GVP Module VIII: PASS Inspection and Audit Findings

Introduction

A PASS can be scientifically well designed and still be poorly controlled as a pharmacovigilance process. Conversely, a study can encounter an operational difficulty without that difficulty necessarily constituting a regulatory deficiency. Inspection and audit therefore require a disciplined distinction between the legal requirement, the evidence that demonstrates implementation, and the professional judgement used to evaluate effectiveness.

For a PASS, an inspector or auditor is ultimately interested in whether the organisation can demonstrate control over the study from the question that initiated it through protocol development, conduct, analysis, reporting and the actions taken in response to the results. GVP Module VIII establishes the pharmacovigilance framework for PASS, while the broader GVP quality-system and inspection framework determines how the organisation's controls and evidence are assessed. citeturn0search25turn0search8

This article therefore does not present an invented list of "typical findings". Where no authoritative inspection finding is cited, examples are explicitly treated as illustrative scenarios or potential failure modes.

1. What a PASS Inspection Is Testing

The first question is not whether every study document is perfect. It is whether the pharmacovigilance system has maintained effective control over a safety activity that may generate evidence for regulatory decision-making.

Depending on the study and its regulatory status, an inspection may therefore examine:

• why the study was initiated;
• how its regulatory status was determined;
• whether the protocol addressed the safety question;
• whether the study was conducted according to the approved or applicable protocol;
• whether important deviations were identified and assessed;
• whether data were reliable and sufficiently controlled;
• whether the analysis was consistent with the protocol;
• whether emerging safety information was escalated appropriately;
• whether the final report accurately represented the evidence;
• and whether the results were incorporated into the wider pharmacovigilance system.

The inspection perspective is consequently broader than document availability. Evidence of effective control is the connecting concept.

2. The Regulatory Status Determines the Control Framework

Before evaluating a PASS process, the organisation should establish what regulatory category applies to the study.

GVP Module VIII covers non-interventional PASS initiated, managed or financed voluntarily by an MAH or pursuant to an obligation imposed by an EU competent authority. Imposed non-interventional PASS are subject to the specific Articles 107n–107q framework, whereas a PASS included in an RMP or conducted voluntarily does not automatically acquire the same legal status. citeturn0search25

That distinction affects what an inspector can reasonably expect to see. For an imposed PASS, regulatory submission, assessment and follow-up controls form part of the applicable legal framework. For a voluntary study, the organisation still needs appropriate pharmacovigilance governance and quality controls, but an internal recommendation should not be presented as though it were a statutory obligation.

This is why inspection preparation should begin with a regulatory classification record, not with a generic PASS checklist.

3. The First Evidence Chain: Why the Study Exists

A reviewer should be able to trace the study back to the safety question it was intended to address.

That question may arise from:

• an identified or potential risk;
• missing information;
• a signal;
• uncertainty about a risk-minimisation measure;
• a regulatory requirement;
• an RMP commitment;
• or another pharmacovigilance need.

The reason for the study establishes the context against which its objectives and results are interpreted.

If the organisation cannot explain why the study was necessary, later controls become difficult to evaluate. A protocol can be methodologically sophisticated but still fail to answer the question that motivated the study.

4. Protocol Control Is the Foundation of Inspection Traceability

The protocol establishes the planned relationship between the research question, population, exposure, outcomes, data sources and analysis.

An inspection may therefore compare the approved or applicable protocol with:

• the study actually conducted;
• amendments;
• deviations;
• statistical analysis;
• interim analyses;
• and the final report.

The purpose is not to demand that no change ever occurs. Long-running observational studies may encounter changes in data availability, coding, population size or feasibility. The control question is whether the organisation recognised the change, assessed its significance, obtained any required approval or regulatory agreement, documented the decision and preserved the relationship between the original question and the revised methodology.

5. Study Conduct and Protocol Deviations

A protocol deviation becomes important when it can affect the validity, interpretation or regulatory acceptability of the study.

The organisation should therefore distinguish minor operational departures from deviations that affect critical aspects of the study.

