Pharmacovigilance Audits

Introduction

Pharmacovigilance systems exist to protect patients.

To achieve this objective, organisations establish:

• Processes
• Procedures
• Systems
• Governance frameworks
• Oversight mechanisms

However, a fundamental question remains:

How does an organisation know whether those controls are actually working?

Pharmacovigilance audits help answer that question.

Audits provide structured, independent assessment of whether pharmacovigilance activities are operating effectively and in accordance with regulatory expectations.

For mature organisations, audits are not merely compliance activities.

They are essential governance tools.

Well-designed audit programmes provide visibility regarding:

• Compliance
• Quality
• Risk
• System effectiveness
• Continuous improvement opportunities

As pharmacovigilance systems become increasingly complex, the importance of auditing continues to grow.

What Is a Pharmacovigilance Audit?

A pharmacovigilance audit is a systematic, independent and documented assessment of pharmacovigilance activities.

The purpose of the audit is to determine whether:

• Processes are established appropriately.
• Activities are performed as intended.
• Controls operate effectively.
• Regulatory requirements are met.
• Risks are managed appropriately.

Several characteristics distinguish auditing from routine operational review.

Systematic

Audits follow defined methodologies.

Independent

Auditors maintain objectivity.

Evidence-Based

Conclusions are supported by evidence.

Risk-Focused

Attention is directed toward areas of greatest importance.

A useful way to think about audits is:

Audits provide assurance regarding the effectiveness of the pharmacovigilance system.

Audits Versus Inspections

The terms audit and inspection are frequently confused.

Although related, they are fundamentally different activities.

Pharmacovigilance Audit

Conducted by or on behalf of the organisation.

Primary objective:

Assess and improve the system.

Pharmacovigilance Inspection

Conducted by regulatory authorities.

Primary objective:

Evaluate compliance with regulatory requirements.

A simple distinction is:

Strong audit programmes often improve inspection readiness significantly.

However, audits should not exist solely to prepare for inspections.

Why Audits Exist

Every system contains risk.

Even organisations with experienced personnel, strong procedures and advanced technology experience:

• Errors
• Deviations
• Process weaknesses
• Communication failures

Audits provide an opportunity to identify these issues before they result in significant consequences.

Examples include:

• Compliance failures
• Regulatory findings
• Patient safety concerns
• Inspection observations

The value of auditing lies not only in identifying problems but also in preventing future problems.

The Purpose of Auditing

Many people assume audits exist primarily to identify mistakes.

This is an incomplete view.

The broader purpose is assurance.

Audits help answer several important questions:

Are processes appropriately designed?

Are processes being followed?

Are controls effective?

Are risks being managed?

Are improvements required?

Viewed this way, auditing becomes a strategic governance activity rather than a compliance exercise.

The Pharmacovigilance Audit Universe

Modern pharmacovigilance systems contain many auditable areas.

Collectively these areas are often referred to as the audit universe.

Examples include:

Individual Case Safety Reports

Case intake, processing and reporting.

Signal Management

Signal detection, validation and evaluation.

Aggregate Reporting

Preparation and submission of aggregate reports.

Risk Management

Risk management plans and risk minimisation activities.

PSMF

Maintenance, governance and accuracy.

Vendor Oversight

Outsourced pharmacovigilance activities.

Affiliates

Local pharmacovigilance operations.

Databases and Systems

Technology supporting pharmacovigilance activities.

Quality Systems

Training, deviations, CAPAs and governance.

The audit universe provides the foundation for audit planning.

Risk-Based Audit Planning

Modern pharmacovigilance auditing is increasingly risk-based.

Risk-based planning recognises that:

Not every activity creates the same level of risk.

Consequently, audit resources should be allocated proportionally.

Factors commonly considered include:

• Patient safety impact
• Regulatory impact
• Organisational dependency
• Operational complexity
• Historical performance
• Inspection history

Higher-risk activities generally receive greater audit attention.

This approach improves efficiency while strengthening oversight.

Audit Programmes

An audit programme defines how audit activities are organised over time.

The programme typically includes:

• Audit objectives
• Audit universe
• Risk assessment methodology
• Audit schedules
• Governance arrangements

A mature programme ensures that audit activities are:

• Planned
• Documented
• Risk-based
• Sustainable

Rather than reacting to individual events, organisations can evaluate the pharmacovigilance system systematically.

Multi-Year Planning

Many organisations use multi-year audit cycles.

This helps ensure that:

• Significant areas receive attention.
• Resources are allocated appropriately.
• Emerging risks can be incorporated.

Multi-year planning also supports strategic oversight.

The objective is balanced coverage rather than excessive audit activity.

Internal Audits

Internal audits assess activities performed within the organisation.

