Introduction

The Pharmacovigilance System Master File (PSMF) is one of the central documents in the European Union pharmacovigilance system. GVP Module II describes the requirements for the PSMF and establishes how it should document the pharmacovigilance system operated by a marketing authorisation holder (MAH).

The PSMF is not simply a regulatory filing document. It is intended to provide a sufficiently detailed and structured description of the pharmacovigilance system so that the organisation, competent authorities and inspectors can understand how the system is organised, where activities are performed, who is responsible for them, and how the system is controlled.

For the QPPV, the PSMF is particularly important because it provides a consolidated view of the pharmacovigilance system for which the QPPV has oversight responsibilities. A PSMF that accurately reflects the live system can therefore be a powerful governance tool. A PSMF that is incomplete, outdated or disconnected from operational reality can instead become evidence of weaknesses in system governance.

This article focuses on the requirements and practical meaning of GVP Module II. Detailed specialist topics such as PSMF structure, annex management, location, maintenance and inspection findings will be covered in the subsequent articles in this series and cross-referenced rather than duplicated here.

Where GVP Module II Fits

GVP Module II sits within the broader EU pharmacovigilance framework described in [[what-are-eu-good-pharmacovigilance-practices-gvp]] and the quality-system principles described in [[gvp-module-i-pharmacovigilance-systems-and-quality-systems]].

The relationship can be viewed simply:

EU pharmacovigilance legislation
              ↓
          EU GVP
              ↓
     GVP Module I
              ↓
  Pharmacovigilance system
              ↓
          PSMF
              ↓
Description + evidence of system organisation

The PSMF should therefore not be interpreted in isolation. It describes a pharmacovigilance system; it does not itself constitute the entire system.

What the PSMF Is Intended to Do

At its core, the PSMF should allow an informed reader to understand the pharmacovigilance system operated by the MAH.

That includes, as applicable:

how the system is organised;
where pharmacovigilance activities are performed;
which functions and individuals have relevant responsibilities;
which products and activities fall within the system;
how important processes are controlled;
which activities are outsourced;
how interfaces between functions are managed;
and how the system is monitored and maintained.

The PSMF therefore has both a descriptive and a governance function.

The descriptive function is straightforward: it documents the system.

The governance function is more subtle. Preparing and maintaining the PSMF requires the MAH to understand its own pharmacovigilance system sufficiently well to describe it accurately. If the organisation cannot determine where an activity occurs, who performs it, which system supports it or which controlled document governs it, that uncertainty may indicate a broader governance problem.

The PSMF Is a Living Document

A common misconception is that the PSMF is written once and then retained as a historical regulatory document.

That is not the intended model.

The pharmacovigilance system changes over time. Organisations change, vendors change, products are acquired or divested, systems are replaced, responsibilities move between affiliates, processes are redesigned and regulatory requirements evolve.

The PSMF therefore needs to remain aligned with the current pharmacovigilance system.

A useful way of thinking about this is:

Live PV system
     ↕
Current controlled processes
     ↕
Current PSMF

The relationship should work in both directions. Changes to the system may require PSMF updates, while periodic review of the PSMF can also reveal that the organisation's understanding or documentation of the system is incomplete.

What the PSMF Is Not

The PSMF should not be treated as:

a replacement for SOPs;
a complete description of every operational procedure;
a repository for every pharmacovigilance record;
a substitute for the quality system;
a substitute for the QPPV's oversight;
or a document prepared only when an inspection is announced.

Instead, it is a structured description of the pharmacovigilance system supported by appropriate references and documentation.

This distinction matters because attempting to put every operational detail directly into the PSMF can make it difficult to maintain. Conversely, making the PSMF so high-level that it cannot explain how the system actually operates defeats its purpose.

The PSMF and the QPPV

The QPPV has a central role in the oversight of the pharmacovigilance system. The PSMF provides an important mechanism through which the QPPV can understand and demonstrate that system.

A QPPV should be able to use the PSMF to answer questions such as:

What pharmacovigilance system does the MAH operate?
Which products and activities are covered?
Where are important activities performed?
Which affiliates, vendors and partners contribute to the system?
How are critical interfaces controlled?
What quality-system arrangements support the system?
How are changes to the system reflected in the documentation?
What evidence demonstrates that the described system is actually operating?

