Inspection Findings in Pharmacovigilance

Introduction

Inspection findings are the primary outputs of pharmacovigilance inspections.

They represent deficiencies, weaknesses or concerns identified by regulatory authorities during inspection activities.

Inspection findings are important because they provide insight into:

• Compliance effectiveness
• Governance maturity
• Risk management capability
• System control
• Patient safety protection

The significance of a finding extends beyond the specific issue identified.

Inspectors often view findings as indicators of broader system performance.

What Is an Inspection Finding?

An inspection finding is a documented observation made by inspectors when evidence indicates that:

• Regulatory requirements are not met.
• Processes are ineffective.
• Controls are insufficient.
• Responsibilities are unclear.
• Risks are inadequately managed.

Findings are evidence-based.

Inspectors typically support findings through:

• Documentation review
• Interviews
• Operational records
• System demonstrations

The quality of evidence often determines the strength of the finding.

Why Inspection Findings Matter

Inspection findings influence regulatory confidence.

A finding may indicate:

• A local issue
• A process weakness
• A governance failure
• A systemic compliance problem

Inspectors often assess not only the issue itself but also what the issue reveals about the wider pharmacovigilance system.

A useful principle is:

Findings are often symptoms of deeper governance or oversight weaknesses.

Finding Classification

Most authorities classify findings according to significance.

Although terminology varies, classifications commonly include:

Critical Findings

Highest level of regulatory concern.

Major Findings

Significant deficiencies requiring prompt remediation.

Minor Findings

Lower-risk deficiencies requiring correction.

Classification influences regulatory expectations and follow-up activities.

Critical Findings

Critical findings are the most serious category.

They generally indicate situations involving:

• Significant patient safety risk
• Significant public health risk
• Major regulatory non-compliance
• Fundamental control failures

Examples may include:

• Failure to report serious adverse reactions
• Absence of effective pharmacovigilance systems
• Significant data integrity failures
• Failure to implement required risk minimisation measures

Critical findings frequently trigger enhanced regulatory scrutiny.

Major Findings

Major findings indicate significant weaknesses that require management attention.

Examples may include:

• Systemic reporting delays
• Inadequate vendor oversight
• Significant CAPA failures
• Persistent governance deficiencies

Major findings may not create immediate patient safety concerns but often indicate important compliance risks.

Minor Findings

Minor findings generally involve lower-risk deficiencies.

Examples may include:

• Documentation inconsistencies
• Localised procedural deviations
• Isolated record management issues

Although less serious individually, multiple minor findings may indicate broader weaknesses.

Systemic Findings

One of the most important concepts in inspections is systemic impact.

Inspectors often distinguish between:

Isolated Issues

Limited to a specific activity.

Systemic Issues

Affect multiple processes or organisational areas.

Systemic findings typically attract greater attention because they suggest broader control weaknesses.

Repeat Findings

Repeat findings are often viewed seriously by regulators.

A repeat finding may indicate:

• Ineffective CAPAs
• Weak root cause analysis
• Poor governance
• Limited organisational learning

Inspectors frequently explore recurring deficiencies in detail.

A useful principle is:

A repeated finding often attracts greater concern than the original finding.

Root Causes Behind Findings

Findings rarely occur in isolation.

Underlying causes may include:

Governance Weaknesses

Oversight mechanisms are ineffective.

Resource Constraints

Insufficient personnel or expertise.

Training Deficiencies

Responsibilities are not understood.

Process Design Issues

Controls are inadequate.

Technology Limitations

Systems fail to support compliance.

Effective remediation requires understanding these underlying causes.

Regulatory Expectations Following Findings

Following inspection completion, organisations are generally expected to:

• Evaluate findings
• Perform root cause analysis
• Develop CAPAs
• Implement corrective actions
• Verify effectiveness

The quality of the response often influences regulatory confidence.

Regulatory context - EMA GVP Module I and Module III, ICH Q9 and ICH Q10 set expectations for quality systems, risk-based approaches, and demonstrable corrective and preventive actions. - Inspectors expect responses that are timely, risk-proportionate, evidence-based, and governed by appropriate oversight (e.g., QPPV visibility, QA review, executive escalation where required). - Where applicable, regulators may expect notifications or submissions (e.g., PSMF updates, regulatory reporting, or changes to marketing authorisation documentation) following significant findings.

CAPAs and Inspection Findings

Inspection findings typically require CAPAs.

