APIC data integrity guidance for CSV and DI teams
APIC data integrity guidance comes in two documents that only work as a pair. The Practical risk-based guide for managing Data Integrity (Rev.2, April 2022) sets the method: map the processes, grade the data, sort systems into four categories, check the gaps against minimum controls, then score the failure modes. The Data Integrity FAQ (V3, October 2025) settles the narrow arguments that come up in audits and self-inspections.
Plenty of computer system validation (CSV) programs still treat data integrity as a checklist stapled to the back of a validation report. The APIC material takes a different line. It calls data integrity (DI) continuous governance, then hands CSV teams a way to decide how much control a given system actually deserves. That decision drives the rest: how deep the testing goes, which systems get audit trails switched on, and what has to be sitting in the user requirement specification (URS) before anyone writes code.
Why these two documents travel well outside Europe
APIC, the Active Pharmaceutical Ingredients Committee, is an industry working group under CEFIC, the European Chemical Industry Council. It speaks for manufacturers of active pharmaceutical ingredients (APIs) and intermediates, and its remit runs across GMP, quality systems and regulatory harmonization for APIs worldwide.
The committee formed in 1992, at a point when European rules on API manufacturing were tightening fast. Companies wanted one place to answer regulators, agree on best practice and hold a common position in international standard setting.
| Period | What happened | Why a CSV or DI team should care |
| 1992 | APIC founded under CEFIC to represent European API producers in international GMP standard setting | Created the industry channel that later shaped API GMP text |
| Mid 1990s | PIC/S moved to draft a globally harmonized API GMP, the “what to do” layer of the rules | Industry experts, APIC among them, joined the drafting work |
| 2000 | The draft was finalized through ICH as ICH Q7 | ICH Q7 is still the baseline for API GMP worldwide |
| 2000 onward | APIC began a companion implementation guide, the ICH Q7 “How to do” document, iterated to V15 by 2021 | Closed the distance between regulatory principle and shop-floor practice |
| 2001 to 2015 | Specialist working groups formed: GMP and QA, regulatory affairs, third-party audit, supplier management, quality agreements, cleaning validation, laboratory outsourcing | The first quality agreement guide and template appeared in 2009, revised to V2 in 2017. The annual global API GMP and regulatory conference tracks EMA, FDA and EDQM developments, and APIC took part in discussions on the EU Falsified Medicines Directive |
| 2016 to 2022 | Attention turned to data integrity, audit trails, impurity risk (nitrosamines and genotoxic impurities), registered starting material (RSM) audits and ongoing process verification (OPV) | The RSM manufacturer audit guide (2018) and its Q&A companion (2019) came out of this stretch |
| 2023 to now | Supplier management best practice V2 (2024), nitrosamine risk management V2 (2025), and an API distribution GDP “How to do” V3 in June 2026 that extends to veterinary APIs and aligns with EU 2021/1280 | Current work also covers sustainable API production, AI and digital quality, multi-product shared-line risk and supply chain resilience |
Membership runs somewhere between 60 and 70 European API manufacturers, plus a number of national industry associations. The readership is wider than that. A lot of API producers outside Europe reach for APIC guides when they build audit programs, negotiate quality agreements and implement GMP.
Two of those guides are the ones CSV and DI teams keep close at hand.
The two APIC documents, and how they divide the work
| Document | Revision | The question it answers | Where it fits in your document set |
| Practical risk-based guide for managing Data Integrity | Rev.2, April 2022 | How much DI control does this system or process need, and how do we prove it? | DI management SOPs, URS, validation plans, data integrity risk assessment reports |
| Data Integrity FAQ | V3, October 2025 | Is this particular practice acceptable, and what does acceptable look like? | Internal audit findings, inspection responses, SOP detail, training scenarios |
The split is deliberate. The main guide gives you a framework you can defend in front of an inspector. The FAQ gives you the industry-accepted answer to a narrow question. Work the guide first to classify systems and run the gap check. When a scenario is genuinely ambiguous, the FAQ tells you what a reasonable inspector would accept.
The five-step method behind risk-based data integrity management
The main guide refuses one-size-fits-all control, and it builds on ALCOA+ principles. It opens with two positions. Data governance is an ongoing management process, not a remediation project with a finish line. And control should be proportionate to risk, where risk splits along two axes: the severity of the data, and the processing characteristics of the system holding it.