The PSMF is therefore more than an administrative responsibility delegated to a document owner. Its accuracy and currency are relevant to effective QPPV oversight.

PSMF as an Inspection Document

During a pharmacovigilance inspection, the PSMF can provide an inspector with a map of the organisation's pharmacovigilance system.

This makes consistency particularly important.

An inspector may compare the PSMF with:

the actual organisational structure;
SOPs and other controlled documents;
contracts and agreements;
system records;
case-processing activities;
audit records;
training records;
quality metrics;
CAPA records;
and interviews with personnel.

A discrepancy does not automatically mean that the pharmacovigilance system is non-compliant. However, unexplained discrepancies can lead an inspector to investigate whether the PSMF is maintained effectively or whether the underlying system itself is not adequately controlled.

The Central Principle

The most important practical principle for GVP Module II is simple:

The PSMF should accurately describe the pharmacovigilance system as it actually operates.

That principle should guide both the initial preparation of the PSMF and every subsequent update.

The following articles in the Module II series will examine the required content, structure, supporting documentation, accessibility, maintenance, summary information, interfaces and common inspection deficiencies in greater detail.

What GVP Module II Requires the PSMF to Show

GVP Module II describes the PSMF as a document that provides a description of the pharmacovigilance system and its components. The emphasis is on a current, accurate and sufficiently detailed description rather than on a document that merely lists procedures.

The PSMF should enable an informed reviewer to understand the organisation and functioning of the system, including its scope, responsibilities, locations, interfaces and important controls.

The practical test is whether someone who understands pharmacovigilance but does not work inside the organisation could use the PSMF to understand how the system operates.

The Scope of the Pharmacovigilance System

The PSMF needs to make the scope of the system understandable.

This includes the medicinal products and activities for which the MAH's pharmacovigilance system is responsible and the organisational arrangements through which those activities are performed.

Scope becomes particularly important for organisations with:

multiple marketing authorisation routes;
many products;
different affiliates;
acquired portfolios;
co-marketing arrangements;
outsourced activities;
shared systems;
or different operating models in different territories.

A PSMF that describes only the headquarters organisation may therefore provide an incomplete picture of the actual pharmacovigilance system.

Organisation and Responsibilities

The PSMF should explain how the pharmacovigilance system is organised and where responsibilities reside.

The description should be sufficiently clear to identify important interfaces and accountability.

This does not mean that the PSMF needs to reproduce every organisational chart or every job description. It should instead provide a meaningful picture of the functions and organisational relationships that are relevant to pharmacovigilance.

For the QPPV, this is particularly important because responsibility can be distributed across departments, affiliates and vendors while overall pharmacovigilance oversight remains with the MAH.

The QPPV and the PSMF

The PSMF should support the QPPV's ability to maintain oversight of the pharmacovigilance system.

A practical governance question is whether the QPPV can use the PSMF to identify significant changes in:

organisational structure;
critical responsibilities;
important vendors;
safety databases and other systems;
major pharmacovigilance processes;
and the location or performance of relevant activities.

Changes affecting the system should not occur invisibly from the perspective of the QPPV.

Locations of Pharmacovigilance Activities

Pharmacovigilance activities may be distributed across multiple locations.

For example, an MAH may have:

Global PV function
      ↓
Regional PV teams
      ↓
Local affiliates
      ↓
External service providers
      ↓
Specialist subcontractors

The PSMF should make the relevant organisational geography understandable.

The objective is not to create a static list that becomes obsolete immediately. It is to maintain sufficiently accurate information to understand where important activities are performed and how those locations fit into the system.

Outsourced and Delegated Activities

Outsourcing is a major practical issue in PSMF maintenance.

If a vendor performs an important pharmacovigilance activity, the PSMF should allow the reader to understand the role of that activity within the overall system.

Relevant information can include the nature of the outsourced activity, the organisational relationship, the applicable oversight arrangements and the interfaces with the MAH's own processes.

The PSMF should not become a vendor contract repository. Contracts, detailed service specifications and safety-data exchange agreements should remain controlled in their appropriate systems. The PSMF should provide the necessary description and references to those arrangements.

