Common Pharmacovigilance Audit Failures

A dashboard screenshot without commentary Meeting minutes showing review of a threshold breach, assigned actions and follow-up A list of KPI names in an SOP An archived spreadsheet with no calculation details

Ask the CAPA owner whether the process appears improved Confirm that the revised SOP was distributed Sample 100 post-change ICSRs over three months and assess them against a predefined mapping-error acceptance criterion Close the CAPA when the vendor confirms completion

A routine monthly KPI meeting with no material changes A high-impact system migration or major vendor change Completion of a low-risk training module Issuance of an audit report with no findings

Send a general reminder to operations and close the issue after the vendor confirms the upgrade Correct affected cases, assess regulatory impact, perform structured RCA, implement targeted preventive controls and verify effectiveness with objective sampling Wait for the next routine vendor audit before taking action Replace the vendor immediately without documenting the underlying control failure

It measures programme activity but not whether important risks were covered or controls were effective It cannot be calculated using a denominator It is always a confidential measure It automatically duplicates the repeat-finding rate

No action is needed because the escalation threshold was not crossed The KPI is below target and should be discussed and managed, even if the defined escalation threshold was not reached The KPI should be reported as meeting target because most CAPAs were timely The result proves all CAPAs are effective

It prevents the use of electronic audit trails It fails to align audit effort and frequency with differences in risk It makes auditors automatically non-independent It prevents CAPA effectiveness checks

To confirm only that the CAPA record contains a signature To determine whether the implemented actions achieved the intended risk reduction and prevented recurrence To replace the original root-cause analysis To allow closure whenever the target date was met

It is never possible for staff actions to contribute to a finding It does not normally explain why controls, training, supervision or process design failed to prevent or detect the error It automatically requires a vendor audit It prevents the finding from being classified as regulatory

An informal discussion with no defined membership or decision authority A CAPA Board or equivalent with a documented charter, defined membership, decision authority and recorded minutes A single action owner who approves and verifies the CAPA alone A committee that reviews only overdue administrative tasks