For a significant deviation, an effective process should establish:

1. what happened;
2. when it happened;
3. why it happened;
4. which study elements were affected;
5. whether data quality or interpretability was affected;
6. whether corrective action was required;
7. whether regulatory notification or approval was required;
8. and how the deviation was reflected in the analysis and final report.

The absence of deviations is not itself evidence of quality. A mature system identifies deviations honestly and evaluates their consequences.

6. Data Quality Is Part of the Safety Evidence

PASS conclusions depend on the data from which they are derived. Inspection therefore extends beyond whether the final dataset exists.

Depending on the design, relevant controls may include:

• data-source qualification;
• data extraction controls;
• coding and classification rules;
• reconciliation;
• missing-data management;
• validation of key variables;
• audit trails;
• database access controls;
• and documented data-cleaning decisions.

The appropriate controls depend on the study design and data source. The underlying principle is that important analytical results should be traceable to sufficiently reliable source information.

7. Statistical Analysis Must Remain Traceable to the Question

An inspection may compare the planned analysis with the analysis actually performed.

Changes are not necessarily problematic. They become important when the organisation cannot explain why they occurred or whether they altered interpretation.

For example, an analysis may change because a planned variable is unavailable or because an unforeseen methodological problem emerges. The organisation should then preserve the reasoning, determine whether the change affects the study's validity and ensure that the final report transparently describes the departure from the original plan.

A statistically sophisticated analysis is not a substitute for transparent methodological governance.

8. Emerging Safety Information Cannot Wait for Study Closure

A PASS is part of pharmacovigilance while it is being conducted. A study team may therefore encounter information that has implications beyond the original research question before the final report is completed.

The governance model should provide a route for escalation of potentially important findings to the appropriate pharmacovigilance function.

This does not mean that every preliminary observation becomes a regulatory signal. It means that the organisation should have a controlled mechanism for recognising potentially important information, assessing it and determining whether further action is warranted.

9. The Final Report Is the Beginning of the Decision Process

For an imposed non-interventional PASS, the final study results enter a defined regulatory assessment process. EMA publishes outcomes of such assessments, and PRAC, CHMP and CMDh have roles depending on the applicable regulatory context. citeturn0search1turn0search10

Consequently, inspection should not stop at the final report.

The organisation should be able to demonstrate how the results were interpreted and, where applicable, how they affected:

• the safety profile;
• signal management;
• the RMP;
• risk-minimisation measures;
• product information;
• subsequent aggregate reports;
• regulatory commitments;
• and further evidence generation.

This creates the second major evidence chain: study result → pharmacovigilance interpretation → action or documented no-action.

10. What Counts as Evidence of Effective Implementation

A policy or SOP demonstrates what the organisation says it will do. It does not by itself demonstrate that the process works.

For PASS, stronger evidence may include the controlled protocol, approval records, amendment assessments, deviation records, data-quality documentation, analysis outputs, review records, final report, regulatory correspondence and evidence of resulting actions.

The appropriate evidence depends on the process being inspected. The objective is to demonstrate that the organisation's stated control actually operated in practice.

11. The QPPV's Role in PASS Oversight

The QPPV does not necessarily perform the technical epidemiological work. The oversight responsibility is to ensure that significant PASS activity is appropriately integrated into the pharmacovigilance system.

For an important study, this may require visibility of:

• the safety question;
• regulatory status;
• significant methodological issues;
• emerging safety findings;
• final conclusions;
• regulatory consequences;
• and implementation of resulting actions.

The exact governance mechanism can vary. What matters is that significant information can reach the appropriate decision-makers and that responsibilities are clear.

12. Audit and Inspection Are Not the Same Activity

A pharmacovigilance audit is an independent quality-system activity designed to assess processes and controls according to its defined scope. A regulatory inspection is conducted by a competent authority to assess compliance with applicable requirements.

The two activities can examine similar evidence, but they have different purposes and authority.

An internal audit may identify an opportunity to strengthen a PASS process before a regulatory inspection occurs. It should not, however, be described as though its observations were regulatory inspection findings.

This distinction is important when reporting lessons from internal quality activities.

Key Takeaways

PASS inspection readiness is best understood as traceability plus evidence of effective control.

