PASS and Risk Management Plans

Introduction

Post-Authorisation Safety Studies (PASS) are among the most important Additional Pharmacovigilance Activities used within modern Risk Management Plans (RMPs). They are designed to generate information that cannot be obtained adequately through routine pharmacovigilance activities alone.

PASS studies are frequently used to investigate Important Identified Risks, Important Potential Risks and Missing Information. They may help quantify risks, characterise risk factors, evaluate long-term outcomes or assess safety in specific populations.

Within an RMP, a PASS should never exist without a clear scientific purpose. The study should address a defined uncertainty and contribute directly to risk management objectives.

What Is a PASS?

A PASS is a study conducted after marketing authorisation with the objective of obtaining additional information about the safety of a medicinal product.

The purpose may include:

• Identifying risks
• Characterising risks
• Quantifying risks
• Evaluating risk factors
• Assessing safety in specific populations
• Supporting benefit-risk evaluation

PASS studies may be imposed by regulators or proposed voluntarily by the Marketing Authorisation Holder.

Why PASS Studies Are Included in RMPs

Routine pharmacovigilance activities provide valuable information but have limitations.

Examples include:

• Under-reporting of adverse events
• Limited denominator data
• Difficulty estimating incidence
• Limited ability to evaluate causality
• Incomplete information regarding risk factors

PASS studies are used when additional evidence is needed to address an important uncertainty.

A useful principle is:

A PASS should answer a question that routine pharmacovigilance cannot answer adequately.

Relationship Between Safety Concerns and PASS

PASS studies should be linked directly to safety concerns.

Examples include:

Important Identified Risks

To better characterise frequency, severity or risk factors.

Important Potential Risks

To determine whether a suspected association is genuine.

Missing Information

To generate data in populations where knowledge is limited.

The connection between the safety concern and the study objective should be explicit.

PASS and Important Identified Risks

A PASS may be used to investigate:

• Incidence
• Severity
• Long-term outcomes
• Risk factors
• Vulnerable populations

Example:

Important Identified Risk:
Serious hepatotoxicity

PASS Objective:
Characterise incidence and predictors of severe liver injury.

The objective is not necessarily to prove the risk exists but to understand it more completely.

PASS and Important Potential Risks

Potential risks are among the most common reasons for PASS studies.

Example:

Important Potential Risk:
Major cardiovascular events

PASS Objective:
Determine whether use of the product is associated with increased cardiovascular risk.

The study may ultimately:

• Confirm the risk
• Refute the risk
• Reduce uncertainty

All three outcomes are valuable.

PASS and Missing Information

PASS studies frequently address Missing Information.

Examples include:

• Pregnancy exposure
• Long-term use
• Severe renal impairment
• Severe hepatic impairment
• Paediatric use

The objective is to reduce uncertainty regarding safety in these populations.

PASS Study Designs

Several study designs may be used.

Cohort Studies

Useful for estimating incidence and comparing outcomes.

Case-Control Studies

Useful when outcomes are rare.

Registry Studies

Useful for long-term follow-up and specialised populations.

Database Studies

Useful when large populations are required.

Hybrid Designs

Some studies combine multiple approaches.

The selected design should match the scientific question.

Imposed Versus Voluntary PASS

PASS studies may be:

Imposed

Required by a regulatory authority.

Voluntary

Proposed by the Marketing Authorisation Holder.

Imposed studies usually become regulatory commitments and require formal tracking.

PASS Protocols

Protocols should define:

• Objectives
• Study population
• Data sources
• Endpoints
• Analysis plans
• Milestones

The protocol should clearly demonstrate how the study addresses the relevant safety concern.

To improve inspection readiness and practical usability, the next sections introduce a protocol-level checklist and a comparative table of study designs with concrete examples and regulatory expectations.

