QPPV.COM

GVP Module VIII: PASS Governance, Oversight and Quality Management

A practical framework for governing PASS activities, including roles, oversight, quality planning, vendor management, study conduct and escalation.

Audio Lesson 18 min
Knowledge Assessment Test your understanding of this article. Take the assessment →

GVP Module VIII: PASS Governance, Oversight and Quality Management

Introduction

A PASS is not simply a study performed after marketing authorisation. Where it forms part of the pharmacovigilance system, the study must be governed so that its objectives, conduct, data, analyses, conclusions and regulatory commitments remain controlled throughout its lifecycle.

GVP Module VIII should therefore be read together with broader pharmacovigilance quality-system requirements. EMA currently lists Module VIII Rev. 3 as the published module while noting that GVP modules will be updated to reflect amendments to Commission Implementing Regulation (EU) No 520/2012.

1. Governance Starts With the Study Question

The governance model should begin with a clearly defined pharmacovigilance question.

The organisation should be able to explain what safety question is being addressed, why a PASS is appropriate, how the study relates to the safety concern or risk-management objective, who owns the scientific question, and how the results will be used.

A study that has strong project management but an unclear pharmacovigilance purpose is not well governed.

2. Roles and Responsibilities

A controlled PASS should have clearly assigned responsibilities for, as applicable, study sponsorship, medical and scientific oversight, epidemiology and statistics, pharmacovigilance, regulatory affairs, data management, quality assurance, privacy functions, study operations and external service providers.

The organisation should distinguish accountability from execution. Outsourcing an activity does not remove the MAH's responsibility for appropriate oversight.

3. PASS Within the PV Quality System

PASS governance should connect to the pharmacovigilance quality system rather than operate as an isolated research process.

Relevant quality-system elements can include written procedures, training and competence, documented responsibilities, controlled records, deviation management, CAPA, change control, vendor oversight, issue escalation and management oversight.

The depth of control should be proportionate to the study's regulatory status, complexity and risk.

4. Imposed PASS Requires Stronger Regulatory Control

An imposed non-interventional PASS is subject to specific EU regulatory procedures and oversight.

The organisation should therefore distinguish an imposed study from a voluntary study in its governance framework.

For an imposed study, the control system should explicitly track applicable regulatory requirements, submissions, procedural milestones, amendments, progress information, final reporting and commitments.

5. Governance of Voluntary PASS

A voluntary PASS is not necessarily a low-governance activity.

If the study addresses an important safety question or supports risk-management decisions, the same principles of scientific integrity, documentation, data quality and oversight remain important.

The principal difference is the regulatory basis and associated procedural obligations, not whether quality matters.

6. Study Charter and Governance Plan

For a complex PASS, a study-specific governance document can define objectives, roles, decision rights, escalation routes, meeting structures, deliverables, milestones, quality controls, data-access rules, publication controls and regulatory interfaces.

The exact document structure is an operational choice. The important requirement is that responsibilities and controls are clear and documented.

7. Scientific Independence

Scientific conclusions should be protected from inappropriate commercial influence.

This does not mean that the MAH cannot define the study question or review the work. It means that scientific decisions should be based on the protocol, data and appropriate methodology.

Governance should provide mechanisms for documenting and resolving legitimate scientific disagreement.

8. Protocol as the Primary Control Document

The protocol should provide the controlled basis for study conduct. It should define, as applicable, objectives, population, exposure, outcomes, data sources, study design, analysis methods, confounders, quality controls and reporting arrangements.

Operational documents should remain consistent with the approved protocol.

9. Protocol Deviations

A deviation should not automatically be treated as a trivial operational event.

The organisation should assess what occurred, why it occurred, whether it affected study integrity, whether participant or data protection was affected, whether the analysis remains valid, whether regulatory notification is required, and whether corrective action is necessary.

Important deviations should remain traceable from discovery through assessment and closure.

10. Change Control

PASS activities may evolve because of new evidence, data-source limitations, recruitment problems or regulatory developments.

Changes should be assessed before implementation where required.

