Common PSMF Inspection Findings

Introduction

The Pharmacovigilance System Master File is one of the most frequently reviewed documents during a pharmacovigilance inspection.

Inspectors commonly request the PSMF before the inspection begins and use it to build their initial understanding of the pharmacovigilance system.

For this reason, weaknesses within the PSMF often influence the entire inspection.

A well-maintained PSMF can help inspectors quickly understand:

• Organisational structure
• Governance arrangements
• Vendor oversight
• Product scope
• Compliance controls

A poor PSMF may create concerns before operational processes are even reviewed.

Understanding common findings therefore provides valuable insight into how inspectors assess pharmacovigilance systems.

What Inspectors Are Actually Assessing

Many organisations assume inspectors are reviewing the PSMF simply to verify compliance with regulatory requirements.

In reality, inspectors are usually trying to answer three questions:

Question 1

Does the organisation understand its pharmacovigilance system?

Question 2

Does the organisation control its pharmacovigilance system?

Question 3

Can the organisation demonstrate that control?

The PSMF becomes one of the most important tools inspectors use to answer those questions.

Why PSMF Findings Matter

PSMF findings rarely exist in isolation.

An outdated product inventory may suggest:

• Poor governance
• Weak change control
• Inadequate oversight

An incomplete vendor inventory may suggest:

• Outsourcing risks
• Compliance monitoring gaps
• Unclear responsibilities

Consequently, PSMF findings often trigger broader inspection scrutiny.

Inspectors frequently view the document as an indicator of overall system maturity.

Finding Category 1: Outdated Information

The most common PSMF finding is simple.

The document no longer reflects reality.

Examples include:

• Former QPPVs still listed
• Obsolete organisational charts
• Retired systems
• Former vendors
• Outdated product inventories

These findings often arise because organisations treat the PSMF as a periodic document review exercise rather than a continuously maintained governance tool.

Root Cause

Usually:

• Weak ownership
• Weak change control
• Lack of governance integration

Preventive Approach

Integrate PSMF updates into:

• Change control
• Vendor onboarding
• Product lifecycle management
• Organisational restructuring

Finding Category 2: Missing Vendors

Outsourcing has become a central component of modern pharmacovigilance systems.

Inspectors therefore expect visibility regarding:

• Who performs activities
• Which activities are outsourced
• How oversight is maintained

Common findings include:

• Missing vendors
• Incomplete inventories
• Missing oversight descriptions
• Inconsistent vendor information

Why Inspectors Care

Because outsourcing does not transfer accountability.

The MAH remains responsible.

Typical Inspection Question

Show me all vendors performing pharmacovigilance activities.

If the organisation cannot answer consistently, concerns arise quickly.

Finding Category 3: Incomplete Product Inventories

The product inventory defines the scope of the pharmacovigilance system.

Common deficiencies include:

• Missing products
• Incorrect marketing status
• Delayed updates after acquisitions
• Withdrawn products remaining active

Inspectors frequently compare product inventories against:

• Regulatory records
• Marketing authorisations
• Organisational product lists

Discrepancies may indicate wider governance weaknesses.

Finding Category 4: Organisational Structures That Do Not Match Reality

Many PSMFs contain organisational charts.

Inspectors often verify these through interviews.

Examples of findings include:

• Incorrect reporting lines
• Missing functions
• Unclear responsibilities
• Outdated affiliate structures

These deficiencies may make it difficult for inspectors to determine accountability.

Finding Category 5: Weak QPPV Documentation

Because the QPPV occupies a central role within the pharmacovigilance system, inspectors frequently review QPPV information early.

Common findings include:

• Incorrect contact information
• Missing deputy arrangements
• Unclear responsibilities
• Inconsistencies between documents

These findings often attract attention because they affect accountability.

Finding Category 6: Annexes That Are Not Maintained

Many organisations focus heavily on the main body of the PSMF.

Annexes receive less attention.

This creates risk because annexes often contain the most dynamic information.

Examples include:

• Product inventories
• Vendor inventories
• Audit programmes
• Inspection histories

Inspectors frequently discover that annexes have not been updated for extended periods.

For additional information see:

[[psmf-annexes-guide]]

Finding Category 7: Governance Descriptions That Do Not Reflect Practice

This is one of the most serious categories of findings.

The PSMF may describe:

• Governance committees
• Escalation processes
• Oversight activities

However, inspection evidence may demonstrate that those activities do not actually occur.

Examples include:

• Committees that rarely meet
• Missing minutes
• Escalations that never occur
• Metrics that are not reviewed

Inspectors often regard these findings as more significant than administrative errors.

