How Often Should a PSMF be Reviewed?

The Pharmacovigilance System Master File (PSMF) should be maintained as a living document that accurately reflects the current pharmacovigilance system at all times.

There is No Universal Review Frequency

Regulations generally focus on ensuring that the PSMF remains accurate and current rather than prescribing a specific review interval.

Organisations should establish review processes that ensure significant changes are reflected promptly.

Events That Should Trigger a Review

• Appointment of a new QPPV
• Changes to deputy arrangements
• New vendor relationships
• Safety database changes
• Organisational restructuring
• Governance changes
• Inspection findings

Periodic Reviews

Many organisations perform formal quarterly, semi-annual or annual reviews of the PSMF to confirm continued accuracy.

These reviews often complement change-driven updates.

Inspection Perspective

Inspectors frequently compare the PSMF against actual practice. Discrepancies may indicate weaknesses in oversight, governance or document maintenance.

Practical Perspective

The best review frequency is one that ensures the PSMF always reflects reality. Effective organisations treat the PSMF as a continuously maintained management document rather than a periodic compliance exercise.

QPPV Oversight

A complete and inspection-ready PSMF must describe not just structures and processes, but also how the Qualified Person responsible for Pharmacovigilance (QPPV) is appointed, supported and overseen. QPPV oversight is central to PSMF accuracy, PV system performance and regulatory compliance. The sections below expand practical, regulatory and inspection-relevant detail on QPPV oversight and how it should be reflected in PSMF maintenance and review processes.

Regulatory Context

• The QPPV is a regulatory requirement for marketing authorisations in the EU/EEA and is central to the pharmacovigilance system. Guidance (including EMA GVP modules) sets out that the QPPV must be suitably qualified, permanently and continuously available to perform their duties, and able to exercise oversight of the whole PV system.
• Regulators expect documented arrangements demonstrating the QPPV's authority and ability to ensure compliance with expedited reporting, signal detection, risk management and corrective actions across affiliates, vendors and partners.
• The PSMF should include the QPPV's name, contact details, qualifications or CV, scope of responsibility, delegation arrangements, and evidence of their oversight and availability.

Roles and Responsibilities — What Oversight Means

QPPV oversight is more than a job title. It encompasses:

• Accountability for establishing and maintaining the pharmacovigilance system (policies, SOPs, processes).
• Ensuring timely and accurate individual case safety report (ICSR) reporting and aggregate safety reporting.
• Overseeing signal detection, safety surveillance, pharmacovigilance inspections and audit programmes.
• Authorising and approving safety documentation and regulatory submissions where required.
• Holding authority to escalate safety concerns to senior management and to trigger CAPA or product-level risk actions.
• Maintaining an up-to-date delegation log, showing activities and responsibilities formally delegated to deputies, affiliates, vendors or contractors.

These responsibilities must be documented and demonstrable in the PSMF.

Practical Implementation — Building an Oversight Framework

Use a structured programme to make QPPV oversight operational and auditable:

1. Governance and Authority
2. Maintain a written PV governance charter or terms of reference that document the QPPV’s reporting line, decision-making authority, and escalation routes to senior management and regulatory affairs.

3. Include a RACI (Responsible, Accountable, Consulted, Informed) matrix for key PV activities (case processing, aggregate reporting, signal management, audits, inspections) showing the QPPV’s accountabilities.

4. Delegation and Deputies

5. Keep a delegation log that records delegated tasks, names, limits of delegation, effective dates and revocation. Update the PSMF each time delegation changes.

6. Deputies must be named with CVs, contact details and documented training/competence records. Include arrangements for 24/7 availability or on-call rotas where applicable.

7. Availability and Contactability

8. Document how the QPPV is continuously available (on-call rota, contact details, emergency escalation plan) and include evidence of availability testing (e.g., periodic contact checks, call logs).

9. For multinational companies with remote affiliates, describe how the QPPV maintains oversight (regular meetings, access to case management systems, review of affiliate reports).

