PSMF Maintenance and Change Control

Introduction

Creating a Pharmacovigilance System Master File is relatively straightforward.

Maintaining it accurately over time is far more difficult.

Many organisations begin with a high-quality document.

Over time, however, the pharmacovigilance system evolves:

• Products are acquired.
• Products are divested.
• Vendors are replaced.
• Databases are upgraded.
• Organisational structures change.
• QPPVs change.
• Affiliates are added.

Unless maintenance activities evolve at the same pace, the PSMF gradually becomes less accurate.

This process is often subtle.

The document may remain largely correct while becoming progressively less representative of operational reality.

For this reason, experienced inspectors often view PSMF maintenance as a governance issue rather than a documentation issue.

The Real Objective of Maintenance

Many organisations approach maintenance incorrectly.

They focus on:

Updating the document.

The actual objective is different.

The objective is:

Ensuring the PSMF continuously reflects the pharmacovigilance system.

This distinction is important.

The goal is not document compliance.

The goal is system representation.

A perfectly formatted PSMF that no longer reflects reality provides little regulatory value.

Why PSMFs Become Outdated

The most common causes include:

• Lack of ownership
• Weak governance
• Poor change control
• Infrequent review
• Resource constraints
• Organisational complexity

Rarely does a PSMF become inaccurate because of a single major failure.

More commonly, numerous small changes accumulate over time.

Examples include:

• One missing vendor
• One outdated organisation chart
• One product not added
• One affiliate not updated

Individually these issues may appear minor.

Collectively they create inspection risk.

The PSMF Lifecycle

A useful way to view the PSMF is as a lifecycle rather than a document.

The lifecycle generally includes:

1. Creation
2. Review
3. Approval
4. Maintenance
5. Verification
6. Improvement

Many organisations invest heavily in stages 1–3.

The strongest organisations focus primarily on stages 4–6.

Ownership Models

One of the most important governance decisions concerns ownership.

Central Ownership Model

A single function owns the entire PSMF.

Advantages:

• Consistency
• Clear accountability

Challenges:

• Heavy workload
• Reliance on one team

Distributed Ownership Model

Different sections have different owners.

Examples:

Advantages:

• Greater expertise
• Better scalability

Challenges:

• Coordination complexity

Hybrid Model

Most mature organisations adopt a hybrid approach.

Central governance coordinates updates while subject matter experts maintain specific content.

Change Control and the PSMF

The strongest PSMF programmes are integrated into change control processes.

Whenever a significant change occurs, organisations should ask:

• Does the PSMF require updating?
• Does an annex require updating?
• Does the QPPV require notification?
• Does oversight documentation require revision?

This transforms maintenance from a reactive activity into a proactive governance process.

Changes That Should Trigger Review

Examples include:

Organisational Changes

• New departments
• Reporting line changes
• New affiliates
• Restructuring

Personnel Changes

• New QPPV
• New deputy QPPV
• New leadership roles

Vendor Changes

• New vendor onboarding
• Vendor termination
• Vendor mergers
• Scope changes

Product Changes

• Acquisitions
• Divestments
• New marketing authorisations
• Product withdrawals

Technology Changes

• Database migrations
• New safety systems
• System retirement
• Significant upgrades

Compliance Events

• Audits
• Inspections
• Significant CAPAs
• Major deviations

These events frequently require PSMF updates.

Review Frequencies

A common question is:

How often should a PSMF be reviewed?

There is no universally correct answer.

The appropriate frequency depends upon:

• Organisational size
• Complexity
• Change volume
• Outsourcing model

Typical approaches include:

The critical point is not frequency.

The critical point is effectiveness.

Annex Maintenance

Most maintenance effort involves annexes.

Commonly updated annexes include:

• Product inventories
• Vendor inventories
• Organisational charts
• Audit schedules
• Inspection histories

These sections often change far more frequently than the main body.

For additional information see:

[[psmf-annexes-guide]]

Maintaining Product Inventories

Product inventories often represent one of the largest maintenance burdens.

Common update triggers include:

• New products
• Withdrawn products
• Acquired products
• Divested products

Many organisations align inventory updates with Regulatory Affairs activities.

This improves consistency and reduces duplication.

Maintaining Vendor Inventories

Vendor inventories are another common source of findings.

Updates should occur when:

• New vendors are approved
• Existing vendors are terminated
• Services change
• Oversight models change

Strong organisations integrate vendor governance and PSMF governance.