Strong CAPAs demonstrate:

Understanding

The issue is understood fully.

Root Cause Analysis

Underlying causes are identified.

Appropriate Actions

Remediation is proportional to risk.

Effectiveness Verification

Improvement can be demonstrated.

Weak CAPAs frequently lead to recurring findings.

For additional discussion see:

[[inspection-capas]]

Inspection Findings and the QPPV

The QPPV typically plays an important role in finding management.

Particularly important areas include:

• Significant findings
• Critical findings
• Root cause analysis
• CAPA oversight
• Regulatory communication

Inspectors often evaluate whether significant findings are visible to pharmacovigilance leadership.

Inspection Findings and Vendors

Outsourced activities frequently contribute to inspection findings.

Examples include:

• Weak oversight
• Poor SDEA management
• Inadequate auditing
• Limited governance visibility

Importantly:

Outsourcing activities does not outsource responsibility.

Marketing Authorisation Holders remain accountable for pharmacovigilance compliance.

Inspection Findings and the PSMF

The PSMF frequently contributes to inspection observations.

Common issues include:

• Outdated information
• Missing information
• Inconsistent information
• Inaccurate system descriptions

Inspectors often compare the PSMF against operational reality.

Discrepancies frequently attract attention.

Common Finding Themes

Across inspection programmes, recurring themes often include:

Weak Governance

Poor Vendor Oversight

Limited QPPV Visibility

Weak CAPA Programmes

Inadequate Auditing

Documentation-Reality Gaps

These themes appear consistently across many inspections.

Regulatory Impact of Findings

The impact of findings depends upon:

• Severity
• Scope
• Recurrence
• Risk
• Organisational response

Potential consequences may include:

• CAPA commitments
• Follow-up inspections
• Enhanced oversight
• Increased regulatory scrutiny

Strong responses often reduce long-term regulatory concern.

Characteristics of Effective Finding Management

High-performing organisations generally demonstrate:

Rapid Assessment

Issues are evaluated promptly.

Strong Root Cause Analysis

Underlying causes are identified.

Effective CAPAs

Actions address causes rather than symptoms.

Executive Visibility

Significant issues receive management attention.

Continuous Learning

Findings improve the system.

These characteristics strengthen regulatory confidence.

Inspection-ready CAPA Checklist

This checklist is designed to help pharmacovigilance organisations prepare CAPAs that are inspection-ready. For each item the checklist provides the requirement, why inspectors care, and example evidence inspectors expect to see.

1. Immediate triage and risk assessment
2. Requirement: Perform and document a rapid risk assessment within 24–72 hours of receipt of the finding.
3. Why inspectors care: Demonstrates timely management attention and patient-safety focus.

4. Evidence: Risk assessment form, meeting minutes, interim actions record, notification to QPPV/Head of PV.

5. Clear scope and impact statement

6. Requirement: Define scope (products, systems, geography, timelines) and potential patient safety impact.
7. Why inspectors care: Shows understanding of the breadth and seriousness of the problem.

8. Evidence: Written scope statement, traceability to PSMF, list of affected MAHs/regions.

9. Root cause analysis (RCA)

10. Requirement: Complete a structured RCA (e.g., 5 Whys, Ishikawa, fault tree) with documented evidence and supporting data.
11. Why inspectors care: Demonstrates that actions address true causes, not symptoms.

12. Evidence: RCA report, raw data reviewed, interview summaries, process maps.

13. Risk-based prioritisation of corrective and preventive actions

14. Requirement: Prioritise CAPAs using a documented risk matrix (likelihood, severity, detectability).
15. Why inspectors care: Ensures resource focus is proportionate to risk.

16. Evidence: Risk scoring rationale, prioritisation table, QPPV sign-off on risk acceptance.

17. SMART CAPA actions

18. Requirement: Each action must be Specific, Measurable, Achievable, Relevant, Time-bound.
19. Why inspectors care: Enables verification and prevents open-ended actions.

20. Evidence: CAPA plan with SMART descriptions, owner assignments, timelines.

21. Separation of corrective vs preventive actions

22. Requirement: Distinguish immediate corrective actions from preventive actions and long-term system changes.
23. Why inspectors care: Clarifies immediate containment versus systemic improvement.

24. Evidence: CAPA log with corrective/preventive tags, interim containment evidence.

25. Defined owners and governance

26. Requirement: Assign responsible owners and accountable executives; ensure QPPV and QA oversight.
27. Why inspectors care: Shows senior oversight and accountability.