10. Oversight of Third Parties

11. Include vendor oversight processes in the PSMF: vendor qualification, PV obligations in contracts (MAH responsibilities retained), service level agreements, audit schedules and follow-up of CAPAs.

12. Ensure the QPPV has documented means to access vendor systems and data necessary to meet regulatory obligations (case data, signal outputs, audit findings).

13. Meetings, Reviews and Records

14. Schedule regular governance meetings chaired by or attended by the QPPV (monthly PV operations review, quarterly PV compliance review, annual management review). Maintain minutes signed/approved by the QPPV and file them with PSMF evidence.

15. Maintain a calendar of oversight activities (audits, training, system changes) that the QPPV uses to plan and evidence reviews.

16. SOPs and Documentation

17. Develop SOPs describing QPPV oversight processes: sign-off authorities, review of aggregate reports, oversight of clinical trial safety, handling of safety signals and PSUR/PBRER approval workflows.

18. Store QPPV-relevant documents in the PSMF and ensure they are version controlled with review dates.

19. Training and Competency

20. Keep records of initial and ongoing training for the QPPV and deputies. Document competency assessments and development plans.
21. Include evidence of training on regulatory changes, safety database updates and inspection readiness.

Oversight of Affiliates and Global Arrangements

• For central QPPVs with decentralized affiliates, document the model used (centralised oversight, hybrid model, delegated PV functions) and the controls in place to ensure consistent compliance across jurisdictions.
• For affiliates operating under local QPPVs or local PV Responsible Persons, include cross-reference matrices that show responsibilities, reporting lines and how the central QPPV receives assurance (monthly reports, audit summaries, KPI dashboards).
• Capture local variations and country-specific contact points in the PSMF and ensure the QPPV has the authority to review local PV procedures and outcomes.

Governance, Management and Escalation

• Establish clear escalation routes for safety concerns. Document thresholds that trigger escalation to the QPPV and to senior management (e.g., trends in serious ADRs, signal detection, safety-related regulatory inquiries).
• Include the QPPV in product- or portfolio-level risk governance committees and ensure the PSMF references committee charters and meeting minutes where safety decisions are made.
• Demonstrate that the QPPV has adequate resources: staff, IT systems, budget for audits and training. Document resource reviews and management responses.

Performance Monitoring and KPIs

Define and monitor KPIs that the QPPV uses to judge system performance. Useful KPIs include:

• Timeliness of ICSR reporting (percentage within regulatory timelines).
• Case quality metrics (completeness scores, follow-up rates).
• Number and severity of inspection findings / audit non-conformities.
• CAPA closure rates and timeliness.
• Signal detection output and time to investigation.
• Compliance rates for delegated vendors and affiliates.

Include KPI dashboards, trend analyses and QPPV review sign-offs in the PSMF to demonstrate proactive oversight.

Inspection Relevance — What Inspectors Look For

Inspectors assess both the existence of the QPPV role and the effectiveness of oversight. Typical inspection expectations and evidence requests include:

• QPPV CV and proof of appointment (contract, formal delegation).
• Evidence of permanent and continuous availability (contact details, on-call rota).
• Delegation log and records showing how tasks are delegated and monitored.
• Minutes of governance meetings where the QPPV exercised oversight or provided decisions.
• SOPs referencing the QPPV’s role and sign-off examples (e.g., approval of PSMF, PSURs, safety signals).
• Evidence of oversight of vendors and affiliates (audit reports, corrective actions, access to data).
• Records of competence development and training for the QPPV and deputies.
• KPI reports and management review demonstrating that the QPPV monitors performance and drives improvements.

Failure to demonstrate effective QPPV oversight is a common inspection finding and often triggers requests for corrective action plans.

Practical Evidence to Maintain in the PSMF

To make PSMF reviews efficient and inspection-ready, maintain the following items as living records:

• QPPV name, role description, CV and contact details.
• Delegation log with dated entries and limits of delegation.
• Deputies’ names, CVs and contact details.
• Governance charter, RACI matrix and organisational chart showing reporting lines.
• SOPs that reference QPPV responsibilities and sign-off examples.
• Meeting calendars and minutes for PV governance and management reviews.
• Vendor contracts, audit schedules, recent reports and CAPA records.
• KPI dashboards, trend analyses and QPPV sign-offs.
• Evidence of availability testing and emergency contact procedures.