The Role of Metrics

Metrics help prevent gradual deterioration.

Examples include:

• Overdue updates
• Missing reviews
• Inventory discrepancies
• Open governance actions

Metrics convert maintenance from a subjective activity into an objective one.

For additional information see:

[[psmf-metrics]]

QPPV Oversight

The QPPV does not necessarily maintain the PSMF personally.

However, regulators generally expect visibility regarding:

• Significant changes
• Major compliance risks
• Governance effectiveness
• Inspection readiness

The QPPV should have confidence that maintenance processes are functioning effectively.

For additional information see:

[[psmf-qppv-oversight]]

Inspection Perspective

Inspectors often review maintenance processes as carefully as the document itself.

Typical questions include:

• Who owns the PSMF?
• How are updates triggered?
• How are changes approved?
• How are inventories maintained?
• How is accuracy verified?

Inspectors are often less interested in a single outdated entry than in the process that allowed it to occur.

Regulatory expectations (EMA GVP Module II and related guidance) emphasise that the PSMF must accurately describe the pharmacovigilance system, and that systems and documentation must be auditable. Inspectors therefore expect traceability from an operational change to the PSMF update, and supporting evidence that the system described is operationally implemented and under oversight.

Signs of a Mature Maintenance Programme

Characteristics commonly include:

Clear Ownership

Responsibilities are documented and understood.

Change Control Integration

Updates are linked to operational change.

Routine Reviews

Review activities occur consistently.

Metrics

Quality is monitored objectively.

Governance

Senior oversight exists.

Inspection Readiness

The document remains current throughout the year.

The Biggest Mistake Organisations Make

The most common mistake is treating the PSMF as a document.

The PSMF is not simply a document.

It is a representation of the pharmacovigilance system.

When organisations focus exclusively on document maintenance, quality gradually deteriorates.

When organisations focus on maintaining alignment between the document and the system, quality tends to improve naturally.

Key Takeaways

• The objective of PSMF maintenance is to maintain alignment with operational reality.
• Most inaccuracies arise from accumulated small changes rather than major failures.
• Effective change control is one of the most important maintenance tools.
• Product inventories and vendor inventories require particular attention.
• Metrics and governance reviews help prevent gradual deterioration.
• Inspectors often assess maintenance processes as carefully as the document itself.
• Mature organisations treat PSMF maintenance as an ongoing governance activity rather than a periodic documentation exercise.

Inspection‑ready Maintenance Checklist

The checklist below is designed to be inspection-ready: each line item specifies the expected evidence, location of evidence, minimum retention period and the responsible role. Use this as an operating template during an inspection; keep an accessible index of the evidence items linked to the PSMF (e.g., a digital evidence register).

Core principles inserted into the checklist: - Every PSMF update must be traceable to a triggering event, a change control record and an approval with date and owner. - Evidence must be retained in a controlled repository with access controls, version history and audit trail. - Timelines should be defined, measurable and demonstrably met or escalated.

Maintenance checklist (inspection-ready)

• PSMF Governance and Ownership
• Item: Documented ownership for the PSMF (central and section owners).
• Required evidence: Organogram, roles & responsibilities document, delegation log.
• Location: Governance SOP / controlled GxP repository.
• Retention: Current + 5 years.
• Responsible: PV Governance Lead.

• Inspection note: Inspectors will verify that owners are documentarily and operationally accountable.

• Change Control Linkage

• Item: Procedure linking operational change control to PSMF update requirement.
• Required evidence: Change control SOP, sample change control records with PSMF update flag.
• Location: QMS change control repository.
• Retention: Current + 5 years.
• Responsible: Quality Assurance (QA).

• Inspection note: Provide examples showing triggers and resulting PSMF updates.

• Version History and Change Log

• Item: PSMF version history including author, approver, effective date and summary of changes.
• Required evidence: PSMF change log (embedded and separate audit spreadsheet).
• Location: PSMF document header and evidence folder.
• Retention: Full document lifecycle.
• Responsible: PSMF Owner.

• Inspection note: Inspectors will check for neat chronological traceability.

• Evidence Repository and Index

• Item: Central evidence register linking each PSMF statement to underlying evidence.
• Required evidence: Evidence index (spreadsheet or DMS links), copies of referenced documents (contracts, SOPs, CVs).
• Location: Controlled document management system (DMS).
• Retention: As per document retention policy.
• Responsible: PSMF Owner / Document Controller.