That framing produces a five-step sequence.
| Step | Activity | Output |
| 1 | Business process mapping across every GMP and GDP flow, identifying all CGxP data generation points, data flows and manual transcription nodes | A process and data flow map with clear ownership of original records |
| 2 | Data severity grading, sorting records into high, medium and low severity by their impact on batch release, product quality and patient safety | A severity register that sets the control floor for each data type |
| 3 | Computerized system classification into the four APIC categories | A system inventory with a category assigned to every CGxP system |
| 4 | Current-state gap assessment against the minimum DI controls for that category, worked through with checklists | A defect list per system, not a general maturity score |
| 5 | Failure mode and effects analysis (FMEA) plus a remediation plan | Ranked actions with owners and deadlines, prioritized by risk priority number (RPN) |
Step 5 names the failure modes rather than leaving them vague: falsification, deletion, overwriting, loss and missing records. Each one gets scored, and the RPN decides what gets fixed first. In practice that ordering is the whole point, because almost no site can remediate everything in one budget year.
Underneath the five steps sits a data lifecycle management view. Data has to be controlled from generation and capture through transmission, processing, review, backup, archiving, retrieval and finally destruction. Two transitions carry the most risk, and the guide says so directly: movement of data between systems, and any point where a person retypes a value.
The four APIC system categories that set validation scope
This classification step is the most useful thing in the guide, because it sorts CGxP systems by how they handle data rather than by price or vendor reputation.
| Category | Definition | Typical examples | Minimum DI control focus |
| Cat1 | Fully electronic system. Data is generated and stored electronically with a complete audit trail | LIMS, ERP, electronic batch records | Full CSV lifecycle validation, complete audit trail testing, electronic signature controls |
| Cat2 | Hybrid system. Manual entry paired with electronic storage, with a configurable audit trail | Configurable spreadsheets and interface-driven equipment software | Audit trail configuration and review, access control, data transfer checks |
| Cat3 | Electronic equipment with no local data storage. Output exists only as a printed record | Balances, pH meters, direct-reading titrators | Print template control, date locking, controlled management of paper originals |
| Cat4 | Purely paper-based record system | Manual logbooks and paper forms | Controlled forms, issuance and reconciliation, archival discipline |
Classification is not a one-time label. A software upgrade, a functional change or a process redesign can move a system between categories, and the guide expects both the classification and the control strategy to be revisited when that happens.
Look at what the table implies. An innocuous desktop tool can land in Cat1 and attract heavy validation. An expensive instrument can sit in Cat3 with a much narrower control set. Cost and risk do not track each other, and the model does not pretend they do.
What APIC data integrity guidance requires at each CSV stage
This is the part CSV teams lift into their own templates. The guide pushes CSV data integrity requirements to the front of the lifecycle and keeps them there, and three threads run through the whole section: audit trail scope, access control and electronic signature compliance.
Requirements from the main guide:
| # | Requirement | Practical implication |
| 1 | The URS must state DI needs explicitly: audit trail, non-modifiable timestamps, permission model, electronic signatures, non-tamperable export and backup and restore capability | If it is not in the URS, it is not testable later and not defensible in an inspection |
| 2 | System category determines validation depth and test focus | Cat1 systems need the heaviest validation and full audit trail testing. Cat3 systems need print template, date lock and paper record control instead |
| 3 | The validation report must carry its own data integrity conclusion, reviewed by fully independent personnel | A functional pass on the software is not a DI conclusion |
| 4 | Change control covers software version upgrades, configuration changes and interface changes, with an assessment of impact on audit trail, data storage and signature validity | Schema and interface changes are the usual blind spot |
| 5 | Periodic review must include a DI risk reassessment, with audit trail and backup effectiveness rechecked at the same time | Periodic review is where drift gets caught |
| 6 | Printouts cannot serve as the original record, and electronic original data must stay retrievable for the long term | Paper becomes a convenience copy, not a legal substitute |
Requirements from the FAQ:
| # | Requirement | Practical implication |
| 1 | An electronic document management (EDM) system used to store digitally signed documents must be validated for that purpose, with signature metadata preserved and verifiable | Storing a signed PDF is not the same as controlling a signed record |
| 2 | Hybrid signatures should be avoided. Where unavoidable, sign on paper first and then digitize, with the complete electronic version held as the official CGxP record | The sequence is what makes the record defensible |
| 3 | System administrator rights must be segregated from business user rights, and administrator actions need audit trails too | The familiar carve-out for IT is not available |
| 4 | Before a system is retired, validate the export format, the completeness of the extracted data and its long-term readability | Retirement is a data migration project with a validation deliverable |
| 5 | Where scanned signed documents arrive from outside, the quality agreement must define a true copy certification process | Without a named procedure, the scan has no status |
| 6 | All electronic worksheets used for CGxP work (including Excel workbooks) fall under controlled management, and uncontrolled local files cannot serve as original records | The most common finding in this area, by a wide margin |
Nine gap analysis domains and thirty-two check items
The two documents slot together into a workable data integrity gap analysis. Nine domains, thirty-two check items, each one traced back to the guide that supplies the requirement.