Updating the PSMF in Response to QPPV Changes

• Immediate updates: When a QPPV appointment, resignation or extended absence occurs, update the PSMF immediately with evidence of the change (appointment letter, delegation to interim QPPV, contact details).
• Delegation updates: Any delegation to deputies or contractors requires immediate PSMF updates — include the delegation log entry and relevant contracts.
• Periodic reconciliation: Include QPPV oversight items in your periodic PSMF review checklist so that elements such as CVs, availability arrangements and governance documents are verified at least annually (or more frequently if local regulations demand).

Example Oversight Schedule (Practical Template)

• Continuous: Update PSMF for any immediate changes (QPPV/deputy appointment, vendor contract, safety database change).
• Monthly: PV operations review (case volumes, timeliness, critical events) with minutes.
• Quarterly: KPI review, vendor oversight report, training updates and a PSMF snapshot validation for QPPV-related sections.
• Annually: Comprehensive PSMF review, management review attended by the QPPV, audit programme review and resource adequacy assessment.

Governance Discussion — Board and Executive Engagement

• The QPPV must be supported by management with the authority and resources to implement PV requirements. Document executive-level engagement (board briefing minutes, executive summaries of PV performance) in the PSMF.
• Senior management should receive periodic attestations from the QPPV confirming the status of the PV system. Keep signed annual attestations in the PSMF as evidence of governance oversight.

Inspection-Ready Checklist for the PSMF

This checklist is structured to be inspection-ready: each item is paired with the typical inspection question, the evidence to present, where to store it in the PSMF and practical presentation tips.

• PSMF administrative controls
• Inspection question: Do you have a current, version-controlled PSMF that matches what is in practice?
• Evidence: PSMF cover page with version number, version history log, latest author and approver (QPPV) signatures, publication date.
• Storage: PSMF root folder + master version control register.

• Presentation tip: Provide a printed index and an electronic folder tree; show the version control sheet first.

• QPPV and deputies

• Inspection question: Who is the QPPV? Is the QPPV continuously available?
• Evidence: Signed appointment letter, CV, contact details, deputy delegation entries, evidence of availability checks (call logs), continuity plan.
• Storage: PSMF section 1 (QPPV), delegation log appendix.

• Presentation tip: Highlight the delegation log and a recent phone-check record.

• Governance and escalation

• Inspection question: How does PV escalate issues to senior management?
• Evidence: Governance charter, RACI, committee charters, management review minutes, signed attestations.
• Storage: Governance section, management review folder.

• Presentation tip: Provide the latest management review minutes and corresponding QPPV attestation.

• SOPs and process documentation

• Inspection question: Are SOPs current and used in practice?
• Evidence: SOP index with current versions, training records showing staff trained to the current SOPs, examples of SOP application (e.g., approved PSUR).
• Storage: SOP library cross-referenced in PSMF.

• Presentation tip: Show SOP version table and a matched training completion report.

• Case handling and safety database

• Inspection question: How are ICSRs managed and reported?
• Evidence: Safety database vendor contracts, system validation/compliance evidence, user access list, recent ICSR sample bundle (anonymised), SOPs and KPIs.
• Storage: Systems and infrastructure section; sample ICSR bundle in annex.

• Presentation tip: Pre-select a small number (3–5) of representative ICSRs with redactions and cross-reference to database entries.

• Aggregate reports, signal management and PSURs

• Inspection question: How do you detect and respond to signals and produce aggregate reports?
• Evidence: Signal management SOP, signal log, PSUR/PBRER approval records, signal investigation records, relevant committee minutes.
• Storage: Signal management and aggregate reporting sections.

• Presentation tip: Provide a recent signal file with timeline and QPPV sign-off.

• Vendor oversight

• Inspection question: How do you ensure third parties meet PV obligations?
• Evidence: Vendor contracts, SLA clauses, audit reports, CAPA logs and closure evidence, access agreements for data.
• Storage: Vendor management section with a vendor master list.