Finding Category 8: Weak Vendor Oversight Descriptions

Inspectors increasingly focus on outsourced pharmacovigilance activities.

Common deficiencies include:

• Lack of oversight descriptions
• Missing governance activities
• Unclear responsibilities
• Incomplete documentation

A vendor may perform activities effectively.

If oversight cannot be demonstrated, findings may still occur.

Finding Category 9: Inadequate Traceability

Traceability is often overlooked.

Inspectors should be able to move easily between:

• PSMF statements
• Procedures
• Contracts
• Inventories
• Operational evidence

Poor traceability creates inefficiency and may reduce confidence in the document.

Finding Category 10: PSMF Treated as an Inspection Document

This is arguably the most important finding category.

The organisation updates the PSMF:

• Before inspections
• Before audits
• Before authority requests

But not during normal operations.

This often produces a predictable cycle:

1. Document quality deteriorates.
2. Inspection approaches.
3. Intensive remediation occurs.
4. Quality improves temporarily.
5. Deterioration resumes.

Mature organisations avoid this cycle entirely.

The Real Root Causes

Although findings appear diverse, most originate from a small number of root causes.

Governance Failure

Nobody actively governs the PSMF.

Ownership Failure

Responsibilities are unclear.

Change Control Failure

System changes do not trigger PSMF updates.

Oversight Failure

Review activities are ineffective.

Resource Failure

Insufficient capacity exists to maintain the document.

Understanding these root causes is usually more valuable than understanding individual findings.

CAPAs Following PSMF Findings

Effective CAPAs focus on system improvement rather than document correction.

Weak CAPA:

Update vendor inventory.

Strong CAPA:

Integrate vendor onboarding and termination activities into PSMF governance procedures.

The difference is important.

One fixes a symptom.

The other addresses a root cause.

What Great Organisations Do Differently

High-performing organisations tend to share several characteristics.

Defined Ownership

Every major annex has an owner.

Change Control Integration

Updates are triggered automatically by relevant business changes.

Regular Governance Reviews

PSMF health is reviewed routinely.

Inspection Readiness Culture

The PSMF remains inspection-ready continuously.

QPPV Engagement

The QPPV understands and actively uses the document.

Inspector Psychology

One of the most useful concepts for organisations is understanding inspector psychology.

Inspectors are not trying to find typographical errors.

They are trying to determine whether the pharmacovigilance system is:

• Understood
• Controlled
• Governed
• Sustainable

The PSMF provides one of the clearest windows into those questions.

Key Takeaways

• PSMF findings frequently reflect broader governance weaknesses.
• Outdated information remains the most common deficiency.
• Vendor inventories and product inventories are frequent inspection focus areas.
• Governance descriptions must accurately reflect operational reality.
• Strong CAPAs address root causes rather than document errors.
• Mature organisations maintain inspection readiness continuously.
• Inspectors often view PSMF quality as an indicator of pharmacovigilance system maturity.

Inspection-ready PSMF Maintenance Checklist

This checklist is designed for operational use: to keep the PSMF continuously inspection-ready, to support governance, and to provide clear traceability between statements and evidence. Use it as the operational control list for the PSMF owner and governance committee.

For each item below include: owner, frequency, trigger events, evidence type, and last review date.

1. Governance and ownership
2. Confirm PSMF owner, deputy and committee oversight assigned and documented.
3. Frequency: quarterly review by PV governance committee.
4. Trigger: organisational changes, QPPV changes.
5. Evidence: signed responsibility matrix, committee terms of reference (ToR), minutes confirming review.

6. Inspection relevance: demonstrates accountable oversight and continuous stewardship.

7. QPPV and deputies

8. Verify contact details, role description, formal appointment letters and deputy arrangements are current.
9. Frequency: monthly validation of contact details; annual review of role description.
10. Trigger: personnel changes, new regulatory requirements.
11. Evidence: QPPV appointment letter, CV, delegation log, deputy nomination file.

12. Inspection relevance: shows clear accountability and compliance with GVP Module I/II.

13. Product inventory (master list)

14. Reconcile PSMF product list with MAH records and regulatory databases (e.g., national portals).
15. Frequency: monthly reconciliation; full audit quarterly.
16. Trigger: MA transfers, new approvals, withdrawals, mergers/acquisitions.
17. Evidence: reconciliation spreadsheet, MA certificates, product transfer agreements.