The organisation should be able to connect the reason for the study to its protocol, conduct, data, analysis, conclusions and subsequent pharmacovigilance or regulatory action.

A potential weakness becomes meaningful when it affects the ability to demonstrate compliance, reliability, scientific validity or effective governance. Not every operational imperfection is a regulatory finding.

The next part of this article examines the specific failure patterns that can break this evidence chain and how an experienced PV professional would investigate them.

References

1. European Medicines Agency. Good Pharmacovigilance Practices (GVP), Module VIII — Post-authorisation safety studies, Rev. 3.
2. European Medicines Agency. Post-authorisation safety studies (PASS), including current procedural guidance and questions and answers.
3. European Medicines Agency. Outcomes of imposed non-interventional post-authorisation safety studies.
4. European Medicines Agency. Coordination of pharmacovigilance inspections.
5. European Medicines Agency. GVP Module I — Pharmacovigilance systems and quality systems.
6. Commission Implementing Regulation (EU) No 520/2012, as amended.
7. Directive 2001/83/EC, as amended.
8. Regulation (EC) No 726/2004, as amended.

Regulatory Note

This article distinguishes legal requirements, GVP guidance, regulatory procedure and recommended operational practice. It does not present invented inspection findings. Examples identified as scenarios or failure modes are illustrative unless an authoritative inspection source is specifically cited.

Current EU legislation, EMA procedural guidance and applicable national requirements should be verified when applying this framework to an actual PASS.

13. Failure Pattern: The Study Objective No Longer Matches the Safety Question

A PASS can remain technically compliant with its original protocol while becoming less useful to the pharmacovigilance question that motivated it. This can occur when the safety profile changes, the target population changes, a signal evolves or the original uncertainty becomes less relevant.

The inspection issue is not simply that the objective became outdated. The issue is whether the organisation recognised the change and assessed whether the study remained fit for purpose.

An experienced reviewer would therefore compare the original safety rationale with subsequent safety information, protocol amendments, governance discussions and the final interpretation.

14. Failure Pattern: Important Amendments Are Treated as Administrative Changes

A change to a data source, outcome definition, population or analytical method can affect the scientific meaning of a PASS. Treating such a change as document maintenance can break the traceability between the approved study design and the final evidence.

A controlled amendment process should identify the scientific consequence of the proposed change before implementation. For an imposed non-interventional PASS, the applicable regulatory procedure must also be considered. Current EMA guidance provides a defined process for substantial amendments. citeturn0search10

The key inspection question is therefore: Can the organisation show why the change was made, what its consequences were, and why the revised study remained capable of answering the safety question?

15. Failure Pattern: Deviations Are Recorded but Not Interpreted

A deviation log can demonstrate that events were recorded, but it does not demonstrate that their consequences were understood.

Suppose a data source becomes temporarily unavailable and a study team substitutes another source. Recording the event is necessary, but the scientific assessment must determine whether the substitute population, exposure measurement or outcome ascertainment remains comparable.

The final report should reflect material deviations and their implications. Otherwise the inspection record may show documentation without effective quality control.

16. Failure Pattern: Data Reconciliation Cannot Be Explained

A PASS may use multiple databases or data sources. Differences between source counts, analytical datasets and reported results can therefore occur for legitimate reasons.

The weakness arises when the organisation cannot explain the differences.

An inspector may select an important result from the final report and ask how it was derived. The organisation should be able to move backwards through the analytical dataset, transformation rules and source data sufficiently to demonstrate the result's provenance.

This does not require every inspection to reproduce the entire analysis manually. It requires a controlled and intelligible evidence trail.

17. Failure Pattern: Statistical Changes Are Hidden in the Final Report

A study may require unplanned analyses because the data behave differently from anticipated. Such changes can be scientifically appropriate.

The problem arises when the final report presents the revised analysis without explaining that the original plan changed, why it changed and whether the change could influence interpretation.

A transparent report protects the credibility of the analysis even when the methodological change was necessary.

18. Failure Pattern: Preliminary Findings Are Not Connected to Pharmacovigilance

A PASS may produce interim information that has potential relevance to a known or emerging safety concern.