• Presentation tip: Present an audit report with follow-up evidence and CAPA closure.

• Inspections and audits

• Inspection question: How do you manage inspections and audits?
• Evidence: Inspection history, responses to regulatory requests, audit schedule and recent audit reports, CAPA plans.
• Storage: Inspection and audit section.

• Presentation tip: Show a closed CAPA with evidence of implemented changes.

• Training and competence

• Inspection question: Are staff competent and trained on PV processes?
• Evidence: Training matrix, training records for key staff (including QPPV), competency assessments.
• Storage: Training and personnel section.

• Presentation tip: Provide training records for staff tied to a recent SOP revision.

• KPIs and performance monitoring

• Inspection question: How do you monitor and assure PV performance?
• Evidence: KPI dashboards, trend analyses, QPPV review sign-off, remedial actions.
• Storage: KPIs and metrics section.

• Presentation tip: Present KPI reports that demonstrate trend actioning.

• Evidence provenance and retention

• Inspection question: How is documentary evidence controlled and retained?
• Evidence: Version control register, document control SOP, access logs, backup/archiving evidence, evidence retention register with retention periods and destruction authorisations.
• Storage: PSMF administration annex.
• Presentation tip: Show the document control SOP and the evidence retention register side-by-side.

Practical notes for inspections - Pre-pack an inspection folder: a short "inspection pack" containing the PSMF index, version control sheet, QPPV appointment, delegation log, governance minutes and 3–5 key evidence items. Provide both electronic and printed forms as requested. - Cross-reference: Ensure every evidence item has a unique identifier and a cross-reference entry in the PSMF index so inspectors can quickly locate originals. - Redaction practice: For case examples, pre-redact personal data consistently with GDPR and local law; retain a clear mapping in a protected file (not in the pre-supplied pack) to reconstitute if required by regulator under secure conditions. - Access and confidentiality: Ensure the inspection team has the means to view restricted items under supervision; maintain audit logs of what was provided.

Sample PSMF Index (Inspection-Ready) — With Version Control and Evidence Retention

The sample index below follows GVP Module II structure and emphasises traceable evidence links, version control and retention requirements. Tailor to your company structure, portfolio size and jurisdictional needs.

1. Cover page and PSMF administration
2. 1.1 PSMF title, MAH name, site of responsible person
3. 1.2 PSMF version history (see template below)
4. 1.3 Master index (this section references every item below with unique evidence IDs)
5. 1.4 Document control SOP
6. Evidence examples: version history (EVID-0001), document control SOP (EVID-0002)

7. Retention: Maintain version history indefinitely; SOPs retained for life of product + 5 years (or local requirement)

8. Organisation and Governance

9. 2.1 Organisational chart (PV function highlighted) (EVID-0101)
10. 2.2 Governance charter / terms of reference (EVID-0102)
11. 2.3 RACI matrix for key PV processes (EVID-0103)

12. Retention: 5 years after change or product withdrawal; governance minutes retained 5 years (or per jurisdiction)

13. Qualified Person responsible for Pharmacovigilance (QPPV)

14. 3.1 QPPV appointment letter and contract (EVID-0201)
15. 3.2 QPPV CV and declarations of interest (EVID-0202)
16. 3.3 Deputies log and delegation records (EVID-0203)
17. 3.4 Evidence of availability (on-call rota, call test logs) (EVID-0204)

18. Retention: 5 years post-departure; appointment letters retained life of product + 5 years

19. Pharmacovigilance System Description and SOPs

20. 4.1 PSMF narrative describing the PV system (EVID-0301)
21. 4.2 SOP index and current versions (EVID-0302)
22. 4.3 Examples of SOP application (e.g., PSUR approval) (EVID-0303)

23. Retention: SOPs retained for life of product + 5 years; application evidence 5–10 years depending on jurisdiction

24. Systems and databases

25. 5.1 Safety database details, supplier, validated status (EVID-0401)
26. 5.2 System validation documentation and GxP compliance evidence (EVID-0402)
27. 5.3 User access lists and change control records (EVID-0403)

