Common Pharmacovigilance Audit Failures

Introduction

Most pharmacovigilance organisations perform audits.

Fewer operate truly effective audit programmes.

The difference is important.

An audit programme may appear active because:

• Audits are conducted.
• Reports are written.
• Findings are documented.
• CAPAs are opened.

Yet significant risks may still remain unidentified or unresolved.

Many inspection findings arise not because audits are absent, but because audit programmes fail to provide meaningful assurance.

Understanding common audit failures can help organisations strengthen oversight and improve audit effectiveness.

What Audit Failure Really Means

Audit failure does not necessarily mean:

• No audits were performed.
• No reports were produced.

Instead, audit failure generally means:

The audit programme failed to provide reliable assurance regarding the effectiveness of the pharmacovigilance system.

This distinction is critical.

An active programme may still be ineffective.

Failure 1: Auditing Everything Equally

One of the most common weaknesses involves lack of prioritisation.

All activities receive similar audit attention regardless of risk.

Consequences include:

• Excessive effort in low-risk areas.
• Insufficient attention in high-risk areas.
• Poor resource allocation.

Root Cause

Absence of risk-based planning.

Prevention

• Formal risk assessments.
• Dynamic planning.
• Risk-driven scheduling.

For additional discussion see:

[[risk-based-audit-planning]]

Failure 2: Weak Audit Universe Design

Some organisations maintain incomplete audit universes.

Examples include:

• Missing vendors.
• Missing affiliates.
• Missing governance processes.
• Missing technology platforms.

If an activity is absent from the audit universe, it is unlikely to be audited.

Root Cause

Poor programme design.

Prevention

• Periodic audit universe review.
• Cross-functional input.
• Change-control integration.

Failure 3: Lack of Auditor Independence

Independence is fundamental.

Problems arise when:

• Auditors assess their own work.
• Operational managers audit their own departments.
• Significant conflicts of interest exist.

Even technically correct findings may lose credibility.

Root Cause

Resource limitations or governance weaknesses.

Prevention

• Clear independence requirements.
• Independent review structures.
• Escalation pathways.

Failure 4: Compliance-Only Auditing

Some audit programmes focus exclusively on procedural compliance.

Questions become limited to:

• Was the procedure followed?
• Was documentation completed?

These questions are important.

However, they do not always assess effectiveness.

Root Cause

Checklist-driven auditing.

Prevention

Evaluate:

• Outcomes
• Controls
• Risk management
• Governance effectiveness

Failure 5: Poor Root Cause Analysis

Findings are identified.

Causes are not understood.

Examples:

Finding:

Reporting delay occurred.

Root Cause:

Staff error.

This explanation is often incomplete.

More useful questions include:

• Why was the error possible?
• Which controls failed?
• Were resources sufficient?

Prevention

Use structured root cause methodologies.

Failure 6: Generic Training CAPAs

One of the most common CAPA weaknesses is over-reliance on training.

Example:

Finding:

Significant process failure.

CAPA:

Retrain staff.

Training may help.

However, many failures originate from:

• Process design
• Governance weaknesses
• System limitations

Training alone rarely resolves systemic issues.

Prevention

Address root causes rather than symptoms.

For additional discussion see:

[[audit-capas]]

Failure 7: Repeat Findings

Repeat findings deserve special attention.

A repeated deficiency may indicate:

• Weak CAPAs
• Weak governance
• Weak oversight
• Poor effectiveness checks

Inspectors frequently view recurring issues as indicators of programme weakness.

Prevention

Strengthen effectiveness verification.

Failure 8: Weak CAPA Governance

Some organisations focus heavily on CAPA creation.

Less attention is given to:

• Implementation
• Monitoring
• Verification

As a result:

• Actions become overdue.
• Risks remain unresolved.
• Findings recur.

Prevention

Formal governance reviews.

Failure 9: Limited Management Visibility

Audit results sometimes remain confined to operational teams.