Protocol-level Checklist for PASS (Master Checklist)

A single, comprehensive protocol-level checklist improves scientific rigor, governance, inspection readiness and operational clarity. The checklist below is intended to be embedded in protocol templates, used by the sponsor/CRO during protocol development, and retained in governance records. When a PASS is imposed, regulatory authorities will expect the protocol to be complete, justified and consistent with commitments. Inspectors will expect the checklist to be demonstrably applied.

Use the checklist as a series of declarative headings in the protocol and as a control document in governance. Items marked "Y/N/NA" should be completed in the project quality files.

1. Administrative and identification items
2. Study title, short title and protocol number (Y/N)
3. Study phase and classification (imposed/voluntary; prospective/retrospective) (Y/N)
4. Sponsor legal entity and MAH contact details (Y/N)
5. CRO and key vendors with responsibilities (Y/N)
6. Protocol version history, approval dates and signatories (sponsor, PI/lead epidemiologist, QPPV, biostatistician) (Y/N)

7. Regulatory obligations and commitments (e.g., EU decision numbers, imposed study references) (Y/N)

8. Scientific rationale and context

9. Clear linkage to RMP safety concern(s) (explicit RMP section/table reference) (Y/N)
10. Scientific background and existing evidence summary (Y/N)
11. Primary and secondary research questions and hypotheses (Y/N)

12. Study objectives mapped to RMP objectives and decision criteria (Y/N)

13. Study design and justification

14. Chosen study design and alternative design(s) considered (Y/N)
15. Justification for design relative to study question and limitations (Y/N)

16. Diagram or flowchart of study structure (Y/N)

17. Population, exposure and comparator definitions

18. Target population, inclusion/exclusion criteria (Y/N)
19. Detailed exposure definition (index date, duration, dosage, formulation) (Y/N)
20. Comparator(s) and rationale (active, non-user, new-user design) (Y/N)

21. Subgroup definitions (age, sex, comorbidities, concomitant drugs) (Y/N)

22. Outcomes and endpoint definitions

23. Primary and secondary endpoints with operational definitions and coding algorithms (Y/N)
24. Outcome validation strategy (medical record review, algorithm performance, adjudication) (Y/N)

25. Time-windows for outcome ascertainment (Y/N)

26. Data sources and data quality

27. Primary data source(s) and suitability assessment (EHRs, claims, registries, pregnancy registries) (Y/N)
28. Data ownership and data access arrangements (data sharing agreements) (Y/N)
29. Data provenance and lineage (fields, dates, transformations) (Y/N)
30. Data quality plan: completeness, accuracy, timeliness checks (Y/N)

31. Dataset creation and programming standards, code review and version control (Y/N)

32. Sample size and statistical considerations

33. Sample size or minimum detectable effect justification (Y/N)
34. Power calculations, event accrual assumptions and sensitivity ranges (Y/N)
35. Detailed statistical analysis plan (SAP) and linkage to protocol analyses (Y/N)
36. Pre-specified subgroup and sensitivity analyses (Y/N)
37. Handling of missing data and censoring (Y/N)
38. Confounding control strategy (covariate selection, propensity scores, inverse probability weighting) (Y/N)

39. Adjustment for multiplicity / interim analyses and alpha control if applicable (Y/N)

40. Bias control, confounding and validation

41. New-user design and active comparator considerations (Y/N)
42. Approaches to reduce immortal time bias and time-varying confounding (Y/N)
43. Matching or weighting strategies and balance diagnostics (Y/N)

44. Outcome and exposure validation sub-studies and reproducibility checks (Y/N)

45. Operational and governance arrangements

46. Roles and responsibilities: sponsor, MAH, QPPV, PI, epidemiologist, biostatistician, data manager, medical writer (Y/N)
47. Governance committees: Steering Committee, DSMB/Data Monitoring Committee, Scientific Advisory Board (Y/N)
48. Regular reporting rhythm and escalation pathways (Y/N)

