Critical Vendor Management in Pharmacovigilance

Use the same supplier for additional functions to simplify governance Document compensating controls, strengthen oversight and accelerate continuity testing while maintaining a replacement shortlist Remove the supplier from the vendor inventory because it is already well known Reduce KPI monitoring to avoid duplicated reporting

To replace the need for individual vendor risk assessments To provide a controlled, complete source for vendor identification, status and traceability To allow commercial procurement to approve all PV vendors without PV involvement To record only vendors that have already been classified as critical

Review only the commercial contract because operational controls belong to the vendor Assess governance, QMS, data integrity, case processes, reporting timelines, continuity, change control, training, incidents, CAPA and subcontractors Review only the vendor's most recent customer satisfaction survey Use an identical checklist without considering the vendor's services or risk profile

Percentage of dedicated FTEs available versus plan Percentage of cases entered within the agreed SLA after receipt Percentage of changes deployed under approved change requests System uptime for the production database

High Medium Low Critical

Two independent vendors perform the same non-critical administrative activity All regional expedited-report submissions depend on one platform with no tested alternate processing arrangement A vendor provides a service with documented internal backup and tested failover A low-risk supplier has multiple commercial contacts

They allow the MAH to rely on vendor summaries without verification They show the underlying evidence, performance over time and whether breaches were identified and escalated They replace the need for contractual KPIs They demonstrate only the vendor's financial performance

To perform every operational vendor activity personally To retain ultimate pharmacovigilance oversight responsibility and receive appropriate periodic and event-driven escalation To approve vendor invoices and negotiate commercial pricing To replace the compliance function during vendor audits

The vendor provides a low-cost administrative service that is easily replaced The vendor performs an activity whose failure could significantly affect patient safety, compliance or continuity of pharmacovigilance operations The vendor has the largest commercial contract in the organisation The vendor operates in more than one geographic region

Because these details determine the vendor's invoice value Because they reveal additional dependencies, data flows and control points that may affect risk and oversight Because subcontractors automatically become MAH employees Because system access is relevant only to information-technology audits