The organisation should have defined criteria for escalation rather than relying entirely on the study team's judgement at the end of the project.

An escalation mechanism should allow potentially important information to reach the appropriate pharmacovigilance function, where it can be evaluated within the broader signal-management and regulatory framework.

The existence of an escalation process does not mean that every preliminary result is treated as a confirmed signal. It means that potentially important information is not lost because the final report has not yet been completed.

19. Failure Pattern: The Final Report Is Scientifically Complete but Regulatory Follow-Up Is Weak

A high-quality final report may still leave the organisation with significant work.

For an imposed PASS, the regulatory assessment can lead to changes affecting the marketing authorisation. EMA's published PASS outcomes illustrate that final-result assessments can lead to variation of marketing authorisations and corresponding alignment activities for other products containing the same active substance where applicable. citeturn0search1

The inspection question therefore extends beyond report quality: What did the organisation do after learning the result?

20. Failure Pattern: The RMP Interface Is Assumed Rather Than Assessed

A PASS can be included in an RMP because it addresses a safety concern or evaluates the effectiveness of risk minimisation. The completion of the study should therefore trigger an assessment of what the results mean for the RMP.

The conclusion may be that no update is required. That can be an entirely appropriate outcome.

What matters is that the organisation can demonstrate that the question was actually considered and that the conclusion was supported by the evidence.

21. Failure Pattern: Risk-Minimisation Effectiveness Is Confused With Study Completion

Where a PASS evaluates a risk-minimisation measure, the existence of a final report does not itself demonstrate that the measure was effective.

The organisation should distinguish:

measure implemented → population reached → behaviour or process changed → intended risk reduction achieved.

The appropriate endpoints depend on the measure and study design. A process metric can demonstrate implementation while providing little evidence of clinical effectiveness.

This distinction is particularly important when PASS results feed directly into RMP decisions.

22. Failure Pattern: Vendor Oversight Stops at Contract Management

A CRO or other vendor may conduct substantial parts of a PASS. A contract, however, is not evidence that the MAH exercised effective oversight.

The organisation should be able to demonstrate appropriate qualification, defined responsibilities, data-quality controls, issue escalation, review of important analyses and scientific review of conclusions.

The degree of oversight should be proportionate to the criticality and complexity of the outsourced activity.

23. Failure Pattern: Regulatory Commitments Are Tracked Separately From the Study

A study tracker may show that the study is complete while a regulatory commitment tracker still contains an open obligation.

This can happen when project management and regulatory governance use separate systems without reconciliation.

The solution is not necessarily to create one universal database. The essential control is a reliable relationship between the study lifecycle and the regulatory commitment lifecycle.

24. Failure Pattern: The Organisation Cannot Reconstruct What Was Submitted

A final report stored in a document-management system is not necessarily the same version that was submitted to the authority.

For regulated submissions, the organisation should retain sufficient evidence to establish:

• what version was submitted;
• when it was submitted;
• through which applicable route;
• who approved it;
• and what regulatory correspondence followed.

This becomes particularly important when the submitted document differs from an earlier internally approved draft.

25. Failure Pattern: Audit Findings Are Treated as Regulatory Findings

An internal audit may identify weaknesses in PASS governance. That observation should be managed through the quality system, including appropriate root-cause analysis and corrective action.

It should not be described externally as an "EMA finding" or "inspection finding" unless an authority actually made that finding.

This distinction protects the accuracy of the organisation's compliance history and prevents internal learning from becoming distorted as it is passed between governance forums.

26. How an Experienced Reviewer Investigates a Weakness

An experienced PV professional does not begin by asking which SOP was violated. The first question is usually what the weakness could affect.

A useful sequence is:

Observation
    ↓
What requirement or control applies?
    ↓
What process actually occurred?
    ↓
What evidence demonstrates that?
    ↓
What was the scientific / regulatory consequence?
    ↓
Was the issue detected internally?
    ↓
Was it corrected?
    ↓
Was the correction effective?

This prevents superficial CAPA. A missing signature may be a documentation error, but it may also reveal that a required review never happened. The investigation must distinguish the visible defect from the underlying control failure.