28. Evidence: CAPA owner list, escalation matrix, meeting attendance logs, executive sign-off.

29. Realistic timelines with milestones

30. Requirement: Provide realistic completion dates for high-, medium-, and low-priority actions with intermediate milestones.
31. Why inspectors care: Unrealistic timelines undermine confidence in commitment.

32. Evidence: Gantt or milestone chart, change control tickets with planned dates.

33. Evidence requirements for each action

34. Requirement: Specify the types of evidence that will demonstrate action completion (documents, system changes, training records, audit reports).
35. Why inspectors care: Inspections verify actions by checking evidence packages.

36. Evidence: Evidence checklist per action, hyperlinks or file references, version control history.

37. Effectiveness measures and verification plan

    • Requirement: Define metrics, data sources, sampling plans, statistical thresholds, and monitoring periods.
    • Why inspectors care: Demonstrates that actions produce sustainable improvement.
    • Evidence: Effectiveness protocol, metric reports (baseline and follow-up), trend analyses.

38. Interim controls and mitigation

    • Requirement: Document interim controls to manage immediate risk pending permanent corrective actions.
    • Why inspectors care: Protects patients and maintains regulatory compliance during remediation.
    • Evidence: Interim SOPs, manual workarounds, communication logs, additional QC checks.

39. Traceability and audit trail

    • Requirement: Ensure each finding is traceable to CAPA actions and evidence; maintain version control.
    • Why inspectors care: Enables inspectors to follow the remediation from finding to closure.
    • Evidence: CAPA traceability matrix, document control logs, cross-referenced file folders.

40. Communication and regulatory interaction

    • Requirement: Document all regulatory communications and internal stakeholder updates.
    • Why inspectors care: Regulatory transparency is required especially for significant findings.
    • Evidence: Emails to regulators, meeting minutes, PSMF update records.

41. Integration with PSMF, SOPs, vendor agreements

    • Requirement: Update the PSMF, SOPs, contracts and oversight documents as required by the CAPA.
    • Why inspectors care: Operational reality must be consistent with documented system descriptions.
    • Evidence: Revised PSMF sections, signed SOPs, vendor contract amendments.

42. Closure criteria and final sign-off

    • Requirement: Define objective acceptance criteria for closure and secure QA and QPPV sign-off.
    • Why inspectors care: Closure must be justified with evidence and appropriate governance.
    • Evidence: Closure report, effectiveness verification results, QA and QPPV signatures, management review minutes.

43. Post-closure monitoring period

    • Requirement: Define a monitoring period post-closure with periodic review to detect recurrence.
    • Why inspectors care: Prevents premature closure and demonstrates sustainable compliance.
    • Evidence: Ongoing metric reports, periodic review minutes, audit findings.

44. Readiness for inspection follow-up

    • Requirement: Prepare an evidence package for potential inspector follow-up including a concise executive summary.
    • Why inspectors care: Facilitates efficient re-inspection and regulatory verification.
    • Evidence: Packaged evidence PDF, executive summary, index of documents.

Practical guidance for using the checklist during an inspection follow-up

• Populate the checklist immediately after the inspection, assign owners and agree timelines with QA, PV Head and QPPV.
• Link CAPA actions to the specific inspection observation number and to the PSMF section they relate to.
• Maintain a live CAPA tracker with hyperlinks to evidence; ensure read-only snapshots are taken for inspection packages.
• Ensure routine governance boards (e.g., PV Steering, Quality Board) receive regular CAPA status reports.

Fully Worked Sample CAPA Plan (inspection-ready)

This fully worked example is provided to illustrate an inspection-ready CAPA plan, including timelines, evidence requirements and effectiveness metrics. It is written in a format suitable for direct use in a CAPA tracker or inspection follow-up submission.

Scenario (hypothetical, typical Major Finding) - Inspection finding: "Systemic delays in reporting serious adverse reactions (SARs) within regulatory timelines observed for multiple products in Region X due to incomplete triage procedures and an IT workflow failure in the safety database." - Classification: Major (systemic, multiple products, reporting timeliness risk). - Relevant regulations/guidance: EMA GVP Module I & III, ICH E2D, local reporting timelines.

Scope - Products affected: Product A, Product B, Product portfolio for Region X. - Systems: Safety database (PV-DB), SFTP transfer from vendor EDC, local affiliate triage process. - Teams: Local affiliate PV staff, vendor PV processing team, corporate PV operations, IT vendor. - Period under review: Last 12 months.