The PSMF and Safety Data Systems

Computerised systems can be critical components of the pharmacovigilance system.

The PSMF should describe the important systems supporting pharmacovigilance activities at a level that allows their role in the system to be understood.

Depending on the organisation, this can include:

safety databases;
literature-monitoring systems;
signal-management tools;
aggregate-reporting systems;
document-management systems;
regulatory-information systems;
quality-management systems;
and interfaces between these systems.

The PSMF is not a system validation file. Detailed validation documentation belongs in the relevant controlled systems and quality records.

The PSMF should instead explain how significant systems fit into the pharmacovigilance architecture.

Data Sources and Information Flows

A useful PSMF should help explain where safety information enters the system and how it moves through relevant processes.

For example:

Sources of safety information
          ↓
Receipt / intake
          ↓
Processing
          ↓
Assessment
          ↓
Signal / risk management
          ↓
Regulatory reporting
          ↓
Decision and action

The exact flow varies by organisation, but the PSMF should provide sufficient context to understand the system's major information flows.

Quality Management Arrangements

GVP Module II should be considered together with GVP Module I because the PSMF describes a pharmacovigilance system that includes its quality system.

The PSMF should therefore provide an appropriate description of quality-management arrangements, including relevant controls, monitoring and oversight.

It should not attempt to reproduce the entire quality-management system.

Instead, it should explain the elements necessary to understand how the pharmacovigilance system is controlled and how important quality issues are identified and managed.

Compliance Monitoring and Performance Indicators

The pharmacovigilance system should be monitored using appropriate performance information.

The PSMF can therefore provide information about relevant compliance monitoring and performance indicators, including how the MAH assesses whether important pharmacovigilance activities are being performed as required.

The useful distinction is between:

Activity data — what happened.

Performance information — whether the activity met the expected standard.

Governance information — whether management and the QPPV have sufficient information to act when performance is inadequate.

The PSMF should support understanding of this monitoring framework without becoming a dashboard containing every operational metric.

Deviations and Corrective Actions

A mature pharmacovigilance system recognises that deviations can occur.

The PSMF should provide an appropriate description of the quality system and mechanisms used to identify and address significant compliance issues.

Detailed deviation records and CAPA files should remain in the relevant quality systems.

The PSMF should allow an inspector to understand the framework through which such problems are detected, assessed, escalated and corrected.

Audit Arrangements

Auditing is another component of the overall pharmacovigilance quality system.

The PSMF should describe the relevant audit arrangements and how the audit programme relates to the pharmacovigilance system.

The PSMF is not a substitute for the audit programme or individual audit reports. Those records remain controlled separately.

This distinction is important because a PSMF should describe the system while the underlying quality records demonstrate its operation.

Training and Competence

People are a fundamental component of the pharmacovigilance system.

The PSMF should provide appropriate information about the organisational arrangements for ensuring that personnel involved in pharmacovigilance are appropriately qualified and trained.

Detailed training curricula, individual completion records and assessment results normally belong in the relevant training systems.

The PSMF should instead allow the overall training and competency framework to be understood.

Interfaces With Other Functions

Pharmacovigilance does not operate as an isolated department.

Important interfaces can include:

Regulatory Affairs;
Medical Affairs;
Clinical Development;
Quality Assurance;
Clinical Operations;
Market Access where relevant to information flows;
Legal and compliance;
Supply Chain;
Information Technology;
and local affiliates.

The PSMF should describe important interfaces sufficiently to explain how safety information and responsibilities move across organisational boundaries.

Shared Pharmacovigilance Systems

A shared system creates additional governance questions.

For example, multiple legal entities may rely on common safety infrastructure or common operational processes.

The organisation should be able to demonstrate:

which entity is responsible for which activity;
how responsibilities are documented;
how information is exchanged;
how changes are controlled;
and how the QPPV obtains appropriate oversight.

A shared system should therefore be represented as a controlled operating model rather than simply described as a common database.

The PSMF and Product-Specific Information

The PSMF describes the pharmacovigilance system rather than replacing product-specific regulatory documentation.

Product lists, product-specific risk information and other dynamic information may be maintained in controlled annexes or linked controlled systems as appropriate.