| # | Domain | Items | Reference |
| 1 | Data governance and the DI management system | 5 | Main guide Rev.2 |
| 2 | Computerized system classification using the four categories | 3 | Main guide Rev.2 |
| 3 | System lifecycle CSV and DI requirements across DQ, IQ, OQ and PQ | 5 | Main guide Rev.2, plus FAQ for retirement |
| 4 | Permission management and account control | 5 | Main guide Rev.2, plus FAQ |
| 5 | Audit trail control | 4 | Main guide Rev.2, plus FAQ for retention |
| 6 | Data storage, backup and restore | 3 | Main guide Rev.2, plus FAQ |
| 7 | Electronic signatures, scanned records and hybrid records | 3 | FAQ V3 |
| 8 | Supplier and third-party system DI control | 2 | Main guide Rev.2, plus FAQ |
| 9 | Deviations, CAPA and continuous improvement | 2 | Main guide Rev.2 |
The domains are not equally urgent. Domains 2 and 5 do most of the heavy lifting, because classification sets the control floor and audit trails are where inspectors spend their time. Domain 4, permission and account control, gets written up more than any other, since shared logins and dormant accounts are easy to find and hard to explain away.
Two domains need a word on scope. Domain 3 covers the whole confirmation chain, so DI evidence has to show up at design qualification, installation qualification, operational qualification and performance qualification, not merely in a closing report. Domain 8 covers software as a service (SaaS) platforms, outsourced LIMS and third-party data platforms. It expects supplier audits of software vendors and service providers, and it requires the quality agreement to name DI responsibilities, data ownership, audit trail access, retention obligations and the vendor’s duty to flag changes to customers.
Where the guidance cuts against common practice
Four positions in the APIC material tend to surprise people, and each one has a cost attached.
Re-authentication is not required for every action. The FAQ ties repeated authentication to a documented risk assessment based on data severity instead of treating every transaction as high risk. Sites that bolt blanket re-authentication onto every step create friction and teach users to work around it.
Control follows the data, not the price tag. Severity grading and system classification are independent of what a system cost, which means a spreadsheet used for batch calculations can demand stricter control than a well-known enterprise platform. Teams that assume a vendor’s reputation carries the compliance weight get caught right here.
Administrators are not exempt. Administrator activity, configuration changes, permission edits and direct data operations included, must be fully recorded. Where an admin function falls outside the audit trail, the system does not meet the requirement, whatever the vendor’s release notes say.
The electronic version wins. In any hybrid arrangement, whether it involves a wet signature that was later scanned or a printout filed next to the electronic record, the official CGxP record is the electronic original. Paper is a reference copy. Sites that still file printouts as master records are building an archival liability, and it turns up in inspections as a data integrity finding with a CAPA commitment attached.
How to actually run the gap analysis
- Do not renumber anything until domain 2 is finished. Assign a category to every CGxP system first, because validation scope and audit trail scope both follow from it.
- Walk the process map before you open the DI checklist. Manual transcription nodes found during mapping justify more controls than any generic checklist item.
- Grade severity with release impact in mind. Ask whether a record influences a batch disposition or a patient safety decision, then grade accordingly.
- Write DI requirements into the URS of systems still in procurement. Use change control for anything already in service, because retrospective URS work does not exist in most quality systems.
- Test audit trails with attempt-and-detect cases. Confirming that the audit trail screen opens is not a test. Periodic audit trail review belongs in the SOP as well as in the validation file.
- Test backup restore and keep the evidence. An untested backup is a claim, not a control.
- Log DI findings as deviations with CAPA rather than as audit observations, so they enter the same lifecycle as any other quality defect.
- Feed DI status into the product quality review (PQR) cycle. Otherwise the risk assessment gets refreshed only when an inspection is announced.