For imposed non-interventional PASS, changes to key study characteristics can have formal regulatory implications. The organisation should therefore distinguish routine operational changes from changes requiring protocol amendment or regulatory review.

11. Quality by Design

Quality should be built into the study rather than added during final report review.

Examples include prespecified definitions, fit-for-purpose data sources, controlled data transformations, predefined analysis methods, documented quality checks, traceable programming, independent review of important outputs and controlled handling of deviations.

A final statistical review cannot reliably compensate for fundamental design weaknesses introduced at the beginning of the study.

12. Proportionality

PASS quality management should be risk-based.

A large multinational imposed PASS using multiple databases may require substantially more formal controls than a small exploratory voluntary study.

However, proportionality does not mean that fundamental scientific or regulatory requirements can be ignored. The objective is sufficient control to ensure reliable conclusions and compliance with applicable obligations.

Key Takeaways

PASS governance should connect the scientific question, study design, regulatory obligations and pharmacovigilance quality system.

The strongest governance models clearly assign accountability, preserve scientific integrity, control changes and deviations, and maintain appropriate oversight of internal and external contributors.

Imposed PASS require particular attention to formal regulatory procedures, while voluntary PASS still require appropriate scientific and quality governance.

References

  1. European Medicines Agency. Good Pharmacovigilance Practices (GVP), Module VIII — Post-authorisation safety studies.
  2. European Medicines Agency. Post-authorisation safety studies (PASS), including current procedural advice and Q&A.
  3. European Medicines Agency. GVP Module I — Pharmacovigilance systems and their quality systems.
  4. Commission Implementing Regulation (EU) No 520/2012, as amended.
  5. Directive 2001/83/EC, as amended.

Regulatory Note

This article is an educational explanation of PASS governance and quality management. It does not replace current EU legislation, GVP Module VIII, applicable PASS procedural guidance, study-specific regulatory requirements or the MAH's approved quality system.

Regulatory requirements and guidance may change. Current EMA and EU requirements should be verified before establishing or modifying a PASS governance framework.

13. Governance Across the PASS Lifecycle

PASS governance should continue from study conception through close-out. A useful lifecycle is:

Safety question
    ↓
Study decision
    ↓
Protocol and governance
    ↓
Regulatory submission / registration where applicable
    ↓
Study conduct
    ↓
Data quality and monitoring
    ↓
Analysis
    ↓
Final report
    ↓
Regulatory action / RMP impact
    ↓
Follow-up and closure

The controls required at each stage should be defined before the activity reaches that stage.

14. Study Oversight Committees

Complex studies may require formal governance groups such as steering committees or study-management teams.

Their responsibilities should be explicit. A committee should not exist merely as a meeting calendar.

The organisation should document:

Scientific decisions should remain attributable to appropriately qualified individuals.

15. Quality Management Plan

For a complex PASS, a quality-management plan can translate general quality-system expectations into study-specific controls.

It may define:

The plan should be proportionate to study complexity and should be consistent with the protocol.

16. Critical Data and Critical Processes

Not every study activity has the same impact on the validity of the final conclusion.

Critical areas may include:

Quality oversight should focus particularly on controls that could materially change the scientific conclusion if they fail.

17. Data Management Governance

Data management should preserve a clear chain from the original data source to the analytical dataset.

Important controls can include:

A final table should be traceable back to the analytical data and, where appropriate, the underlying source.

18. Statistical Programming and Reproducibility

Analytical programming should be sufficiently controlled that important results can be reproduced.

The organisation should consider controls for:

A PASS conclusion that cannot be reproduced from controlled data and code presents a significant governance weakness.

19. Vendor and CRO Oversight

External providers are common in PASS activities, particularly for epidemiology, database studies, data management, statistics and study operations.

Oversight should cover the critical activities rather than rely only on a supplier qualification performed before the study began.

Relevant controls can include:

The MAH should retain sufficient knowledge to challenge important vendor conclusions.

20. Joint Studies and Consortium Governance

A PASS may involve several organisations, particularly where a common data source or shared safety question is involved.

The governance agreement should clarify:

Shared study execution should not create ambiguity about regulatory accountability.

