qualified and kept qualified for 12 months.

  • Up to 20 spreadsheets in one version-controlled register
  • A full Validation Dossier for every spreadsheet
  • Re-validation after every change, with no per-change fee
  • Version change-log diffing: formula, constant and protection differences between revisions
  • Audit-day integrity check: every seal re-verified in one report before the visit
  • All three compliance profiles; choose the profile per spreadsheet

Best for Annual surveillance cycles, and template libraries that change.

Start Annual Register · €490/year + VAT

For business customers. All prices exclude VAT, GST and other local taxes, where applicable; they are added to your invoice.

Prices are in euro; your card issuer converts the amount.

Payable by company card · VAT invoice issued in your organisation's name

Up to three spreadsheets, Single Dossiers cost less; from four, the Annual Quality Register does.

FAQ

You should not have to trust it, and you don't. A tool needs to be trusted blindly only when its output cannot be checked, and every output of NormXL can be checked line by line. Each test vector in the Dossier prints:

  • the inputs;
  • the formula as written;
  • the value Excel cached;
  • NormXL's value;
  • the difference.

A reviewer can verify any of them with a calculator, and Appendix B pre-selects three for exactly that purpose. Behind the vectors sit two further lines of evidence: two independent implementations agreeing on every recalculated cell, and a statistical engine benchmarked against NIST StRD certified values, with the engine version printed in every Dossier.

This is the established principle for tools whose output is independently verified. Safety-critical software standards require tool qualification only where the output is not verified (DO-178C §12.2; ISO 26262-8, Clause 11). European MedTech practice, as discussed by consultancies such as the Johner Institute, draws the same line between validating a tool and verifying its output. In your validation procedure, record NormXL as a supporting tool whose output is verified by review and spot calculation, with a short, risk-based rationale. (NormXL is independent and is not affiliated with or endorsed by the Johner Institute.)

The spreadsheet itself is a different matter. A template with your formulas and limits is typically treated as GAMP® 5 Category 4, configured software, and NormXL tests it the way that category calls for. It is tested against its intended use, with documented, risk-based tests, and every result is confirmed by two independent computations.

Agreement between two engines proves that your formulas are evaluated as written. It cannot prove that what is written is safe at its limit. A Cpk stored as 1.3299999999999794 is reproduced faithfully by both engines, and it still holds the lot. So at every decision cell NormXL does three more things:

  • it tests the cell at its limit and one step either side;
  • it evaluates the comparison in strict IEEE 754 as well as under Excel's conventions;
  • it records the rounding rule the formula actually implements, so your reviewer can compare it with the rule your procedure declares.

Where your rule requires it, the decision is also re-evaluated in exact decimal arithmetic. A disagreement between any of these is a finding, printed with the corrected formula next to it.

No. NormXL runs as WebAssembly in the standard sandbox of a modern browser (Edge, Chrome, Firefox or Safari). There is nothing to install, no add-in and no administrator rights, so there is nothing for IT to package or allow-list. Once the page has loaded it can run offline.

Yes, for .xlsm workbooks. Formulas are recalculated as in any workbook. VBA is analysed statically and never executed. The Dossier lists every module and flags what matters for validation:

  • shell and file-system calls;
  • silent On Error Resume Next;
  • switching calculation to manual;
  • macros that calculate rather than format.

Cells whose values depend on VBA logic are listed as "not independently recalculated", and numerical algorithms written in VBA are isolated for documented code review by your team. In GAMP® 5 terms, custom VBA moves a template towards Category 5.

You show them how to check it without relying on you or on us. The Quick-Verify card in Appendix B takes under five minutes:

  1. Re-hash the workbook with Get-FileHash .\file.xlsx -Algorithm SHA256, certutil -hashfile file.xlsx SHA256 or shasum -a 256 file.xlsx, and compare the result with the cover page.
  2. Recompute three pre-selected test vectors with a calculator.
  3. Open the workbook and confirm the protection state.

Every limitation of the analysis is listed in the Dossier, so nothing is hidden. Two minutes of checkable evidence usually settles more than an hour of explanation. The decision itself is always the assessor's or auditor's.

No accreditation body, Notified Body or regulator pre-approves validation tools or documents, and you should be wary of any vendor who implies otherwise. What they assess is whether your organisation validated its spreadsheet adequately for its intended use and can demonstrate it. The Dossier is built around exactly that demonstration:

  • intended use and risk;
  • executed tests and boundary behaviour;
  • protection and constants;
  • version identity.

Every claim in it is checkable. Once your Technical Manager or Quality Manager reviews and signs it, it is your validation record.

Your workbook does not: not the file, not its name, not its size, not its hash. You can confirm that in the browser's network monitor. What does leave is what you type into the order form (name, organisation, business email, standard and package) and standard website analytics if you accept them in the cookie banner.