• Inspection note: Ability to open referenced evidence within inspection is expected.

• Annexes: Product Inventory

• Item: Up-to-date product list with MA numbers, status (active/suspended/withdrawn), and holder.
• Required evidence: Regulatory submissions, MA licences, product dossiers.
• Location: Regulatory Affairs annex & evidence folder.
• Retention: As per regulatory requirements.
• Responsible: Regulatory Affairs (RA).

• Inspection note: Inspectors will seek concordance between PSMF and regulatory records.

• Annexes: Vendor Inventory

• Item: Current list of PV vendors, scope of service, oversight model and contract/SOW references.
• Required evidence: Contracts/SOWs, vendor qualification, oversight plans, audit reports.
• Location: Vendor management repository and PSMF annex.
• Retention: Contractual retention period + 5 years.
• Responsible: PV Operations / Procurement.

• Inspection note: Inspectors expect evidence of oversight activities and adequacy of contracts.

• QPPV and Deputies

• Item: Current QPPV contact details, CV, delegation matrix and evidence of oversight.
• Required evidence: CVs, appointment letters, delegation logs, minutes of oversight meetings.
• Location: PSMF section, governance folder.
• Retention: Current + 5 years after end of role.
• Responsible: PV Governance.

• Inspection note: Inspectors will verify that the named QPPV is in place and has visibility over significant PV activities.

• Systems and Databases

• Item: Inventory of PV systems, validation status and system owners.
• Required evidence: System inventory, validation certificates, change/incident logs.
• Location: IT controlled repository and PSMF annex.
• Retention: As per GxP system retention.
• Responsible: IT / System Owner.

• Inspection note: Inspectors will validate that systems listed are validated and in use.

• SOPs and Procedures

• Item: List of PV SOPs referenced in the PSMF and confirmation they are current.
• Required evidence: SOPs with version history, training records.
• Location: SOP repository.
• Retention: Current + 5 years.
• Responsible: QA / PV Governance.

• Inspection note: Inspectors will sample SOPs for consistency with the PSMF.

• Audit and Inspection History

• Item: Up-to-date annex of audits and inspections with outcomes and open CAPAs.
• Required evidence: Audit reports, inspection reports, CAPA plans and closure evidence.
• Location: QA evidence folder and PSMF annex.
• Retention: As per audit retention policy.
• Responsible: QA.

• Inspection note: Inspectors will review past findings and CAPA effectiveness.

• Training and Competence

• Item: Evidence that personnel accountable for PSMF content are trained.
• Required evidence: Training records mapped to PSMF roles.
• Location: Learning management system (LMS) and PSMF evidence folder.
• Retention: As per HR policy.
• Responsible: PV Governance / HR.

• Inspection note: Inspectors expect demonstrable competence for key roles.

• Evidence of Verification

• Item: Periodic checks to verify PSMF accuracy (e.g., spot checks, reconciliations).
• Required evidence: Verification logs, reconciliation reports, governance meeting minutes.
• Location: Governance repository.
• Retention: Minimum of 3 cycles or 3 years.
• Responsible: PV Governance / QA.

• Inspection note: Inspectors look for independent verification activities and remediation of discrepancies.

• Escalation and Deviation Management

• Item: Documented escalation path for overdue or uncompleted PSMF updates.
• Required evidence: Escalation SOP, escalation logs, CAPA where applicable.
• Location: QMS.
• Retention: As per QMS.
• Responsible: PV Governance / QA.

• Inspection note: Evidence of timely escalation demonstrates control.

• Traceability for a Sample Change

• Item: Provide a bundled example that shows an operational trigger → change control record → PSMF update → evidence index → approval.
• Required evidence: Complete bundle with dates, names, change control number, updated PSMF section, and evidence.
• Location: Inspection binder / digital bundle.
• Retention: As required by inspection follow-up.
• Responsible: PSMF Owner.
• Inspection note: This is frequently requested during inspections.

Implementation tips for the checklist - Maintain an evidence index with hyperlinks or physical pointers; during inspection, provide an indexed bundle for 2–3 recent updates. - Use standard file-naming conventions (e.g., PSMF_ANNEX_VendorInventory_YYYYMMDD_vX.pdf). - Ensure the DMS records who changed what and when (audit trail). - Retain both redline and clean final versions for a reasonable period to demonstrate change rationale.