28. Retention: System validation life of system + 5 years; backup & archive retention per data policy/regulation

29. Individual Case Safety Reports (ICSRs)

30. 6.1 Case processing SOPs and flowcharts (EVID-0501)
31. 6.2 Sample ICSR bundle(s) with cross-references (anonymised) (EVID-0502)
32. 6.3 ICSR submission logs and gateway confirmations (EVID-0503)

33. Retention: ICSRs retained in original format as per regulatory requirement (often life of product + X years; check local law—e.g., EU often minimum 10 years for PV records)

34. Aggregate reporting and signal management

35. 7.1 PSUR/PBRER process and archives (EVID-0601)
36. 7.2 Signal management SOP and recent signal files (EVID-0602)
37. 7.3 Risk management plans and safety communication examples (EVID-0603)

38. Retention: 5–10 years after final report or product withdrawal as applicable

39. Clinical trials and post-authorisation studies

40. 8.1 Clinical safety oversight SOPs (EVID-0701)
41. 8.2 Safety data flows from clinical systems to PV database (EVID-0702)
42. 8.3 Investigator safety reports and SUSAR logs (EVID-0703)

43. Retention: per clinical trial record policy and local regulations

44. Vendor and supplier management

45. 9.1 Vendor master list and PV responsibilities matrix (EVID-0801)
46. 9.2 Contracts, SLAs and PV clauses (EVID-0802)
47. 9.3 Recent vendor audit reports and CAPAs (EVID-0803)

48. Retention: Contracts retained for contract lifecycle + 5 years (adjust per law); audit evidence retained until next audit + 5 years

49. Inspections and audits

    • 10.1 Inspection history and responses (EVID-0901)
    • 10.2 Internal and vendor audit schedules/reports (EVID-0902)
    • 10.3 CAPA plans and closure evidence (EVID-0903)
    • Retention: Inspection records retained per regulator guidance (commonly life of product + 5 years)

50. Training and personnel records

    • 11.1 Training matrix and records (EVID-1001)
    • 11.2 Competency assessments for QPPV and deputies (EVID-1002)
    • Retention: Personnel records per HR policy and local law (commonly 5–7 years)

51. KPIs, management review and continuous improvement

    • 12.1 KPI dashboards and trend analyses (EVID-1101)
    • 12.2 Management review minutes and QPPV attestations (EVID-1102)
    • Retention: KPI records and management reviews retained for at least 5 years

52. Backup, archive and evidence retention register

    • 13.1 IT backup and archiving policy for PV data (EVID-1201)
    • 13.2 Evidence retention register with retention periods and destruction authorisations (EVID-1202)
    • 13.3 Disaster recovery and continuity plans (EVID-1203)
    • Retention: Policy documents retained indefinitely; backups per retention schedule

Appendices - A. Glossary and abbreviations - B. List of marketing authorisations and products covered - C. Contact list for PV personnel and affiliates - D. Cross-reference table: PSMF sections vs. GVP Module II paragraphs

Version Control Template (Master Version History)

Maintain a master version history as both a front-matter PSMF page and a controlled record in the document management system. Example table columns and sample entry:

• Version number: 3.2
• Effective date: 2026-06-01
• Author: PV Head (name, role)
• Approver: QPPV (name, signature date)
• Summary of changes: Updated QPPV appointment; added vendor audit APR-2026; revised SOPs 4.1–4.4
• Impacted sections: 1.2, 3.1–3.4, 9.2–9.3, 4.2
• Evidence attachments: EVID-0201 (QPPV appt), EVID-0803 (vendor audit)
• Location: Document management system path /PSMF/v3.2
• Retention instruction: Retain previous versions for audit trail; do not delete

Operational rules for version control - Major changes: Increment major version (e.g., 3.1 → 4.0) when structure or governance materially changes. - Minor changes: Increment minor version (e.g., 3.1 → 3.2) for editorial updates, minor clarifications, CV updates. - Approval: Every new version must be approved by the QPPV (or acting QPPV) and recorded in the version history. - Audit trail: Keep the previous versions accessible in read-only archive for inspection. Do not overwrite historic files without preserving a copy.