27. Root Cause Should Explain the Control Failure

If a PASS deviation was not escalated, a root cause such as "human error" is rarely sufficient by itself.

The investigation should ask why the system allowed the error to occur and remain undetected. Possible contributing factors might include unclear criteria, insufficient training, ambiguous ownership, inadequate system prompts, workload, ineffective review or poor escalation design.

The correct root cause depends on evidence. It should not be selected merely because it fits a familiar CAPA category.

28. CAPA Effectiveness Is a Separate Question

Correcting the individual PASS record does not necessarily demonstrate that the underlying problem has been fixed.

For example, adding a missing review to one report may close the immediate documentation gap while leaving the process vulnerable to recurrence.

An effective CAPA should therefore have a defined success criterion appropriate to the identified root cause. The organisation should be able to demonstrate that the control changed and that the change worked.

29. Inspection Questions That Reveal Process Maturity

An inspector may explore the same process through increasingly detailed questions:

1. Show me the PASS protocol.
2. Why was this study required?
3. Who approved the protocol?
4. What changed during the study?
5. How were deviations assessed?
6. How do you know the key data are reliable?
7. What did the study find?
8. Who assessed the safety implications?
9. What changed in the RMP or product information?
10. What regulatory action followed?
11. How was implementation verified?
12. How did you ensure the issue was considered in subsequent pharmacovigilance activities?

The questions progressively move from document existence to system effectiveness.

30. Minimum Inspection Evidence Set

The precise evidence package depends on the PASS, but a mature organisation should normally be able to retrieve, as applicable:

• safety rationale;
• regulatory classification;
• protocol and approval;
• amendments;
• study governance records;
• deviation records;
• data-quality documentation;
• analysis plans and outputs;
• final report;
• scientific review;
• regulatory correspondence;
• RMP impact assessment;
• signal-management impact assessment;
• product-information assessment;
• implementation records;
• and evidence of follow-up or closure.

The objective is not to maximise document volume. It is to preserve the evidence necessary to explain significant decisions.

Key Takeaways

The most consequential PASS weaknesses are often interface failures: protocol versus conduct, data versus analysis, study results versus pharmacovigilance assessment, study completion versus regulatory commitment closure, or implementation versus effectiveness.

An experienced reviewer follows those interfaces because that is where a technically complete study can fail to function as an effective pharmacovigilance activity.

The next section develops the governance model needed to prevent these failures and to demonstrate sustained control across the PASS lifecycle.

Regulatory Note

The failure patterns in this section are illustrative. They are not presented as documented regulatory inspection findings unless an authoritative source is specifically cited.

Legal requirements, GVP guidance, regulatory procedures and recommended operational controls should be distinguished when evaluating an actual PASS.

31. From Individual Findings to System Effectiveness

An inspection should ultimately move beyond individual documents and ask whether the organisation's controls work as a system.

For PASS, this means considering whether regulatory classification, study governance, data management, scientific review, pharmacovigilance integration and regulatory follow-up reinforce one another.

A process may contain many documented controls and still be ineffective if they operate independently. The useful test is whether an important safety question can move reliably through the system from identification to evidence generation and then to action.

32. Governance Across the PASS Lifecycle

A mature governance model assigns responsibility at each stage without fragmenting accountability.

A practical structure is:

Safety / regulatory need
        ↓
PV governance
        ↓
Protocol and regulatory assessment
        ↓
Study execution
        ↓
Data and scientific review
        ↓
Final interpretation
        ↓
Regulatory / PV impact assessment
        ↓
Implementation
        ↓
Follow-up and closure

Different functions may own individual activities, but the organisation should maintain a clear route for escalation and decision-making across those boundaries.

33. Cross-Functional Interfaces

PASS commonly crosses Pharmacovigilance, Epidemiology, Biostatistics, Regulatory Affairs, Medical Affairs, Clinical or Data functions, Quality and external providers.

The risk is not simply that several departments participate. The risk is that each function sees only its own part of the process.