This is one reason PSMF architecture matters: frequently changing information should be managed in a way that keeps the PSMF accurate without requiring uncontrolled manual rewriting of the main document.

Annexes and Controlled Supporting Information

The PSMF includes annexes and supporting information that provide detail beyond the main narrative.

Annexes commonly contain information that is more structured, detailed or frequently updated than the core description.

The important governance principle is that an annex is part of the controlled PSMF information set. It should not be treated as an informal collection of spreadsheets stored separately from the PSMF without appropriate control.

Where information is generated by another controlled system, the PSMF can use that system as the authoritative source provided that accessibility, version control and traceability are maintained.

Change Control

Changes to the PSMF should be controlled.

The organisation should maintain a history showing what changed and when.

This is particularly important for changes to the description of the live pharmacovigilance system.

A practical change-control process is:

System change identified
       ↓
PSMF impact assessed
       ↓
Update required?
       ↓
Controlled revision
       ↓
QPPV awareness / approval as applicable
       ↓
Effective version released
       ↓
Change history maintained

The precise internal approval process can vary, but the organisation should be able to reconstruct the history of material PSMF changes.

Current Versus Historical System Information

The PSMF primarily describes the current pharmacovigilance system.

However, inspections and audits can require an understanding of how the system operated in the past.

This creates an important distinction:

Current PSMF
     =
Current system description

Historical records
     =
Evidence of previous system states

An organisation should therefore not assume that replacing an old PSMF automatically eliminates the need to retain appropriate historical records.

Accessibility

The PSMF must be maintained so that it is accessible to the QPPV and can be provided to competent authorities and the Agency as required by the applicable legal framework.

Accessibility is therefore a functional requirement, not merely a document-management preference.

An organisation should know:

where the authoritative PSMF is located;
how the current version is identified;
who can access it;
how annexes are accessed;
and how the organisation can respond to a regulatory request without reconstructing the document under time pressure.

The PSMF as a Control Point

A well-designed PSMF creates a useful control point between the abstract organisational structure and the detailed operational records.

Organisation
     ↓
Pharmacovigilance system
     ↓
PSMF
     ↓
Processes / systems / vendors
     ↓
Operational records

If this chain is coherent, the PSMF becomes a useful navigation tool for both management and inspectors.

If the chain is inconsistent, the PSMF can expose weaknesses that would otherwise remain hidden.

The final chunk will address practical maintenance, inspection testing, common PSMF failures, QPPV oversight and implementation, followed by References and the Regulatory Note.

Practical PSMF Maintenance

A PSMF should be maintained as part of normal pharmacovigilance governance rather than as an inspection-preparation exercise.

A practical maintenance cycle is:

Change in the PV system
        ↓
Impact assessment
        ↓
PSMF update where required
        ↓
Review and controlled release
        ↓
Verification
        ↓
Periodic reconciliation

The organisation should define triggers for review and update. These can include organisational changes, product changes, new or changed vendors, system changes, material process changes, regulatory changes and significant quality findings.

The exact frequency of review should be established according to the applicable requirements and the organisation's quality system. A periodic review should not be used as an excuse to leave known material changes unrecorded until the next scheduled review.

PSMF Change Triggers

A useful change-trigger list includes:

Change	PSMF assessment
New product	Assess scope and supporting information
Product transfer	Assess scope, responsibilities and interfaces
Acquisition/divestment	Assess organisational and system boundaries
New vendor	Assess outsourced-activity description
Vendor replacement	Assess activities, interfaces and oversight
Safety database change	Assess system description and data flows
QPPV change	Assess QPPV and organisational information
Major reorganisation	Assess responsibilities and locations
New PV process	Assess system description and controls
Major regulatory change	Assess applicable system implications
Significant inspection finding	Assess whether the PSMF description remains accurate

This is a governance aid rather than a substitute for the current GVP requirements.

PSMF Reconciliation

Periodic reconciliation is particularly useful for a large or decentralised organisation.

The review can compare selected PSMF statements against authoritative sources such as the organisational master data, vendor register, system inventory, product database, controlled procedures and current regulatory records.