Risk assessment summary (initial) - Impact: Potential under-reporting or delayed reporting of serious adverse reactions, risk to patient safety and regulatory non-compliance. - Likelihood: Medium (process existed but had gaps). - Risk level: High (due to timeliness requirement for SARs).

Root Cause Analysis (executive summary) - Primary root causes: 1. Incomplete triage SOP at affiliate level — responsibilities and timelines not clearly defined. 2. PV-DB workflow error — automated status update failed for a subset of transmittals causing them to remain in pending status. 3. Insufficient oversight of vendor receiving transmissions — no alert escalation when workflows break. 4. Training gaps for newly hired affiliate PV staff on triage expectations and PV-DB status flags.

CAPA Objectives - Corrective: Restore compliant reporting timeliness for SARs and remediate the immediate backlog. - Preventive: Ensure systemic fixes (SOPs, IT fixes, vendor alerts, training, enhanced oversight) to prevent recurrence. - Verification: Demonstrate sustained reporting timeliness over a pre-defined monitoring period.

CAPA Plan (table)

Timelines explained - Immediate containment (Action 1): Day 0 is inspection exit date or receipt of finding. Containment must be rapid to protect patients and show regulatory responsiveness. - IT and SOP changes: Implemented in parallel where feasible. IT fixes prioritized due to automation root cause. - Training and vendor contract changes: Follow SOP and IT changes to ensure lasting change. - QA audit and monitoring: Performed after implementation to verify controls work in practice. - Closure report: Compiled after effectiveness verification; provide all evidence in a single indexed package.

Evidence requirements – examples and inspector expectations - For each action, prepare a discrete evidence package containing: - Documents: SOPs (redlined and final), change control logs, validated test scripts, validation reports, contract amendments. - Records: Training attendance records, competency test results, manual review logs, ICSRs with transmission receipts. - Systems evidence: Screenshots from PV-DB showing corrected workflows, audit trails, alert logs, GxP-compliant system export with checksums. - Governance: Meeting minutes from PV Steering/Quality Board with CAPA updates, QPPV correspondence, executive sign-off. - Audit documents: Audit plan, working papers, the final audit report and evidence of closure for audit findings. - Inspectors will expect traceability: link each evidence item to the specific CAPA action and to the original inspection finding number.

Effectiveness metrics – setting thresholds and measurement plans - Primary metric: Reporting timeliness for SARs in Region X measured as percentage submitted within regulatory timeline. - Baseline: e.g., 78% (last 12 months). - Target: >=95% within 90 days, sustained for 6 months. - Measurement frequency: weekly dashboard; aggregate monthly reports. - Secondary metrics: - Median time-to-report (days) — aim to reduce median by X% (e.g., from 7 to <=2 days). - Number of late reports per month — aim for zero critical late reports. - Number of workflow errors detected by automated alerts — aim to detect and resolve 100% within SLA. - Training compliance — >=95% within 30 days of course launch. - Statistical considerations: - Use appropriate sample size for monitoring; where counts are small use 100% review. - Define control limits for metrics; trigger investigations when thresholds are exceeded.

Governance and escalation - Oversight: - Daily stand-up for first 14 days between affiliate PV, corporate PV operations and QA. - Weekly CAPA status updates to PV Steering Committee with QPPV present. - Monthly report to Executive Quality Board until CAPA closure. - Escalation: - If any action misses a milestone by >10 business days without mitigation, escalate to Head of PV and QA. - If effectiveness metrics do not reach interim targets within 90 days, trigger expanded RCA and additional controls. - Regulatory communication: - If regulatory reporting obligations were breached materially, prepare regulatory notification (cover letter, CAPA outline, interim evidence) within timelines expected by the inspectorate.

Effectiveness verification plan (detailed) - Verification activities: - Data review: extract PV-DB reports for all SARs in Region X for pre- and post-implementation periods. - Sample audit: select a statistically significant sample of ICSRs and verify completeness and timeliness. - System monitoring: review automated alert logs for occurrence and resolution time. - Stakeholder interviews: verify procedure adherence with affiliate and vendor staff. - Acceptance criteria: - >=95% timely reporting for three consecutive months OR sustained improvement per agreed threshold for inspection closure. - QA audit confirms process and vendor controls are implemented and effective with no outstanding major findings. - Documentation: - Draft an effectiveness verification report, include raw data extracts, run charts, comparison tables, and signed statements from owners.