49. Contractual arrangements and oversight of subcontractors and data processors (Y/N)

50. Ethics, transparency and regulatory interactions

    • Ethics committee review and consent requirements or justification for no consent (Y/N)
    • Data protection compliance (GDPR, data minimisation and anonymisation strategy) (Y/N)
    • Registration in appropriate public registers (ENCePP/EU PAS register, ClinicalTrials.gov if applicable) (Y/N)
    • Planned regulatory submissions and timelines (protocol submission where imposed) (Y/N)

51. Monitoring, quality assurance and audit readiness

    • Risk-based monitoring plan and QA checks (Y/N)
    • Audit plan and frequency, including sponsor and CRO audits (Y/N)
    • Data management, programming QC and code release notes (Y/N)
    • Standard operating procedures (SOPs) and training records (Y/N)
    • Inspection pack contents and location (protocol, SAP, CRA logs, milestone trackers) (Y/N)

52. Milestones, deliverables and reporting

    • Gantt chart with key milestones: protocol submission, site activation (if applicable), interim analyses, final report submission (Y/N)
    • Deliverables (interim reports, periodic safety update inputs, CSR) and expected timelines (Y/N)
    • Regulatory reporting obligations for serious unexpected ADRs observed in the study (Y/N)

53. Publication, data sharing and archiving

    • Publication policy and authorship plan (Y/N)
    • Data access statements and controlled access provisions (Y/N)
    • Archiving and retention plan for datasets, code and study documents (Y/N)

54. Change control and stopping/termination criteria

    • Pre-specified protocol amendment process and criteria for major/minor changes (Y/N)
    • Termination criteria and data handling on early stoppage (Y/N)
    • Plan for RMP update in case of study findings altering safety concerns (Y/N)

55. Final report and regulatory deliverables

    • Plan for study final report compliant with ENCePP and GVP VIII (Y/N)
    • Timelines for submission to authorities and for public disclosure (Y/N)
    • Linkage of final conclusions to RMP and risk minimisation activities (Y/N)

Implementation notes - Embed this checklist into the protocol template so each item is either addressed in the protocol text or cross-referenced to another study document (SAP, DMP, QA plan). - Retain completed checklist in the study master file and make it available to inspectors as evidence of protocol completeness and governance. - Use checklist entries as acceptance criteria in the protocol sign-off workflow. - During inspections, expect to present the checklist with evidence (minutes, signatures, tracked changes) demonstrating that each item was considered and resolved.

Comparative Table of Study Designs: Examples, Regulatory Expectations and Inspection Focus

The table below summarises common PASS designs with concrete examples, regulatory expectations in Europe (EMA GVP Module VIII and V, Commission Implementing Regulation (EU) No 520/2012), practical use-cases and what inspectors typically examine. Use this table as a decision-support tool when selecting a design and preparing the protocol. The examples are illustrative; protocols must be tailored to the product and safety concern.

Notes on regulatory expectations - Protocols must explicitly state the linkage between the study and RMP safety concern(s), and define success criteria for answering the prespecified question(s). - For imposed studies, authorities expect timely submissions of protocols and interim/final reports according to the regulatory decision or variation conditions; these commitments must be tracked and evidence kept. - Selection and justification of data sources is critical. Regulators expect demonstration that the database can capture relevant exposures, outcomes and confounders; validation evidence or plans for validation should be provided. - Transparency obligations: registration in ENCePP (or relevant registry) and publication of methods and results are expected under GVP principles. - Statistical methods must be prespecified, including handling of multiplicity and sensitivity analyses. Post-hoc analyses should be labelled and justified as exploratory. - Outcome validation, adjudication procedures and data quality controls are commonly requested; where these are absent, regulators will expect justification and compensatory risk-mitigation.

Practical Implementation Details and Governance

This section provides pragmatic steps to operationalise the checklist and design choices, aligned with regulator expectations and inspection readiness.

1. Mapping RMP safety concerns to protocol sections

2. Create a one-page cross-reference table in the study master file mapping each RMP safety concern to the protocol sections that address it (objectives, endpoints, sample size, analysis). This demonstrates explicit linkage to inspectors and facilitates RMP updates.