21. Safety Escalation During the Study

A PASS may generate information that requires action before the final report.

The study team should therefore have a defined route for escalating potentially important safety information to pharmacovigilance and regulatory functions.

The PASS should not become a closed research environment in which important safety findings wait for the final study report.

The appropriate PV process should assess whether expedited or other action is required under the circumstances.

22. Interface With Signal Management

PASS findings may contribute to signal detection, validation or evaluation.

The organisation should define how important emerging findings are communicated into signal management and how the relationship between the study and signal is documented.

A PASS can provide evidence relevant to a signal without itself being equivalent to a signal-management process.

23. Interface With the RMP

Where the PASS is part of an RMP, governance should maintain traceability between:

RMP safety concern / missing information
          ↓
PASS objective
          ↓
Study result
          ↓
Safety interpretation
          ↓
RMP reassessment
          ↓
Regulatory / risk-management action

A completed study should therefore trigger an appropriate assessment of what its results mean for the RMP rather than simply being marked complete administratively.

24. Interface With PSUR

PASS results may become important evidence in periodic safety evaluation.

The organisation should maintain a controlled process for ensuring that relevant interim or final findings are available to the PSUR process when applicable.

The PSUR should not contain a materially outdated safety narrative merely because a relevant PASS is managed by another department.

25. Interim Results and Emerging Evidence

Some PASS generate interim analyses or information before final study completion.

The organisation should define how interim findings are governed and who determines whether they require safety or regulatory action.

An interim result should not automatically be treated as a final scientific conclusion. Its limitations, uncertainty and intended use should be clear.

26. Publications and External Communication

Publication planning should not compromise regulatory obligations or scientific integrity.

Where study findings are published, the organisation should maintain appropriate controls over:

Publication review should not be used to suppress legitimate scientific findings.

27. Training and Competence

Personnel involved in PASS should have competence appropriate to their responsibilities.

Depending on the study, this may include training in:

Training records should support the organisation's ability to demonstrate competence.

28. CAPA and Root-Cause Analysis

Important PASS quality failures should be evaluated through the applicable quality-system process.

A useful root-cause analysis should distinguish between:

Corrective action should address the actual cause rather than merely repeating the failed control.

29. Management Oversight

Management oversight should consider whether PASS activities are progressing according to regulatory and scientific expectations.

Useful management information can include:

Metrics should support decisions and escalation rather than become an administrative exercise.

30. QPPV Oversight

The QPPV does not necessarily need to direct every study activity.

However, where a PASS is important to the pharmacovigilance system, the QPPV should have sufficient visibility to understand:

QPPV oversight should be proportionate to the study's significance and risk.

31. Inspection Evidence

A mature governance system should be able to produce a coherent evidence chain:

Study rationale
    ↓
Protocol
    ↓
Governance / responsibilities
    ↓
Regulatory records
    ↓
Study conduct
    ↓
Quality controls
    ↓
Data and analysis
    ↓
Final report
    ↓
Safety / regulatory impact
    ↓
Follow-up

The objective is not to create documents for an inspection. It is to preserve evidence that the study was effectively controlled.

Key Takeaways

PASS governance must remain active throughout the study lifecycle.

The most important controls concern critical data and processes, scientific independence, reproducibility, vendor oversight, safety escalation and interfaces with the wider pharmacovigilance system.

A PASS should never become isolated from signal management, the RMP or periodic safety evaluation.

References

  1. European Medicines Agency. Good Pharmacovigilance Practices (GVP), Module VIII — Post-authorisation safety studies.
  2. European Medicines Agency. Post-authorisation safety studies (PASS), including current procedural advice and Q&A.
  3. European Medicines Agency. GVP Module I — Pharmacovigilance systems and their quality systems.
  4. Commission Implementing Regulation (EU) No 520/2012, as amended.
  5. Directive 2001/83/EC, as amended.

Regulatory Note

This article is an educational explanation of PASS governance, oversight and quality management. It does not replace current EU legislation, GVP guidance, applicable study-specific requirements or an organisation's approved quality system.

Examples and inspection considerations are illustrative unless an authoritative source is specifically identified.