Examples include:

• Case processing
• Signal management
• Aggregate reporting
• Governance processes
• Quality systems

Internal audits provide several advantages.

Visibility

They improve understanding of system performance.

Flexibility

Scope can be adjusted according to risk.

Continuous Improvement

Findings can drive meaningful improvement.

Internal audits often form the foundation of a pharmacovigilance audit programme.

Vendor Audits

Many pharmacovigilance activities are outsourced.

As a result, vendor audits have become increasingly important.

Vendor audits help determine whether outsourced activities remain under effective control.

Common audit areas include:

• Case processing
• Literature surveillance
• Aggregate reporting
• Technology platforms
• Quality systems

Vendor audits support broader vendor oversight activities.

For additional discussion see:

[[vendor-audits]]

Affiliate Audits

Large organisations often operate through affiliate networks.

Affiliates may perform activities such as:

• Local case management
• Local reporting
• Regulatory communications
• Risk minimisation support

Affiliate audits help assess whether local activities align with global expectations.

These audits frequently examine:

• Local procedures
• Compliance performance
• Governance arrangements
• Escalation pathways

Affiliate audits are particularly important in complex multinational environments.

Why Mature Organisations Value Audits

High-performing organisations view audits differently from struggling organisations.

Less mature organisations may see audits as:

• Disruptive
• Administrative
• Compliance-driven

More mature organisations often view audits as:

• Learning opportunities
• Governance tools
• Risk management mechanisms
• Sources of assurance

This difference in mindset frequently influences audit effectiveness.

Audits become most valuable when they contribute to better decision-making rather than merely generating findings.

Audit Findings

Audit findings are the primary outputs of an audit.

Findings identify situations where:

• Controls are absent
• Controls are ineffective
• Procedures are not followed
• Risks are not adequately managed
• Regulatory expectations may not be met

However, findings should not be viewed as failures.

A useful perspective is:

Findings are indicators of opportunities to improve system effectiveness.

The quality of an audit programme is often determined not by the number of findings generated, but by how effectively those findings are understood and addressed.

Finding Classification

Many organisations classify findings according to significance.

Although terminology varies, common categories include:

Critical Findings

Deficiencies creating immediate or significant risk.

Examples may include:

• Significant reporting failures
• Major patient safety concerns
• Absence of critical controls

Major Findings

Significant weaknesses requiring management attention.

Examples may include:

• Systemic process failures
• Repeated compliance issues
• Significant governance deficiencies

Minor Findings

Limited weaknesses with lower risk impact.

Examples may include:

• Documentation inconsistencies
• Isolated procedural deviations

Observations

Improvement opportunities that may not represent formal deficiencies.

Consistent classification supports effective prioritisation and escalation.

Understanding Root Causes

Identifying a finding is only the beginning.

The more important question is:

Why did the issue occur?

Many organisations stop at symptoms.

Examples include:

Symptom:

• Case submitted late.

Symptom:

• Procedure not followed.

Symptom:

• Training record missing.

These observations may be accurate.

However, effective improvement requires understanding underlying causes.

Possible root causes may include:

• Process design weaknesses
• Resource constraints
• System limitations
• Governance failures
• Communication gaps

Root cause analysis transforms findings into learning opportunities.

Corrective and Preventive Actions

Audit findings typically result in Corrective and Preventive Actions (CAPAs).

CAPAs help organisations:

• Correct deficiencies
• Reduce recurrence
• Improve controls
• Strengthen governance

The objective is not closure.

The objective is improvement.

A CAPA closed administratively but ineffective operationally provides little value.

Strong CAPAs focus on sustainable solutions.

CAPA Effectiveness

One of the most important but frequently overlooked activities is effectiveness verification.

Questions include:

• Did the action address the root cause?
• Did the issue recur?
• Did performance improve?
• Did risk decrease?

Without effectiveness checks, organisations may create the appearance of improvement without achieving actual improvement.

Repeat findings frequently indicate ineffective CAPAs.

Audit Metrics and KPIs

Audit programmes should themselves be monitored.

Examples of useful metrics include:

Audit Coverage

Percentage of planned audits completed.

Audit Timeliness

Audits completed according to schedule.

Open Findings

Current active findings.

Overdue Findings

Findings exceeding target closure dates.

Repeat Findings

Issues recurring after previous remediation.

CAPA Effectiveness

Percentage of CAPAs verified as effective.

These metrics help determine whether the audit programme remains healthy.

Audit Trends

Individual findings rarely tell the complete story.

Trend analysis often provides greater insight.

Examples include:

Increasing Findings

May indicate deteriorating controls.

Decreasing Findings

May indicate improvement.

Stable Findings

May suggest a mature and controlled environment.