18. Inspection relevance: ensures accurate system scope and signal coverage.

19. Vendor inventory and PV agreements

20. Ensure all vendors performing PV activities are listed and PV agreements are indexed.
21. Frequency: monthly vendor reconciliation and annual contract audit.
22. Trigger: new vendor onboarding, contract renewals, subcontracting changes.
23. Evidence: vendor register, master service agreements (MSAs), PV Annexes, oversight reports, performance metrics.

24. Inspection relevance: demonstrates outsourcing control and oversight (GVP Module I/III).

25. SOPs and procedures index

26. Verify the PSMF references current approved SOPs and procedure owners.
27. Frequency: semi-annual cross-check versus document management system (DMS).
28. Trigger: SOP revisions, new procedures introduced.
29. Evidence: DMS links, SOP revision history, training logs.

30. Inspection relevance: links governance statements to operational controls.

31. Safety database and systems

32. Confirm safety database name/version, access control, backup and archive arrangements, GxP status.
33. Frequency: quarterly verification; after system changes or migrations.
34. Trigger: vendor changes, system upgrades/migrations.
35. Evidence: system specification, validation summary, change control records.

36. Inspection relevance: demonstrates validated systems and data integrity.

37. Signal management and risk minimisation

38. Verify documented signal detection processes, recent signal activities and risk minimisation measures.
39. Frequency: quarterly review, with immediate update after signal events.
40. Trigger: signal detection, RMP changes.
41. Evidence: signal reports, meeting minutes, RMP amendments, risk minimisation materials.

42. Inspection relevance: shows active pharmacovigilance and regulatory responsiveness.

43. Aggregate reporting and safety reporting

44. Confirm ICSR reporting responsibilities, timelines and local/regional variations are current.
45. Frequency: monthly checks for active products; annual process review.
46. Trigger: new products, regulatory reporting changes.
47. Evidence: aggregate reports (PSURs), CIOMS forms, ICSR escalation logs.

48. Inspection relevance: demonstrates adherence to expedited reporting obligations.

49. Audit programme and inspection history

50. Update audit schedule, recent audit reports, corrective actions and inspection outcomes.
51. Frequency: continuous; programme reviewed annually.
52. Trigger: completed audits/inspections, significant CAPAs.
53. Evidence: audit reports, CAPA plans, closure evidence, inspection response dossiers.

54. Inspection relevance: provides evidence of self-assessment and corrective action culture.

55. Training and qualifications

    • Confirm PV team competencies, training completion, and delegation logs.
    • Frequency: quarterly training status report.
    • Trigger: personnel changes, SOP updates, regulatory changes.
    • Evidence: training records, CVs, delegation logs.
    • Inspection relevance: demonstrates competent workforce and controlled delegations.

56. Metrics and management information

    • Ensure PV metrics used by governance bodies are current and PSMF references them.
    • Frequency: monthly metric report; quarterly governance review.
    • Trigger: changes in metric definitions or thresholds.
    • Evidence: KPI dashboards, meeting minutes showing metric review.
    • Inspection relevance: shows oversight and trending analysis.

57. Change control and PSMF update triggers

    • Maintain a list of change events that automatically trigger PSMF updates (e.g., new MA, vendor change).
    • Frequency: once maintained, review quarterly.
    • Trigger: any event on the change-trigger list.
    • Evidence: change control forms, linked PSMF update log entries.
    • Inspection relevance: shows proactive integration between change management and PSMF maintenance.

58. Traceability register

    • Maintain a traceability register mapping PSMF statements to supporting procedures, contracts and sample evidence (see traceability table below).
    • Frequency: updated concurrently with PSMF changes; full audit annually.
    • Trigger: PSMF revisions, major CAPAs.
    • Evidence: traceability table, cross-reference indexes, hyperlinks in DMS.
    • Inspection relevance: allows rapid verification of claims in the PSMF.

59. Archive and version control

    • Confirm version history, approval signatures, and archive of retired versions with access logs.
    • Frequency: continuous; audit annually.
    • Trigger: each PSMF revision.
    • Evidence: DMS version history, approval emails, archived copies.
    • Inspection relevance: shows controlled documentation practice and audit trail.

60. Inspection pack readiness

    • Prepare a compact inspection pack containing core evidence referenced in the PSMF with quick-access links or file paths.
    • Frequency: maintained continuously; validated quarterly.
    • Trigger: notification of inspection or audit.
    • Evidence: inspection pack index, zipped evidence bundle or secure DMS folder, retrieval log.
    • Inspection relevance: reduces time to evidence and demonstrates readiness.

Operational note: For each checklist item, record the date of last verification, the verifier name, and any open actions. Use automated reminders in the DMS or governance calendar to avoid backlog.