32. Common Governance Failure: Study Ownership Is Ambiguous

A PASS can involve pharmacovigilance, epidemiology, statistics, regulatory affairs, medical affairs, data management and external providers. If ownership is not explicit, important decisions can fall between functions.

The organisation should be able to identify who is accountable for the study as a whole and who owns critical decisions. A responsibility matrix can be useful, but it should reflect actual decision rights rather than merely list departments.

33. Common Governance Failure: Vendor Oversight Is Administrative

A vendor may deliver every contractual milestone while the MAH has little evidence that the scientific work was adequately challenged.

Vendor oversight should therefore consider the quality and scientific significance of deliverables, not only whether invoices and dates were managed.

For critical analyses, the MAH should retain sufficient subject-matter expertise to review assumptions, methods, limitations and conclusions.

34. Common Governance Failure: Deviations Are Closed Without Impact Assessment

A deviation record marked "closed" does not demonstrate that the deviation was scientifically evaluated.

The organisation should determine whether the deviation affects:

Where there is no impact, the rationale should still be proportionate to the significance of the deviation.

35. Common Governance Failure: Protocol Changes Are Made Informally

Informal changes create a risk that the final study no longer corresponds to the approved protocol.

Changes to important design characteristics should be identified, assessed and documented through the applicable change and regulatory processes.

The final report should make important departures from the planned methodology transparent.

36. Common Governance Failure: Emerging Safety Information Is Not Escalated

A PASS can generate important evidence before the planned final analysis.

A governance system that waits automatically for final study completion may delay appropriate pharmacovigilance action.

The study team should know how and when to escalate important emerging information to the appropriate pharmacovigilance and regulatory functions.

37. Common Governance Failure: Study Completion Is Treated as Regulatory Closure

A final study report does not necessarily mean that every related regulatory or pharmacovigilance action is complete.

After study completion, the organisation may still need to assess:

Administrative study close-out and pharmacovigilance closure are therefore not necessarily the same event.

38. Common Governance Failure: Quality Is Checked Only at the End

Late-stage QC can identify errors but cannot always repair weaknesses in study design, data collection or analysis.

A mature quality approach establishes controls at critical points throughout the lifecycle.

Examples include protocol review, source-data fitness assessment, programming review, deviation assessment, interim-data review and final-report QC.

39. Common Governance Failure: Quality Metrics Replace Scientific Oversight

A study can meet every milestone and still produce a scientifically weak result.

Management metrics should therefore include meaningful indicators of study quality and risk, not only schedule performance.

Possible indicators include unresolved critical deviations, data-quality concerns, major protocol changes, important analytical issues and emerging safety findings.

40. Inspection Scenario: The Study Is Complete but the RMP Was Never Reassessed

An inspector asks what the PASS results changed in the pharmacovigilance system.

The organisation can produce the final report but cannot demonstrate an assessment of its implications for the RMP.

This creates a governance gap because the study was treated as a research deliverable rather than as part of the safety-management system.

The appropriate response is not necessarily an RMP change. The organisation should be able to demonstrate that the impact was actually assessed and explain the conclusion.

41. Inspection Scenario: The Vendor Holds the Only Working Dataset

If the MAH cannot access or reconstruct the analytical dataset and associated derivations without relying on the vendor, there may be a significant continuity and oversight weakness.

Contracts and operational arrangements should preserve appropriate access to records and information needed to fulfil regulatory responsibilities.

The exact technical architecture may vary, but the MAH should not become unable to explain its own study because critical knowledge exists only outside the organisation.

42. Inspection Scenario: Different Functions Describe the Study Differently

Regulatory Affairs describes a PASS as complete, Pharmacovigilance considers it ongoing, and the study vendor has another milestone date.

Such discrepancies can indicate weak governance even if the underlying study is scientifically sound.

The organisation should maintain a controlled common record of the study's regulatory status, milestones, obligations and completion criteria.

43. Inspection Scenario: The Final Report Cannot Be Reproduced

An inspector asks how an important result was generated.

The organisation has the final table but cannot identify the dataset version, derivation logic or programme that produced it.