3. Protocol development workflow and approvals

4. Use a standard protocol template incorporating the checklist. Require sign-off from: sponsor clinical lead, lead epidemiologist, lead biostatistician, QPPV (or their delegated representative), legal/compliance for data agreements, and the person responsible for forecasting milestones.

5. Track approvals with version control and document rationale for any deviations from template items.

6. Governance structure

7. Establish a Steering Committee (sponsor, MAH, clinical lead, epidemiologist) for oversight and major operational decisions.
8. For studies with participant exposure risks or complex analyses, convene an independent DSMB or Data Monitoring Committee with charters, meeting schedules and stopping rules.

9. Document reporting lines between clinical safety, PV operations, medical affairs and regulatory affairs to ensure study findings are considered in PSURs/PBRERs and RMP revisions.

10. Data management, programming and reproducibility

11. Pre-specify dataset creation conventions and central program libraries. Use version-controlled repositories for analysis code and maintain a codebook.
12. Implement independent programming review and archive both raw datasets and analysis-ready datasets. Ensure documentation of data transformations.

13. For database studies, retain mapping documentation from native fields to analytic variables. Inspectors commonly request provenance trails and sample data extracts.

14. Quality assurance and inspections readiness

15. Maintain an inspection dossier that includes: protocol and SAP with approval signatures, all amendments with justifications, milestone tracker, study status reports, audit and QA reports, key correspondence with regulators, data sharing agreements, sample programming scripts, and evidence of results used to update the RMP.

16. Perform a "pre-inspection readiness" review at key milestones (protocol sign-off, first interim report, final report) to ensure all documents are in place and that the checklist is completed.

17. Handling protocol amendments and deviations

18. Use predefined criteria from the checklist to determine major vs minor amendments. Major amendments (that alter objectives, endpoints, primary analysis or data source) should be discussed with regulators if study is imposed.

19. Maintain an issues log detailing deviations, corrective actions, impact assessments and communications with authorities. Inspectors expect to see how deviations were managed and sign-off by governance.

20. Milestone and commitment tracking

21. For imposed PASS, maintain a regulatory commitment tracker linked to the protocol that shows dates for submission, initiation, interim reports and final report. Provide objective evidence (delivery receipts, correspondence) when milestones are met or delayed.

22. Implement escalation thresholds for when milestones slip (e.g., 30-day and 90-day delays escalate to senior management).

23. Integration with pharmacovigilance and regulatory reporting

24. Define processes and timelines to feed emerging PASS results into periodic safety update reports (PSURs/PBRERs), signal management systems and the RMP.

25. Document how serious ADRs discovered during PASS will be reported (timing and responsible person), consistent with spontaneous reporting obligations.

26. Transparency and public disclosure

27. Register the study prior to initiation in ENCePP/EU register or ClinicalTrials.gov as appropriate. Capture registration ID in the protocol and in the RMP milestone table.
28. Prepare a data sharing plan and publication timeline, noting any regulatory confidentiality constraints.

Inspection Relevance — What Inspectors Look For

When regulators inspect PASS activities, their enquiries focus on whether the study is fit-for-purpose and whether governance and documentation demonstrate accountability. Key inspection foci include:

• Linkage to RMP: explicit mapping showing how the PASS addresses the safety concern.
• Protocol completeness: presence of a complete protocol that addresses each checklist item, and rationale for any omissions.
• Approvals and signatories: evidence of timely sign-off by named responsible persons, including QPPV engagement for safety-critical studies.
• Data provenance: traceability from source data to final analysis datasets and reproducible code.
• Validation and adjudication: documentation of outcome validation and adjudication processes, with qualifications of adjudicators.
• Milestone tracking: records of commitments, adherence and documented reasons for delays.
• Governance minutes: Steering Committee and DSMB minutes demonstrating oversight and decisions.
• Regulatory correspondence: copies of protocol submissions, agency feedback and actions taken in response.
• Final report quality: final study report aligned with ENCePP and GVP expectations, with clear interpretation and RMP implications.
• Use of study results: evidence that findings were considered in RMP updates, labeling changes or further risk minimisation.