For exploring a formula, they are useful assistants, and the business versions of ChatGPT and Microsoft 365 Copilot keep your data out of model training. Confidentiality is not the main issue there; evidence is. An assistant can write Python to read your .xlsx and its formulas, but it does not evaluate them the way Excel does. Its analysis is also generated afresh each session, so the same question can produce different code and different conclusions. NormXL runs one deterministic engine: the same file always produces the same Dossier, with every test vector, lock state and decision boundary written down and sealed with SHA-256. One more point: pasting client results into a public AI service sits badly with the confidentiality commitments of ISO/IEC 17025 and 17020 Clause 4.2.

Those tools are built for financial modelling. They are good at finding structural problems such as inconsistent formulas, circular references and hard-coded numbers in a forecast. They do not produce what an assessor or auditor asks for:

  • a requirements-to-test traceability matrix;
  • executed boundary vectors at acceptance limits;
  • a NIST StRD benchmark of statistical functions;
  • a clause-mapped validation record sealed to the file.

NormXL is built for exactly that, and for engineering and metrology formulas rather than cash flows.

No. A tool that claims to do so for a standalone spreadsheet deserves suspicion. Those rules govern electronic records and signatures in use: an audit trail of every change, authenticated reasons for edits, and controls that act while the record is being created. That is the territory of a LIMS, an eQMS or a validated database. NormXL validates the calculation template: the calculator an engineer uses before printing or exporting a signed result into your quality system. If your spreadsheet is itself the live primary record, the fit check above tells you so before you order.

Good: keep them. The Dossier follows the structure most SOPs prescribe (URS, risk assessment, IQ, OQ, release), and the DOCX is fully editable. You can add your document number, adapt the wording to your procedure and cross-reference your SOP. What changes is that the tables arrive filled in with executed evidence, instead of empty.

The time from dropping the workbook to downloading the Dossier, including your answers to the short intended-use questions. Review and approval follow your own procedure, typically 30 to 60 minutes for a calculation template: reading the findings, entering the sources for any constants the Dossier lists, and signing.

Then you have found the problem before your assessor or auditor did. Every Dossier carries an overall status of Released, Released with observations, or Not released, so it can never be mistaken for a clean bill of health when it isn't one. Our own sample workbook is Not released: it contains three red flags, on purpose. Fix the template, run it again, and file the Dossier for the corrected version. On the Annual Register, re-validation after a change is included.

On the Annual Quality Register, nothing extra. NormXL compares the new version with the validated baseline, formula by formula and constant by constant, and you re-validate at no per-change fee. Outside the Register, a changed spreadsheet is qualified with a new Single Dossier. A change of data flowing through validated cells, such as new readings or new coefficients in locked input cells, is not a software change.

Yes, by design. The SHA-256 identifies the exact bytes you validated, and Excel rewrites metadata such as the last-saved time on every save. A new fingerprint therefore tells you "this is not the validated file", not "this is what changed". Two habits keep it simple:

  • keep the validated master read-only in a controlled location, and let people work on copies;
  • record the master's fingerprint in your software or equipment register.

On the Annual Register, NormXL compares a re-saved file with the validated baseline at formula level, so a cosmetic re-save can be told apart from a real change.

No. You validate the master template: its formulas, protection, input checks and version. You then control how it is used. Completed copies are records produced by a validated tool, in the same way a calibrated instrument produces readings without being recalibrated for each one. Have each report state the template's ID and version, keep the master's fingerprint in your register, and anyone can trace a report back to the validated version. A file cannot carry its own fingerprint, so the register holds it.

The one under which the spreadsheet influences results: ISO/IEC 17020:2026 for inspection, ISO/IEC 17025:2017 for testing and calibration, ISO 13485:2016 for medical devices. The profile sets the clause references and terminology in the Dossier. The Annual Register includes all three, chosen per spreadsheet.

Excel workbooks in Office Open XML format: .xlsx and .xlsm. Re-save legacy .xls files as .xlsx first. The Dossier records the application and version that last saved the file, because that is where the cached results (Engine A) come from.

Your next assessment or audit will open a spreadsheet. Make it one you can defend.

Pick the template your colleagues use most: the one copied onto every laptop, the one nobody has opened since it was built. Find out in about three minutes what an assessor or auditor could find in it. Then file a completed validation record instead of a blank template.

Order Your Validation Dossier — €149 + VAT

€149 + VAT per spreadsheet · 0 KB of your workbook uploaded

Download Sample 24-Page Dossier (PDF)

No installation · No admin rights · No AI, no cloud · 0 KB of your workbook uploaded

Order Dossier · €149 + VAT
Pre-release · NormXL 7.0

Complete Your Order

Spreadsheet Validation Dossier · generated in your browser · 0 KB of your workbook uploaded

For business customers

Package Choice
4 Single Dossiers = €596 + VAT

As it should appear on your invoice.

Printed on the cover of your Dossier and on your VAT invoice.

Your order confirmation and release notification are sent here.

Sets the clause references and terminology in your Dossier, at no extra cost. The Annual Register includes all three profiles; choose the one you will use first.

100% In-Browser. No card charged during pre-release qualification.

Your spreadsheet is not part of this form. It is only ever read inside your browser.

Questions before you order? Read the FAQ or the Security & 0 KB Upload page. Both open in a new tab, and this form keeps what you have entered.