Repeated Themes

May indicate systemic weaknesses.

Trends often provide more value than isolated observations.

QPPV and Audit Oversight

Audits represent one of the most important sources of assurance available to a QPPV.

The QPPV cannot personally verify every pharmacovigilance activity.

Audits help provide structured visibility regarding:

• Compliance
• Governance
• Risk
• Control effectiveness

A useful principle is:

Audits help the QPPV understand whether the pharmacovigilance system is functioning as intended.

The QPPV should generally maintain visibility regarding:

• Significant findings
• Critical findings
• Major CAPAs
• Repeat deficiencies
• Emerging risk trends

How QPPVs Use Audit Information

Audit information supports several oversight activities.

Examples include:

Risk Identification

Highlighting emerging risks.

Escalation

Supporting management awareness.

Resource Prioritisation

Directing attention toward higher-risk areas.

Governance Reviews

Supporting evidence-based discussions.

Inspection Readiness

Identifying vulnerabilities before inspections occur.

Effective audit programmes therefore strengthen QPPV oversight significantly.

Inspection Perspective

Inspectors frequently review audit programmes.

However, inspectors are generally less interested in the existence of audits than in their effectiveness.

Typical questions include:

• Is the programme risk-based?
• Are findings addressed?
• Are CAPAs effective?
• Are repeat issues occurring?
• Does management receive appropriate visibility?

The objective is often to determine whether the organisation learns from its audits.

What Inspectors Expect

Strong audit programmes generally demonstrate:

Independence

Auditors remain objective.

Risk-Based Planning

Resources align with risk.

Effective CAPAs

Findings lead to improvement.

Governance Integration

Results influence decision making.

Continuous Improvement

The programme evolves over time.

Inspectors often view these characteristics as indicators of organisational maturity.

Common Audit Programme Failures

Several weaknesses appear repeatedly.

Audit Programmes Focused on Compliance Alone

Audits become administrative rather than strategic.

Weak Risk Assessment

Audit resources are not aligned with risk.

Poor Root Cause Analysis

Symptoms are addressed while causes remain.

Ineffective CAPAs

Problems recur repeatedly.

Limited Management Visibility

Important information fails to reach decision-makers.

Lack of Trend Analysis

Systemic issues remain undetected.

These weaknesses reduce audit effectiveness significantly.

Audits and Organisational Learning

One of the most underappreciated purposes of auditing is organisational learning.

Every audit generates information.

That information can help organisations:

• Improve processes
• Improve governance
• Improve oversight
• Improve compliance

The strongest organisations use audit programmes to strengthen systems continuously rather than simply satisfy procedural requirements.

Characteristics of Mature Audit Programmes

High-performing organisations generally demonstrate:

Risk-Based Planning

Audit effort reflects risk.

Independence

Auditors remain objective.

Meaningful Findings

Findings focus on important issues.

Strong CAPAs

Actions address root causes.

Effective Governance

Results influence decisions.

Continuous Improvement

Learning occurs consistently.

QPPV Visibility

Important information reaches pharmacovigilance leadership.

These characteristics support sustainable pharmacovigilance governance.

The Future of Pharmacovigilance Auditing

Audit programmes continue to evolve.

Emerging trends include:

Data-Driven Auditing

Greater use of metrics and analytics.

Continuous Monitoring

Reduced reliance on periodic reviews.

Risk Intelligence

Improved identification of emerging risks.

Integrated Governance

Closer alignment between audits, inspections, metrics and risk management.

Despite these changes, the fundamental purpose remains unchanged:

Provide assurance regarding the effectiveness of the pharmacovigilance system.

Key Takeaways

• Pharmacovigilance audits provide independent assurance regarding system effectiveness.
• Audit findings should drive learning and improvement.
• Root cause analysis is essential for sustainable remediation.
• CAPAs should address causes rather than symptoms.
• Audit metrics help assess programme effectiveness.
• Audits represent an important source of assurance for QPPVs.
• Inspectors frequently evaluate both audit programmes and their outcomes.
• Mature organisations use audits as governance tools rather than compliance exercises.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module IV – Pharmacovigilance Audits.
2. EMA Good Pharmacovigilance Practices (GVP) Module I – Pharmacovigilance Systems and Their Quality Systems.
3. EMA Good Pharmacovigilance Practices (GVP) Module II – Pharmacovigilance System Master File.
4. EMA Good Pharmacovigilance Practices (GVP) Module III – Pharmacovigilance Inspections.
5. Regulation (EC) No 726/2004.
6. Directive 2001/83/EC.
7. Commission Implementing Regulation (EU) No 520/2012.
8. ICH Q9 Quality Risk Management.
9. ICH E2E Pharmacovigilance Planning.