Closure and retention - Closure prerequisites: - All CAPA actions completed and evidence indexed. - Effectiveness verified per plan. - CAPA closure report prepared and signed by CAPA owner, QA and QPPV. - Retention: - Maintain complete CAPA evidence package for the period required by local regulations and PSMF retention policy. - Re-opening: - Define conditions for re-opening CAPA if recurrence is detected during post-closure monitoring.

Sample CAPA closure executive summary (example) - Summary: The systemic reporting delays in Region X were caused by a combination of incomplete triage SOPs and an automated PV-DB workflow error. Immediate containment corrected the backlog; permanent fixes (software patch, SOP update, vendor alert, training and QA audit) were implemented. Effectiveness was verified by a QA audit and three months of metric reports showing 97–99% timely reporting. CAPA closed with QA and QPPV sign-off on Day 150.

Inspection relevance: what inspectors will look for - Timeliness and transparency: Evidence that the organisation prioritised actions and notified regulators when required. - Root cause credibility: RCA with supporting data (e.g., system logs showing failed status updates). - Action traceability: Clear mapping from finding to specific CAPA actions and evidence. - Evidence sufficiency: Objective, reproducible evidence (system extracts, validated change controls, signed SOPs, training records). - Governance: Demonstrable involvement of QPPV, QA and senior management where required. - Sustained effectiveness: Metrics demonstrating durable improvement, not just one-off fixes.

Governance Considerations for CAPA Programs

• Roles and responsibilities:
• QPPV: Clinical/regulatory oversight and final assurance that safety obligations are met.
• Head of PV: Operational ownership of CAPA delivery.
• QA: Independent assurance of CAPA quality, audit and closure verification.
• IT/IS: Responsible for change control, validation and system evidence.
• Vendor Management: Contractual and operational oversight of external providers.
• Policies and SOPs:
• CAPA policy should define thresholds for regulatory notification, classification of findings, escalation paths and retention requirements.
• SOPs should provide standardized templates for RCA, CAPA plans, evidence indexes and closure reports.
• Executive oversight:
• Significant CAPAs should be visible to a quality or executive board with documented minutes and risk acceptance where applicable.
• Integration with Quality Management System:
• CAPA outcomes should feed into continuous improvement, supplier management, training needs analysis and PSMF updates.
• Resource planning:
• CAPA delivery must be resourced realistically: internal time, vendor support, IT validation capacity and QA time should be factored into timelines.

Inspection Relevance and Practical Implementation Notes

• Be proactive: Provide interim updates and evidence to regulators when appropriate; show that containment was immediate and robust.
• Be transparent: Acknowledge limitations and provide a clear plan with milestones. Concealment or vague timelines undermine confidence.
• Prepare inspection packs: Create a coherent, indexed package that includes the finding, RCA, CAPA plan, evidence per action, metrics and governance sign-offs.
• Use traceability matrices: Include a simple table referencing each finding to CAPA actions, evidence files and PSMF sections to facilitate inspector review.
• Demonstrate learning: Capture lessons learned and integrate into training and global improvement plans.

Key Takeaways (revised)

• Inspection findings identify deficiencies observed during regulatory inspections and often reveal broader governance or oversight issues.
• CAPA quality—root cause analysis, SMART actions, realistic timelines, measurable effectiveness verification and clear governance—strongly influences regulatory confidence.
• An inspection-ready CAPA must include explicit evidence requirements, a traceability matrix, and measurable effectiveness metrics.
• QPPVs should be visible in the remediation process for significant findings and CAPA closure should include QA and QPPV sign-off.
• Well-structured CAPAs not only close findings but strengthen the pharmacovigilance system and reduce future regulatory risk.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module III – Pharmacovigilance Inspections.
2. EMA Good Pharmacovigilance Practices (GVP) Module I – Pharmacovigilance Systems and Their Quality Systems.
3. EMA Good Pharmacovigilance Practices (GVP) Module II – Pharmacovigilance System Master File.
4. Regulation (EC) No 726/2004.
5. Directive 2001/83/EC.
6. Commission Implementing Regulation (EU) No 520/2012.
7. ICH Q9 Quality Risk Management.
8. ICH Q10 Pharmaceutical Quality System.
9. PIC/S Guidance on Pharmacovigilance Inspections.