Auditing your pharmacovigilance system is not optional and not a quality-department formality. It is a legal obligation on the marketing authorisation holder, its results are recorded in the pharmacovigilance system master file, and it is one of the first things an inspector uses to judge whether your safety system is genuinely under control.
What the audit programme has to cover
GVP Module IV sets out how these audits should be planned and conducted, and the organising principle is risk. The programme is not a rolling tour of every process in equal measure; it concentrates effort where failure would most damage patient safety or the reliability of the safety system.
In practice a risk-based programme focuses on four things:
- The quality system supporting pharmacovigilance activities
- Critical pharmacovigilance processes — case management, signal detection, periodic reporting, risk management plan commitments, literature screening
- The key control systems those processes depend on, including the safety database and its interfaces
- Areas that remain high risk after controls or mitigating actions have been applied
Strategy, programme, plan
Three documents do different jobs and are frequently conflated. The audit strategy is a high-level statement of how audit activity will be delivered over a multi-year horizon — typically three to five years — and how the risk universe was defined. The audit programme translates that into the audits scheduled for a given year. The individual audit plan scopes a single engagement.
Inspectors look for the thread running between them. If the strategy identifies a process as high risk and the annual programme never audits it, that gap is itself a finding.
Independence and who may audit
The auditor must be independent of the activity being audited. In smaller organisations, where the person who designed a process is also the person best qualified to assess it, this creates a genuine tension — and it is a common reason companies use external auditors for their own safety system. What is not acceptable is the QPPV auditing processes they are personally accountable for and presenting the result as independent assurance.
From findings to demonstrated resolution
Findings should be graded by their actual impact on the safety system, with critical findings escalated immediately rather than held for the report. Each finding needs a root cause that goes beyond human error, a corrective and preventive action proportionate to that cause, a named owner, a realistic due date, and verification of effectiveness before closure.
The audit trail an inspector will follow is straightforward: is the finding in the report, is it in the CAPA system, is the CAPA closed, and is there evidence the problem has not recurred. A large population of overdue CAPAs from previous audits does more damage to inspection outcomes than the original findings ever did.
The regulatory backdrop is moving
Audit results and the dates of audits form part of the pharmacovigilance system master file and are summarised in its annexes, so an outdated PSMF undermines the audit programme regardless of how well the audits themselves were run. With Regulation (EU) 2025/1466 reshaping the implementing rules for pharmacovigilance, audit programmes should be reviewed against current expectations rather than against arrangements set up years ago.
How PQRA helps
PQRA designs and delivers risk-based pharmacovigilance audit programmes, conducts independent audits of safety systems, affiliates, service providers and licence partners, supports CAPA development and effectiveness verification, and prepares organisations for pharmacovigilance inspection. We also act as QPPV and deputy QPPV where clients need the role covered.
To review your audit strategy or arrange an independent audit of your pharmacovigilance system, get in touch with PQRA.
No responses yet