PSMF Statement Traceability Table (Template and Examples)

A traceability table is essential for inspection readiness. It maps each declarative statement in the PSMF to the authoritative procedure, the contract (if applicable) and representative sample evidence. The table below is a template with common PSMF statements and concrete example mappings. Organisations should populate a full table covering every substantive PSMF paragraph.

Columns: - PSMF Statement ID: unique identifier (e.g., S-01). - PSMF Statement (short): concise summary or heading. - Supporting Procedure(s): SOP or procedure reference (ID and title). - Supporting Contract(s): contract type, vendor name and clause reference (if applicable). - Sample Evidence (examples): one or more representative documents with file path/ID, date, and owner. - Evidence Location (DMS path or physical folder): exact retrieval location. - Owner: person responsible for maintaining the entry. - Last Verified: date of last verification.

Note: Keep the table live in the DMS with hyperlinks to the evidence for immediate inspection use.

Practical guidance for populating the full table: - Assign a unique PSMF Statement ID to every substantive paragraph or annex heading. This allows precise cross-referencing during inspections. - Link to live documents in the DMS using permalinks. If hyperlinks are not permitted, record exact file paths and file identifiers. - Maintain one "golden copy" of the traceability table that is updated under change control and reviewed at least quarterly. - For contractual evidence, reference the contract ID and the clause that supports the PSMF statement (e.g., "Clause 7.3: MAH escalation"). - For sample evidence, select representative files that show both the procedure and operational execution (e.g., an SOP and a contemporaneous meeting minute). - For cloud-hosted systems, include the environment and instance ID (e.g., Prod DB Instance: PVDB-01) and validation status.

Implementation: How to Build and Maintain the Traceability Register

Stepwise, practical implementation with roles and timelines:

1. Initial mapping workshop
2. Participants: PSMF owner, QPPV, Head of PV Operations, Regulatory Affairs, Head of Outsourcing, IT validation lead, Head of Compliance.

3. Output: Draft mapping of key PSMF statements to procedures, contracts and evidence. Aim to complete within 4–6 weeks for core statements.

4. Populate traceability table

5. Use the template above. Prioritise high-risk statements (QPPV, product inventory, vendors, safety database, signal management).
6. Owners attach hyperlinks and confirm representative evidence.

7. Time: 2–4 weeks after workshop for first-pass population.

8. Quality control and verification

9. Independent reviewer (Quality or Compliance) verifies links, sample evidence authenticity and completeness.
10. Log minor gaps and assign CAPAs with defined SLAs.

11. Time: 1–2 weeks.

12. Integrate into change control

13. Any change to a procedure, contract or the PSMF triggers simultaneous update in the traceability table.

14. Implement automated notifications where possible.

15. Ongoing maintenance and governance

16. Quarterly governance review of the traceability register as part of the PSMF health check.
17. Annual comprehensive audit of the register versus operational records.

18. Inspection drill: quarterly tabletop inspections to exercise retrieval of evidence using the traceability register.

19. Tooling and automation

20. Prefer a controlled electronic register within the DMS that supports permalinks, version history, approval workflow, and audit trails.
21. Where possible, integrate with vendor management and product master systems to auto-flag changes that require PSMF updates.

Inspection Relevance: How Inspectors Use the Checklist and Traceability Table

• Pre-inspection review: Inspectors assess the PSMF and will expect the traceability table to demonstrate direct links to underlying controls and evidence.
• Efficiency: A comprehensive, hyperlinked traceability table allows inspectors to validate claims rapidly, reducing time spent searching and minimising follow-up requests.
• Focus of scrutiny: Statements that lack traceability frequently trigger document-based inspection questions and on-site evidence requests (e.g., "show me the contract that demonstrates Vendor X is responsible for case follow-up and the oversight meeting notes from the past 12 months").
• Strength of evidence: Procedures alone are insufficient. Inspectors expect both the documented control and evidence that the control is exercised and effective (meeting minutes, metrics, CAPA closures).
• CAPA credibility: When a finding occurs, inspectors evaluate whether CAPAs address the root cause (e.g., governance integration) — having the traceability register helps demonstrate systemic remediation rather than ad-hoc document edits.

Governance and Roles: Ensuring Sustained Maintenance

Effective governance is essential to sustain the checklist and traceability register.