The purpose is not to prove that every word is unchanged. It is to detect material divergence between the documented system and the live system.

For example, if the PSMF says that literature monitoring is performed internally but the vendor register and operating procedure show that the activity moved to an external provider six months ago, the discrepancy should be investigated and corrected.

PSMF and the Inspection Opening Meeting

The PSMF can be one of the first documents used by inspectors to understand the pharmacovigilance system.

The organisation should therefore be able to navigate from the PSMF to the supporting evidence quickly.

A useful inspection-readiness test is:

Pick any major PSMF statement and ask an operational employee to demonstrate the corresponding process and evidence.

If the employee cannot identify the process, system or record, the organisation should investigate whether the PSMF is too abstract or whether the operational process is insufficiently understood.

PSMF and Inspection Interviews

Different employees should give broadly consistent descriptions of important system interfaces.

They do not need to memorise the PSMF. However, if the PSMF identifies one organisation as responsible for an activity while operational personnel consistently describe a different model, the discrepancy can attract further inspection attention.

This is why PSMF accuracy is closely connected to organisational awareness and training.

PSMF Inspection Evidence

During an inspection, useful evidence can include:

the current controlled PSMF;
PSMF change history;
relevant annexes;
supporting organisational records;
vendor agreements;
system inventories;
quality-system documentation;
audit records;
metrics and quality indicators;
and evidence of QPPV oversight.

The exact evidence requested depends on the inspection scope.

Common PSMF Inspection Failures

1. The PSMF does not describe the live system

This is the fundamental failure. The document describes an organisational model that has already changed.

2. Material changes were not assessed

The organisation cannot show that system changes were evaluated for PSMF impact.

3. Supporting information is inconsistent

The PSMF, SOPs, vendor records and system inventories describe different operating models.

4. Annexes are uncontrolled

Important supporting information exists in spreadsheets or shared folders without adequate ownership, version control or traceability.

5. The PSMF is maintained immediately before inspection

Large numbers of retrospective changes suggest that normal maintenance controls are weak.

6. The QPPV is disconnected from material changes

The QPPV cannot explain significant changes to the pharmacovigilance system described in the PSMF.

7. Outsourcing is incompletely described

The PSMF does not provide an accurate picture of important outsourced activities or interfaces.

8. Historical information cannot be reconstructed

The organisation cannot establish what the pharmacovigilance system looked like during an earlier period relevant to an inspection or investigation.

PSMF and QPPV Oversight

The QPPV should have appropriate oversight of the PSMF and the system it describes.

This does not mean that the QPPV must personally edit every section.

A practical governance model is:

Functional owners
       ↓
Provide current information
       ↓
PSMF owner / document control
       ↓
Quality review
       ↓
QPPV oversight
       ↓
Current controlled PSMF

The exact model can differ between organisations. The important point is that accountability for content, document control and pharmacovigilance oversight should be clear.

What a QPPV Should Test

A QPPV reviewing the PSMF should ask:

Does it describe the system that actually exists today?
Are the products and scope accurate?
Are important responsibilities correctly represented?
Are major outsourced activities visible?
Are critical interfaces understood?
Are important systems accurately described?
Does the quality-system description match reality?
Are material changes being assessed for PSMF impact?
Can the supporting evidence be retrieved quickly?
Could an inspector trace important statements to operational evidence?

These questions test the PSMF as a governance instrument rather than merely as a document.

PSMF and the Rest of the GVP Framework

Module II should not be treated as an isolated documentation exercise.

The PSMF connects directly with other GVP topics.

For example:

Module I
Quality system
     ↓
Module II
PSMF
     ↓
Module III / IV
Inspection and audits
     ↓
Module V
Risk management
     ↓
Module VI
Individual cases
     ↓
Module IX
Signal management

The PSMF provides a high-level description of the system through which these activities are organised and controlled.

This is why weaknesses in the PSMF can sometimes indicate weaknesses beyond document management.

PSMF Versus the PSMF Annexes

The main PSMF narrative and its annexes should be designed as one controlled information set.

Frequently changing information can often be maintained more effectively in controlled annexes or authoritative linked systems, while the main narrative explains the stable architecture and governance model.

This reduces unnecessary document churn while preserving the ability to demonstrate current information.