Governance should therefore make the important hand-offs explicit. For example, a statistical finding should reach the appropriate medical and PV reviewers; a regulatory outcome should reach the team responsible for the RMP and product information; and an implementation action should be visible to the governance function responsible for confirming completion.

34. Management Review and Escalation

Not every PASS requires senior management involvement. Significant studies should, however, have a mechanism for escalation when their risk, complexity or regulatory importance exceeds normal operating conditions.

Escalation triggers may include:

• major protocol changes;
• significant data-quality concerns;
• important unexpected findings;
• substantial delays;
• inability to meet a regulatory milestone;
• disagreement over scientific interpretation;
• or regulatory action affecting the marketing authorisation.

The trigger should be based on the significance of the event rather than on organisational hierarchy alone.

35. Quality Metrics Should Measure Control, Not Activity

Counting completed PASS milestones can provide useful operational information, but activity metrics alone do not demonstrate an effective process.

More informative measures may examine:

• overdue regulatory milestones;
• unresolved critical deviations;
• time to escalation of important findings;
• recurring amendment causes;
• data-quality issues;
• overdue implementation actions;
• CAPA recurrence;
• or effectiveness of controls introduced after previous problems.

Metrics should be interpreted rather than treated as compliance scores. A low number of deviations, for example, may indicate good control or poor detection.

36. Inspection Readiness Is a Continuous State

Inspection readiness should not begin when an inspection notice arrives.

The organisation should maintain sufficient records and governance throughout the PASS lifecycle so that a significant study can be reconstructed without emergency document collection.

This is particularly important for long-running observational studies, where personnel, vendors, data sources and regulatory circumstances can change before the study is completed.

37. Practical Scenario: A Long-Running PASS Changes Hands

A PASS remains active after the original study lead leaves the organisation and a new vendor assumes data-management responsibilities.

A mature system would preserve the protocol history, responsibilities, data specifications, deviations, analysis decisions and regulatory correspondence so that the new team can continue the study without losing institutional knowledge.

If the organisation instead relies on individual memory, the transition itself becomes a control risk.

38. Practical Scenario: The Data Source Changes

Suppose a registry used by the study changes its data structure and the study team migrates to a replacement source.

The organisation should assess whether the change affects population coverage, exposure ascertainment, outcome definitions, missingness or comparability with earlier data.

The correct response is not automatically to reject the change. It is to assess and document its consequences and determine whether protocol amendment, statistical adaptation, regulatory interaction or additional validation is required.

39. Practical Scenario: The Study Finds No New Safety Signal

A PASS may find no evidence supporting the suspected association that motivated the study.

That result can be valuable, but the organisation should still assess whether the study adequately addressed the question, what uncertainty remains and whether the result changes the RMP, signal-management strategy or future evidence needs.

"No new signal" is therefore a scientific finding, not automatically a conclusion that the study has no further relevance.

40. Practical Scenario: The Study Produces an Important Unexpected Finding

Conversely, a study may identify an unexpected association outside its primary objective.

The study team should not assume that the finding belongs only in the final report. The appropriate pharmacovigilance pathway should evaluate the information according to its seriousness, plausibility, evidence strength and potential public-health significance.

The PASS then becomes one source of evidence within the broader safety assessment.

41. The Relationship Between Audit, CAPA and Inspection

An internal audit can identify a weakness before a regulator does. The organisation should then determine whether the observation reflects an isolated event or a broader control problem.

Where CAPA is required, the corrective action should address the underlying cause and have a defined effectiveness assessment.

An organisation that repeatedly identifies the same PASS weakness through successive audits may have a CAPA effectiveness problem even if every individual audit observation was formally closed.

The purpose of the quality system is therefore not simply to close observations. It is to improve the reliability of the process.

42. What Good PASS Governance Looks Like

A mature PASS system has several characteristics in combination:

• the regulatory status is understood;
• the safety question is explicit;
• protocol and amendments are controlled;
• data quality is proportionate to the study's criticality;
• deviations are assessed rather than merely recorded;
• emerging findings can be escalated;
• scientific interpretation is independent and traceable;
• regulatory consequences are assessed;
• RMP and product-information interfaces are controlled;
• outsourced activities remain under MAH oversight;
• commitments are tracked through closure;
• and the QPPV has appropriate visibility of significant safety implications.