Evidence Retention Register — Practical Template

The evidence retention register maps each evidence identifier (EVID-####) to retention rules, owner and location. Example rows:

• EVID-0001 — PSMF version history
• Owner: PV Document Control
• Retention: Indefinite / life of product + 5 years
• Location: /PSMF/Administration/VersionHistory
• Disposal authorisation: PV Head + Legal
• EVID-0201 — QPPV appointment letter
• Owner: HR / PV
• Retention: Life of product + 5 years
• Location: /PSMF/QPPV/AppointmentLetters
• Disposal authorisation: PV Head + Legal
• EVID-0402 — Safety database validation
• Owner: IT / PV Systems
• Retention: Life of system + 5 years
• Location: /IT/Validation/DB-Prod/ValidationReports
• Disposal authorisation: IT Head

Operational guidance - Map retention to legal minimums and internal business needs. Where law is silent, adopt conservative retention (life of product + minimum 5 years). - Ensure disposal authorisation is dual signatory (PV + Legal or Compliance). - Maintain a searchable register accessible to inspectors on request.

Implementation Steps — How to Make the PSMF Inspection-Ready in 30 Days

Day 1–7: Ownership and inventory - Appoint a PSMF owner (document control) and a small cross-functional team (PV operations, QPPV office, legal, IT). - Produce a master inventory of all PSMF items and current evidence identifiers.

Day 8–14: Version control and index - Create or update the master version history and lock a read-only archive of the previous version. - Build the PSMF index described above and assign evidence IDs.

Day 15–21: Evidence gathering and retention mapping - Populate evidence items for the top-priority inspection risks (QPPV appointment, delegation log, SOPs, vendor audits, recent inspection responses). - Complete the evidence retention register with owners and retention periods.

Day 22–28: Produce inspection pack and test - Assemble a short inspection pack: PSMF cover, version history, QPPV appointment, delegation log, governance minutes, 3–5 representative evidence files. - Conduct an internal mock inspection walkthrough with the QPPV and senior management to validate ease of retrieval and content completeness.

Day 29–30: Finalise access and controls - Ensure controlled access to master files, audit logging, backup and redaction protocols. - Publish the new PSMF version with QPPV signature and preserve archives.

Governance Considerations

• Senior management oversight: The PSMF and its maintenance processes should be owned at a level that guarantees resource allocation and authority (e.g., Head of PV reporting to an Executive Sponsor). Record executive involvement and confirmations in the PSMF.
• Change control: Treat PSMF updates as controlled changes. All substantive revisions should follow a change control procedure with impact assessment and QPPV approval.
• Delegation and liability: Document retained MAH responsibilities for PV activities performed by third parties. Contracts must clearly state the QPPV retains oversight and escalation rights.
• Audit and continuous improvement: Include PSMF maintenance and completeness in the internal audit scope. Use audit findings to drive SOP and governance improvements.

Inspection Relevance — Distinctive Evidence and How Inspectors Use It

Inspectors look for coherence: the PSMF narrative must align with the evidence presented. Discrepancies commonly trigger follow-up requests. Be prepared to show: - That the PSMF is the "single source of truth" for PV governance: show the index, master version history and evidence cross-reference. - Live demonstration: Inspectors may request to see live KPIs, the safety database, or a demonstration of how the QPPV would access vendor data—have read-only access prepared and a named staff member to perform the demonstration. - Traceability: For any claim in the PSMF (e.g., "QPPV attended monthly governance meeting"), provide a minute with signature and a corresponding calendar entry.

Final Notes on Frequency, Oversight and Inspection Readiness

A PSMF that accurately documents QPPV oversight and contains an inspection-ready index, version control and evidence retention register significantly reduces inspection risk. Combine immediate updates for material changes with scheduled reviews that explicitly validate PSMF content. Maintain a controlled archive of prior versions and a searchable evidence register so that any assertion in the PSMF can be substantiated promptly during an inspection.

Last reviewed: June 2026