The organisation should nevertheless verify that links and references remain valid and that the annexes themselves are controlled.

PSMF Versus the PSMF Summary

Where the applicable framework requires a summary description or related information, that information should remain consistent with the full PSMF and current pharmacovigilance system.

A summary should not become a separate, independently maintained description that gradually diverges from the authoritative PSMF.

Consistency between related regulatory descriptions is an important quality-control principle.

PSMF as a Knowledge Map

One of the greatest practical benefits of a well-maintained PSMF is that it becomes a map of the pharmacovigilance system.

A new QPPV, auditor or inspector should be able to use it to understand:

Who?
  ↓
Does what?
  ↓
Where?
  ↓
Using which system?
  ↓
Under which process?
  ↓
With which control?
  ↓
With what oversight?

This makes the PSMF useful beyond its regulatory purpose.

A Practical PSMF Review Checklist

Before considering a PSMF review complete, ask:

Is the current version clearly identified?
Does the scope remain correct?
Are the QPPV details current?
Are organisational responsibilities accurate?
Are relevant locations current?
Are important vendors accurately represented?
Are critical systems current?
Are important interfaces described correctly?
Does the quality-system description match actual practice?
Are relevant annexes current and controlled?
Are supporting references valid?
Are material changes traceable?
Can historical versions be retrieved where required?
Can the PSMF and supporting evidence be produced promptly?
Is QPPV oversight demonstrable?

Key Takeaways

The PSMF is a controlled description of the pharmacovigilance system, not the pharmacovigilance system itself.
Its value depends on accuracy, currency, accessibility and traceability.
The PSMF should describe the actual operating model, including affiliates, vendors, systems and critical interfaces.
The QPPV should have appropriate oversight of the PSMF and the system it describes.
Material changes to the pharmacovigilance system should trigger an assessment of PSMF impact.
Supporting information and annexes must be appropriately controlled rather than treated as informal attachments.
Periodic reconciliation can detect divergence between the PSMF and the live system.
Inspection readiness should include testing whether PSMF statements can be traced to operational evidence.
Common weaknesses include outdated organisational information, incomplete outsourcing descriptions, stale system information and uncontrolled annexes.
Historical PSMFs and supporting records may be important when reconstructing the pharmacovigilance system at a previous point in time.
A well-maintained PSMF can function as a practical knowledge map for QPPVs, auditors, inspectors and system owners.

References

European Medicines Agency. Good Pharmacovigilance Practices (GVP), Module II — Pharmacovigilance System Master File (PSMF). Current version should be consulted for the detailed requirements, structure, content, accessibility and maintenance expectations.
European Parliament and Council. Directive 2001/83/EC, as amended. Provides the EU legal framework for pharmacovigilance and related marketing authorisation holder responsibilities.
European Parliament and Council. Regulation (EC) No 726/2004, as amended. Provides Union-level requirements for authorisation and supervision of medicinal products, including pharmacovigilance provisions.
European Commission. Commission Implementing Regulation (EU) No 520/2012, as amended. Establishes detailed rules concerning the performance of pharmacovigilance activities provided for in the EU pharmaceutical legislation.
European Medicines Agency. Good Pharmacovigilance Practices (GVP), Module I — Pharmacovigilance systems and their quality systems. Relevant for understanding the quality-system context of the PSMF.
European Medicines Agency. Pharmacovigilance post-authorisation guidance. Current EMA material should be consulted for applicable procedural and implementation information.

Regulatory Note

This article is an educational explanation of GVP Module II and practical PSMF governance. It does not constitute legal advice and does not replace the current GVP guideline, EU legislation, regulatory decisions or applicable national requirements.

The detailed requirements for the PSMF can change as EU legislation and GVP guidance are revised. For a live regulatory question, the current version of GVP Module II and the applicable legal framework should be checked, including effective dates and transitional arrangements.

The article describes practical governance approaches in addition to regulatory requirements. Examples of controls, reconciliation activities and inspection-readiness tests are presented as implementation approaches and should not be interpreted as additional statutory requirements unless supported by the applicable legal or regulatory source.

GVP Module II Explained: The Pharmacovigilance System Master File