None of these controls should be evaluated in isolation. Their value comes from the continuity they create across the study lifecycle.

43. A PASS Inspection Readiness Test

A useful internal test is to select one important PASS and ask whether an independent reviewer could reconstruct the following without interviewing the original study team:

Why was the study required?
        ↓
What was it designed to answer?
        ↓
What actually happened?
        ↓
What evidence was generated?
        ↓
How reliable was the evidence?
        ↓
What did the organisation conclude?
        ↓
What did the regulator conclude, if applicable?
        ↓
What changed?
        ↓
How was implementation verified?
        ↓
What remains under monitoring?

If the chain breaks, the organisation has identified an inspection-readiness improvement opportunity even if no regulatory deficiency has occurred.

44. The Evidence Matrix

For significant PASS, an evidence matrix can be a useful operational control. It need not become another bureaucratic document; its purpose is to make the relationship between requirement, evidence, owner and status visible.

The specific evidence will vary by study. The principle is to make critical control points demonstrable.

45. Final QPPV Questions

For a significant PASS, the QPPV should be able to obtain clear answers to the following:

• What safety question is the study addressing?
• What is the regulatory status of the study?
• Is the protocol still fit for purpose?
• Have important deviations or amendments been assessed?
• Are the critical data sufficiently reliable?
• Were important emerging findings escalated appropriately?
• What did the study actually establish?
• What uncertainty remains?
• Does the result affect the RMP or risk minimisation?
• Does it affect signal management or aggregate reporting?
• What regulatory action followed, where applicable?
• Were resulting actions implemented effectively?
• Can the complete evidence chain be demonstrated?

These questions provide a governance test rather than a replacement for the applicable regulatory requirements.

46. Final Perspective

The strongest PASS systems are not those that produce the largest number of documents. They are the systems in which the important relationships between documents, decisions and actions remain visible.

The protocol explains the question. The study generates evidence. Scientific review explains what the evidence means. Regulatory assessment determines what follows where applicable. The quality system ensures that the resulting decisions are implemented and remain traceable.

That continuity is what allows a PASS to function as a pharmacovigilance activity rather than as an isolated research project.

Key Takeaways

PASS inspection and audit readiness is fundamentally an exercise in demonstrating effective control over evidence generation and the decisions that follow from it.

The most useful inspection preparation is therefore not a collection of documents assembled shortly before an inspection. It is a functioning governance system in which regulatory status, study design, conduct, data quality, scientific interpretation, regulatory action and follow-up remain connected.

Potential failure modes should be investigated for their effect on the underlying control system. Internal audit observations should not be misrepresented as regulatory findings, and illustrative scenarios should not be presented as documented inspection history.

For the QPPV, the final test is simple: significant PASS evidence should reach the right pharmacovigilance decisions, those decisions should produce controlled action where necessary, and the organisation should be able to demonstrate why the resulting action—or no-action conclusion—was appropriate.

References

1. European Medicines Agency. Good Pharmacovigilance Practices (GVP), Module VIII — Post-authorisation safety studies, Rev. 3.
2. European Medicines Agency. Post-authorisation safety studies (PASS), including current procedural guidance and questions and answers.
3. European Medicines Agency. Outcomes of imposed non-interventional post-authorisation safety studies.
4. European Medicines Agency. Coordination of pharmacovigilance inspections.
5. European Medicines Agency. GVP Module I — Pharmacovigilance systems and quality systems.
6. European Medicines Agency. GVP Module IV — Pharmacovigilance audits.
7. Commission Implementing Regulation (EU) No 520/2012, as amended.
8. Directive 2001/83/EC, as amended.
9. Regulation (EC) No 726/2004, as amended.

Regulatory Note

This article distinguishes legal requirements, GVP guidance, regulatory procedure, audit practice and recommended operational controls. It does not present invented inspection findings. Illustrative scenarios are explicitly educational unless an authoritative inspection source is identified.

Current EU legislation, EMA procedural guidance and applicable national requirements should be verified when applying this framework to an actual PASS.