Inspectors often probe operational decisions—why a particular data source was selected, how confounding was handled, or how missing data were addressed. Having the protocol-level checklist, mapping documents and a complete inspection dossier reduces inspection timeframe and questions.

Governance Discussion

Strong governance underpins credible PASS execution. Key points:

• Central oversight: A nominated study sponsor and a delegated MAH representative must be clearly documented. The QPPV should be aware of all imposed PASS and major voluntary PASS, and should be able to describe their objectives and status.
• Scientific leadership: The study must have a named lead epidemiologist and lead statistician who are accountable for methodological choices and evidence of competence should be available for inspection.
• Contract management: CRO contracts must stipulate deliverables, milestones and audit rights. Subcontractor oversight must be demonstrable.
• SOP alignment: Study-specific procedures should reference sponsor and CRO SOPs and be consistent with GVP and ENCePP principles.
• Risk-based approaches: Governance should use risk-based monitoring and QA, concentrating resources on high-impact areas (outcome validation, confounding control, data provenance).
• Change management: Amendments and their regulatory interactions must be recorded and justified, with impact assessments and updated timelines.

PASS Lifecycle Management (Governance Emphasis)

Lifecycle governance should ensure that PASS remain actionable and aligned with evolving safety profiles.

• Initiation: Protocol sign-off, registration, milestone scheduling and governance charter.
• Conduct: Ongoing oversight via Steering Committee and DSMB as applicable; regular reporting to PV and regulatory affairs teams.
• Review: Interim analyses and pre-planned checkpoints to confirm feasibility and to consider modifications or terminations.
• Completion: Final report writing, regulatory submissions and RMP updates if indicated.
• Archival: Long-term retention of datasets, analysis code, SOPs and QA records to support future inspections or re-analyses.

PASS Results and RMP Updates

PASS findings often trigger RMP revisions. Governance should ensure structured assessment of results with documented decision-making paths, including QPPV sign-off, to update safety concerns, frequency, risk characterisation and risk minimisation measures. Final study reports should include a clear section mapping conclusions to RMP actions.

Common Regulatory Deficiencies (Inspection-driven)

Common deficiencies noted by regulators and inspectors include:

• Inadequate linkage between protocol and RMP safety concern(s)
• Lack of clear exposure/outcome definitions and code lists
• Insufficient justification of data source suitability
• Weak or absent confounding control strategies
• Missing or undocumented validation of outcomes
• Poor milestone management for imposed studies
• Failure to archive analysis code and raw datasets

Applying the protocol-level checklist and the comparative design considerations can materially reduce such deficiencies.

Key Takeaways

PASS studies are important Additional Pharmacovigilance Activities used to investigate Important Identified Risks, Important Potential Risks and Missing Information. They should address specific uncertainties that cannot be resolved adequately through routine pharmacovigilance activities.

Introducing a protocol-level checklist improves completeness, inspection readiness and governance. Selecting the appropriate study design requires balancing scientific objectives, data availability and regulatory expectations; the comparative table provides concrete examples and inspection-relevant considerations to guide design choice.

Strong governance, rigorous protocol content, milestone tracking, transparent reporting and integration with the RMP are essential throughout the PASS lifecycle. Documentation demonstrating that the checklist was used, decisions were justified and results informed risk management is frequently requested during inspections and is a central element of regulatory compliance.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module VIII – Post-Authorisation Safety Studies.
2. EMA Good Pharmacovigilance Practices (GVP) Module V – Risk Management Systems.
3. Commission Implementing Regulation (EU) No 520/2012.
4. ENCePP Guide on Methodological Standards in Pharmacoepidemiology.
5. ICH E2E Pharmacovigilance Planning.
6. EMA Risk Management Plan Template.