This is a data-integrity and reproducibility concern. For critical analyses, the organisation should preserve enough information to reconstruct the analytical process.

44. Inspection Scenario: A Critical Deviation Was Minimized

A major data-source problem is documented as a routine deviation without evaluating its potential effect on the study conclusion.

The problem is not necessarily the existence of the deviation. It is the absence of an appropriate scientific impact assessment.

The organisation should demonstrate how the issue was evaluated and whether corrective or preventive action was required.

45. Governance Model for a Mature PASS

A mature model can be represented as:

Scientific question
       ↓
Regulatory classification
       ↓
Risk-based governance plan
       ↓
Protocol + quality controls
       ↓
Controlled conduct
       ↓
Continuous oversight
       ↓
Data / analysis integrity
       ↓
Independent scientific review
       ↓
Final conclusion
       ↓
PV / regulatory impact assessment
       ↓
Implementation and follow-up

This model keeps the PASS connected to the wider pharmacovigilance system.

46. Minimum Governance Evidence

For a significant PASS, the organisation should normally be able to locate, as applicable:

The exact record set should be proportionate to the study.

47. Final QPPV Governance Checklist

For a significant PASS, the QPPV or appropriate PV governance forum should be able to answer:

  1. What safety question is the study addressing?
  2. Why is this study appropriate?
  3. What is its regulatory status?
  4. Who is accountable for it?
  5. What are the critical quality risks?
  6. How are important deviations handled?
  7. How are vendors overseen?
  8. How are emerging safety findings escalated?
  9. Can critical analyses be reproduced?
  10. What did the final results mean for the safety profile?
  11. What did they mean for the RMP?
  12. What did they mean for signal management?
  13. What did they mean for subsequent PSURs?
  14. What regulatory action was required?
  15. How was completion verified?

If these questions can be answered from controlled evidence, PASS governance is much more likely to be effective rather than merely documented.

Key Takeaways

Effective PASS governance is an end-to-end control system.

The most important distinction is between performing a study and governing a pharmacovigilance activity. The latter requires accountability, scientific oversight, quality controls, regulatory awareness, data integrity and integration with the wider PV system.

The final study report is an important deliverable, but it is not the end of governance. The organisation must understand what the study means for safety, risk management, signal management, periodic evaluation and regulatory commitments.

References

  1. European Medicines Agency. Good Pharmacovigilance Practices (GVP), Module VIII — Post-authorisation safety studies.
  2. European Medicines Agency. Post-authorisation safety studies (PASS), including current procedural advice and Q&A.
  3. European Medicines Agency. GVP Module I — Pharmacovigilance systems and their quality systems.
  4. European Medicines Agency. GVP Module V — Risk management systems.
  5. European Medicines Agency. GVP Module VII — Periodic safety update report.
  6. Commission Implementing Regulation (EU) No 520/2012, as amended.
  7. Directive 2001/83/EC, as amended.

Regulatory Note

This article is an educational explanation of PASS governance, oversight and quality management. It does not replace current EU legislation, GVP guidance, applicable PASS procedural requirements or an organisation's approved quality system.

Regulatory requirements may change. Current EMA and EU requirements should be verified before establishing, modifying or closing a PASS.

Inspection scenarios in this article are illustrative and are not presented as quotations or claims about specific inspection findings unless an authoritative source is identified.

Revision History

Related Articles

GVP Module I Explained: Pharmacovigilance Systems and Quality Systems

Explains the EU GVP Module I framework for pharmacovigilance systems and quality systems, including governance, responsibilities, controls, evidence, QPPV oversight and inspection readiness.

GVP Module VIII: PASS Inspection and Audit Findings

A practical inspection-focused guide to PASS evidence, traceability, study governance, data quality, regulatory commitments and the distinction between illustrative failure modes and documented inspection findings.

EU Pharmacovigilance Inspection Findings: Cross-Functional and Interface Controls

A practical framework for understanding how inspectors test whether pharmacovigilance responsibilities and information flows remain effective across organisational boundaries.

Last reviewed: 2026-08-24