Senior stakeholders receive limited information.

Consequences include:

• Delayed escalation.
• Limited resource support.
• Limited accountability.

Prevention

Structured reporting and governance reviews.

Failure 10: Poor QPPV Visibility

The QPPV may receive:

• Excessive detail
• Insufficient detail
• Delayed information

All three situations can reduce oversight effectiveness.

Prevention

Risk-based reporting focused on significant findings and trends.

For additional discussion see:

[[qppv-and-audit-oversight]]

Failure 11: Failure to Audit Vendors Effectively

Vendor oversight is frequently cited as a challenge.

Common weaknesses include:

• Infrequent audits.
• Poor audit scope.
• Weak follow-up.
• Limited visibility of outsourced risks.

Prevention

Risk-based vendor audit strategies.

For additional discussion see:

[[vendor-audits]]

Failure 12: Failure to Adapt to Change

Audit programmes sometimes become static.

Meanwhile the organisation changes.

Examples include:

• New products.
• New vendors.
• Acquisitions.
• Technology migrations.

Risk exposure changes.

The audit programme does not.

Prevention

Dynamic risk assessment and programme review.

Failure 13: Excessive Focus on Audit Completion

Some organisations measure success by:

• Number of audits completed.
• Schedule adherence.

These metrics are useful.

However, they do not necessarily demonstrate assurance.

Prevention

Focus on outcomes rather than activity volume.

Failure 14: Weak Trend Analysis

Individual findings are reviewed.

Patterns are ignored.

Consequences include:

• Emerging risks remain hidden.
• Systemic weaknesses persist.

Prevention

Regular trend reviews.

Examples include:

• Repeat findings
• CAPA effectiveness
• Vendor findings
• Governance deficiencies

Failure 15: Lack of Organisational Learning

Perhaps the most significant failure occurs when audit programmes generate information but fail to influence behaviour.

Questions to consider:

• Are procedures improving?
• Are controls improving?
• Are governance models improving?
• Are risks decreasing?

Without organisational learning, audits become administrative exercises.

What Inspectors Often See

Many inspection observations ultimately relate to a few recurring themes:

Weak Risk Assessment

Weak Governance

Weak CAPAs

Weak Oversight

Weak Learning

These failures often interact with one another.

For example:

Weak Root Cause Analysis
          ↓
Weak CAPA
          ↓
Repeat Finding
          ↓
Inspection Observation

Characteristics of Strong Audit Programmes

High-performing organisations typically demonstrate:

Risk-Based Planning

Resources focus on important risks.

Independent Auditing

Objectivity is maintained.

Meaningful Findings

Important issues are identified.

Strong CAPAs

Actions address root causes.

Effective Governance

Results influence decisions.

Continuous Learning

The system improves over time.

QPPV Visibility

Significant risks remain visible.

These characteristics help transform audits into strategic governance tools.

Key Takeaways

• Audit failure often reflects ineffective assurance rather than absence of auditing.
• Weak risk assessment remains one of the most common programme weaknesses.
• Auditor independence is essential.
• Root cause analysis and CAPA quality determine long-term effectiveness.
• Repeat findings frequently indicate systemic governance issues.
• Audit outputs should support management decision-making.
• QPPVs require meaningful visibility regarding significant findings and trends.
• Mature organisations use audits to drive learning and continuous improvement.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module IV – Pharmacovigilance Audits.
2. EMA Good Pharmacovigilance Practices (GVP) Module I – Pharmacovigilance Systems and Their Quality Systems.
3. EMA Good Pharmacovigilance Practices (GVP) Module III – Pharmacovigilance Inspections.
4. Regulation (EC) No 726/2004.
5. Directive 2001/83/EC.
6. Commission Implementing Regulation (EU) No 520/2012.
7. ICH Q9 Quality Risk Management.
8. ICH Q10 Pharmaceutical Quality System.