• PSMF Owner (accountable): Responsible for overall currency, approval and response to inspection requests.
• PSMF Deputy (operational): Maintains the register day-to-day; coordinates evidence retrieval.
• Annex Owners (responsible): Maintain specific annexes (product list, vendors, audits) and update the traceability table entries within their domain.
• PV Governance Committee (oversight): Reviews the PSMF health report quarterly, approves changes to governance-related statements, and reviews open CAPAs.
• Quality/Compliance Independent Reviewer: Periodically audits the traceability register and certifies inspection readiness.
• IT/DMS Administrator: Ensures document links are stable, access controls are correct, and version history is maintained.
• Vendor Oversight Lead: Ensures all vendor-related entries are updated when contracts change or subcontracting occurs.

Governance practices: - Maintain a PSMF health KPI: percentage of PSMF statements with complete traceability and representative evidence. - Escalation: any statement with missing evidence beyond a defined SLA (e.g., 30 days) must be escalated to the PV governance committee. - CAPA tracking: All actions to remedy missing or weak traceability must be managed through CAPA with root-cause analysis and closure evidence.

Practical Evidence and Naming Conventions (examples)

To speed inspections and reduce ambiguity, adopt consistent naming and filing conventions:

• File names: [Type][Topic][Organisation][YYYY-MM-DD][Version]
• Example: SOP-PV-020_Outsourcing_PV_VendorA_2024-07-01_v3.pdf
• Example: OversightReport_VendorA_2026-05_PV.pdf
• DMS folders:
• DMS://PV/PSMF/Traceability/Register.xlsx
• DMS://PV/Vendors/VendorA/Contracts/MSA_VendorA_2024.pdf
• Evidence metadata:
• Each evidence file should include an index page that references the PSMF Statement ID(s) it supports.

Example: Using the Register during an Inspection

Scenario: Inspector asks to verify vendor oversight for case processing in March–May 2026.

1. Open traceability table, filter for S-06 (vendor case processing).
2. Provide hyperlinks to:
3. MSA_VendorA_2024.pdf (contract clause establishing responsibility).
4. Oversight_VendorA_2026-05.pdf (monthly oversight report).
5. KPI_VendorA_Q1_2026.xlsx (SLA performance showing compliance).
6. Audit_Report_VendorA_2025.pdf (recent audit with CAPA closure evidence).
7. Provide meeting minutes showing escalation and a corrective action log with closure.
8. The inspector will rapidly triangulate contract → procedure → operational evidence and can focus technical questions elsewhere.

Maintaining Inspection Readiness: Practical Timelines

• Daily/weekly: Minor items (contact details, urgent PSMF changes) updated immediately by owners.
• Monthly: Vendor, product inventory reconciliations; metric reports prepared.
• Quarterly: Governance committee review and traceability register verification; QPPV contact check.
• Annually: Full PSMF review, evidence audit, archive and retire old versions under controlled process.

Regulatory Context

• GVP Module II (PSMF): requires the PSMF to be accurate, up-to-date and available upon request. The traceability register and checklist directly support these requirements by linking PSMF content to the evidence demonstrating compliance.
• GVP Module I and III: emphasise system quality, governance, and inspections. A documented and maintained traceability approach addresses expectations for governance, oversight and inspection response.
• National regulations and the EU framework (Regulation (EC) No 726/2004; Directive 2001/83/EC; Commission Implementing Regulation (EU) No 520/2012) require that MAHs maintain effective pharmacovigilance systems. Demonstrable traceability and ongoing maintenance align with the regulatory expectation that MAHs can evidence the functioning of their PV system at any time.

Final Practical Checklist for Inspection Day (Quick Retrieval)

Keep a compact inspection pack (digital and indexed) that includes the following ready-to-access items (hyperlinked in the PSMF front page and traceability register):

• PSMF current version and approval page.
• Traceability register (current).
• QPPV appointment letter and CV.
• Product master list and reconciliation log.
• Vendor register with active contracts and recent oversight reports.
• Safety database validation summary and change history.
• Latest safety signal meeting minutes and any follow-up actions.
• Latest aggregate report submission evidence.
• Recent audit reports and CAPA closure evidence.
• Training matrix and sample staff CVs.
• PV governance committee minutes with PSMF health review.

Each item should be no more than two retrieval clicks from the PSMF front page or the traceability register.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module II – Pharmacovigilance System Master File.
2. EMA Good Pharmacovigilance Practices (GVP) Module III – Pharmacovigilance Inspections.
3. EMA Good Pharmacovigilance Practices (GVP) Module I – Pharmacovigilance Systems and Their Quality Systems.
4. Regulation (EC) No 726/2004.
5. Directive 2001/83/EC.
6. Commission Implementing Regulation (EU) No 520/2012.
7. EMA Questions and Answers on Pharmacovigilance System Master Files.