Limitations
This article summarizes published industry guidance and the gap analysis structure built on top of it. It is not legal advice, and it does not replace the current revision of either document.
A few constraints are worth stating plainly. Regulatory expectations differ by jurisdiction, so the same practice can be acceptable under one authority and deficient under another. APIC revises its documents on a rolling basis, so the versions referenced here (Rev.2 of the risk-based guide, V3 of the FAQ) may already be superseded when you read this. Confirm the current revision before you build a remediation plan. Nothing here is a validated procedure or an approved specification, and the check items are a structural template rather than a clause-by-clause audit checklist.
Bottom line
Read APIC data integrity guidance as a control design tool, not a compliance manual. Grade the data, classify every CGxP system into one of four categories, put DI requirements in the URS before the system is built, test audit trails and backup restore for real, and keep the electronic original authoritative. Teams that get those five things right usually find the gap analysis writes itself.
FAQ
What is APIC data integrity guidance?
It is a pair of industry documents from the Active Pharmaceutical Ingredients Committee. The Practical risk-based guide for managing Data Integrity (Rev.2, April 2022) defines the risk-based method and the four system categories. The Data Integrity FAQ (V3, October 2025) answers specific practice questions on signatures, passwords, access, retention and hybrid records.
What are the four APIC system categories?
Cat1 systems are fully electronic with complete audit trails, such as LIMS, ERP and electronic batch records. Cat2 systems mix manual entry with electronic storage and a configurable audit trail. Cat3 systems are instruments with no local storage, producing printouts only. Cat4 covers purely paper record systems.
How does system classification change validation scope?
Cat1 systems receive the heaviest validation, with full DI testing and complete audit trail coverage. Cat2 systems focus on audit trail configuration, access control and data transfer checks. Cat3 systems shift attention to print templates, date locking and controlled paper originals. Cat4 systems rest on form control and archival discipline.
What does the URS need to specify for data integrity?
The URS must state unique accounts, least privilege, audit trail scope, non-modifiable timestamps, electronic signature requirements, data backup, export integrity and system log retention. If a DI requirement never reaches the URS, it cannot be tested during qualification, and an inspector has no documented basis to accept the system as compliant.
Are shared accounts ever acceptable in a CGxP system?
No. Every operator needs an individual, unique account so actions trace to a specific person. Shared logins break traceability and rank among the most common findings in this area. Permission changes, role changes and departures also require prompt account updates, with accounts disabled the moment someone leaves the organization.
Does every action require re-authentication?
No. The FAQ ties repeated authentication to a documented risk assessment based on data severity rather than applying it to every transaction. High-severity actions such as approvals, record deletion and signature completion warrant a second check. Low-risk read-only activity usually does not, and forcing it adds friction that users learn to work around.
How long should audit trails be retained?
Audit trail logs must be retained for at least as long as the product data they relate to, and they have to be retrievable on demand. Retention is normally set by the longest applicable record retention requirement for the market. Trimming logs early to save storage breaks the chain between a record and its history of change.
Can a scanned document be used as a CGxP record?
Only if a true copy certification process covers it. The scan must be verified against the original, then archived and traceable in a controlled way. Where scanned signed files arrive from an external party, that certification process belongs in the quality agreement. Uncontrolled scanning and uploading is not acceptable.
What is a hybrid signature and how should it be handled?
A hybrid signature combines a handwritten wet signature with an electronic one. The FAQ advises avoiding the combination. When it cannot be avoided, sign on paper first and then digitize, and treat the complete electronic version as the official CGxP record. The wet signature sequence is what preserves the audit trail.
Is an Excel workbook allowed as a CGxP record?
Yes, provided it is under controlled management. The FAQ requires every electronic worksheet used for CGxP calculation or recording to be controlled, with version, access and calculation integrity managed. Local, uncontrolled spreadsheets stored on a personal drive cannot serve as original records, and that prohibition applies to calculations feeding a batch decision.
Do administrator actions need audit trails?
Yes. Administrator configuration, permission changes and any data operations must be fully recorded in the audit trail, and administrator rights must be segregated from business user rights. An exemption for IT staff does not exist in the guidance. Where a system cannot record administrator activity, that gap is a DI finding regardless of vendor documentation.
What has to happen before a system is retired?
Retirement is a controlled data migration task. Validate the export format, confirm that the extracted data set is complete, and demonstrate long-term readability before the system is switched off. The DI assessment report for the retirement should stay in the quality records, alongside the archive reference for the migrated data.