RACI Matrix for Change‑Triggers (Owners, Evidence & Timelines)

Below is a practical, auditable RACI matrix mapping the common change triggers to Responsible (R), Accountable (A), Consulted (C) and Informed (I) roles, the minimum required evidence to update the PSMF, and target timelines for each activity. The timelines provided are industry-typical expectations to satisfy regulatory expectations and inspection readiness; organisations should adapt these to their risk profile and regulatory obligations. Use change control numbers to link evidence items.

Key: - R = Responsible (executes the work) - A = Accountable (has ultimate sign‑off) - C = Consulted (input required) - I = Informed (kept informed)

RACI matrix

Notes on using the RACI matrix - Timelines reflect expected regulatory scrutiny and inspection relevance; urgent changes (e.g., QPPV changes, product withdrawals) require immediate updates. - “PSMF update timeline” defines when the PSMF itself should be amended and approved; “Evidence collection timeline” defines when supporting records should be available and uploaded to the evidence repository. - For cross-border companies, include timelines for local affiliate records and local language annexes as applicable.

Governance and Auditability Considerations

To make the checklist and RACI matrix operational and inspection-ready, governance must embed the following elements:

• Policy: A PSMF Maintenance Policy that mandates the change-trigger process, timelines and roles. Reference EMA GVP Module II and Module I for regulatory alignment.
• SOPs: Clear SOPs linking change control, vendor management, RA processes and PSMF update actions. SOPs should reference the PSMF evidence index and the change control numbers.
• Evidence Index: A living, controlled evidence index (spreadsheet or DMS view) that maps each PSMF paragraph/annex to source documents and contains DMS links.
• Audit Trail: Use a DMS that preserves the version history. Maintain both redline and clean versions for an appropriate retention period to demonstrate rationale for change.
• Governance Forum: A periodic governance forum (e.g., monthly PSMF Governance Committee) where outstanding updates, overdue items and inspection readiness are reviewed. Meeting minutes should record decisions and action owners.
• KPI Dashboard: Regularly report KPIs such as % of annexes up-to-date, number of overdue updates, time from trigger to PSMF update, and number of evidence gaps. Include trend analysis for senior management.
• Verification: Schedule spot checks and reconciliation activities (e.g., quarterly vendor list reconciliation between procurement and PSMF) with documented outcomes.
• Escalation: Define escalation paths for missed timelines, including triggers for executive escalation and immediate inspection preparation.
• Training: Ensure PSMF section owners receive training on the maintenance workflow, evidence requirements and the RACI responsibilities.

Implementation Example (Operationalising the Matrix)

1. Integrate the RACI matrix entries into the change control request form: add a checkbox “PSMF update required?” and fields for PSMF change owner, planned PSMF effective date, and evidence links.
2. Configure the DMS to require a PSMF change log entry when the “PSMF update” flag is set on a change control record.
3. Establish a PSMF evidence folder template for each change‑trigger type (e.g., Vendor_Onboard_), including required files: contract, audit report, oversight plan, change control record.
4. During governance meetings, present a dashboard item for each outstanding PSMF update where the target timeline has passed; record escalation actions.
5. For inspection readiness, prepare 2–3 “bundles” demonstrating full traceability for typical triggers (e.g., vendor onboarding, QPPV change, system migration) and keep them accessible.

Audit and Inspection Relevance

• Inspectors expect traceability: ensure every PSMF statement can be traced to operational evidence.
• Provide an inspection bundle with the evidence index and 2–3 complete traceability examples.
• Maintain demonstrable timeliness: be prepared to justify any delays with documented risk assessments and escalations.
• Show verification activities: inspectors will value independent checks and reconciliations showing the PSMF reflects current operations.

Conclusion

A robust, inspection-ready PSMF maintenance regime integrates governance, change control and a pragmatic evidence strategy. The checklist and RACI matrix provided here convert high-level principles into operational requirements suitable for audit and inspection. Embedding these into policy, SOPs and the organisation’s DMS ensures that the PSMF remains a living, accurate representation of the pharmacovigilance system.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module II – Pharmacovigilance System Master File.
2. EMA Good Pharmacovigilance Practices (GVP) Module I – Pharmacovigilance Systems and Their Quality Systems.
3. EMA Good Pharmacovigilance Practices (GVP) Module III – Pharmacovigilance Inspections.
4. Regulation (EC) No 726/2004.
5. Directive 2001/83/EC.
6. Commission Implementing Regulation (EU) No 520/2012.
7. EMA Questions and Answers on Pharmacovigilance System Master Files.