PSMF and Pharmacovigilance System Governance Findings: What EU Inspectors Test

1. Why the PSMF Is an Inspection Object

The pharmacovigilance system master file (PSMF) is not simply a document that an organisation keeps because the legislation requires one. It is the documented representation of the pharmacovigilance system operated by the marketing authorisation holder (MAH). That makes it particularly useful during an inspection: an inspector can compare what the PSMF says the system does with what the organisation actually does.

GVP Module II requires the PSMF to describe the pharmacovigilance system applied to medicinal products authorised in the EU, including the relevant global, regional and local arrangements. EMA also states that the PSMF is maintained independently from the marketing authorisation dossier, must be permanently available for inspection and must be provided to competent authorities within seven days when requested. citeturn0search25turn0search2

The inspection significance therefore goes beyond document accuracy. A PSMF discrepancy may be evidence of a weakness in change control, governance, oversight, quality management or the organisation's ability to maintain an accurate understanding of its own pharmacovigilance system.

2. The Regulatory Framework

Three parts of the EU pharmacovigilance framework are particularly relevant to this inspection domain.

GVP Module II establishes the content, maintenance and management of the PSMF. GVP Module I establishes requirements for pharmacovigilance systems and their quality systems. GVP Module III provides the framework for pharmacovigilance inspections. EMA currently lists Module II Revision 2, Module I and Module III among the final GVP modules. citeturn0search0

The underlying legal framework also matters. The PSMF is part of the pharmacovigilance system requirements established under EU pharmacovigilance legislation, while the detailed operational expectations are elaborated through the Commission Implementing Regulation and GVP. An inspection finding should therefore be traced to the applicable legal requirement, GVP expectation or other authoritative requirement rather than described merely as a failure to follow an internal preference.

3. What Inspectors Are Trying to Establish

An inspector reviewing the PSMF is usually trying to answer several connected questions rather than asking whether every paragraph is formatted correctly.

First, does the documented system correspond to the system that actually operates? Second, are responsibilities clear and controlled across the organisation? Third, does the QPPV have sufficient oversight of the system? Fourth, can the MAH demonstrate that changes to the system are identified and reflected in the PSMF? Finally, can information in the PSMF be substantiated by operational evidence?

This produces a useful inspection model:

PSMF statement → underlying process → responsible function → operational evidence → quality oversight.

If any link breaks, the issue may be more significant than a simple documentation error.

4. The PSMF as a System Description, Not a Static Manual

A common conceptual mistake is to treat the PSMF as a static reference manual that is reviewed periodically but otherwise exists outside daily pharmacovigilance operations. GVP Module II instead establishes maintenance requirements intended to keep the file representative of the current pharmacovigilance system. citeturn0search25

The distinction matters during inspection. A system can change many times between formal periodic reviews: a vendor may be replaced, a safety database may be migrated, a local affiliate may transfer activities, a new signal-management process may be introduced, or responsibilities may move between global and regional teams. If those changes materially affect the system described in the PSMF, the organisation needs a controlled mechanism for identifying and assessing their impact on the file.

The inspector therefore does not need to find a deliberately false statement to identify a governance weakness. A PSMF that has simply failed to keep pace with the operating system may demonstrate that change control and pharmacovigilance oversight are not adequately connected.

5. The Evidence Chain Behind a PSMF Statement

A strong PSMF should be supported by evidence that exists outside the PSMF itself. For example, a statement that a particular affiliate performs case intake should be consistent with procedures, agreements, training records, system access and actual case-processing activity.

Likewise, a description of signal management should correspond to the procedures, governance forums, signal logs and decision records used by the organisation. A description of audit arrangements should be compatible with the audit programme and relevant audit records. A description of outsourced activities should be consistent with contracts, safety data exchange agreements, oversight arrangements and vendor performance evidence.

This means that inspection readiness is not achieved by polishing the PSMF immediately before an inspection. The stronger model is continuous evidence-backed maintenance.

6. PSMF Location and Availability

The PSMF has a defined regulatory location requirement. GVP Module II states that it should be located in the EU, either at the site where the main pharmacovigilance activities are performed or at the site where the QPPV operates, with the relevant EEA arrangements applying to Norway, Iceland and Liechtenstein. The location information is registered in the applicable regulatory database and changes to the location must be maintained appropriately. citeturn0search24turn0search2

From an inspection perspective, this creates two related questions. The first is whether the registered location is correct. The second is whether the organisation can actually make the PSMF available in the manner and timeframe required by the regulatory framework.

A technically correct registered address is therefore not sufficient if the organisation cannot promptly retrieve the authoritative PSMF and its supporting information when requested.

7. The Relationship Between the PSMF and the QPPV

The PSMF and the QPPV are closely connected because the PSMF describes the system for which the MAH has established pharmacovigilance oversight. EMA's practical guidance states that the QPPV must reside and operate in the EU and that backup arrangements should be in place for periods of QPPV absence. citeturn0search2

Inspection questions may consequently move between the PSMF and the QPPV. An inspector may ask how the QPPV knows that the PSMF remains accurate, how significant system changes are escalated, how major deviations are communicated, or how the QPPV obtains assurance from affiliates and service providers.

The relevant governance question is not whether the QPPV personally edits every PSMF section. It is whether the pharmacovigilance system has effective controls through which the QPPV can maintain appropriate oversight and assurance.

8. The First Recurring Failure: Documentation Does Not Match Reality

One of the clearest potential inspection findings is a mismatch between the PSMF and operational reality. This can occur in either direction. The PSMF may describe an activity that has stopped, or it may omit an activity that has become part of the system.

Illustrative example: the PSMF states that a local affiliate performs first-line case triage, while operational records demonstrate that the activity was transferred to a central service provider several months earlier. The issue is not merely that one paragraph is outdated. The discrepancy may affect responsibility, oversight, training, access controls, performance monitoring and vendor governance.

The correct inspection interpretation would depend on evidence and scope. The example is illustrative, not a claim that a regulator has reported this exact finding.

9. Why PSMF Inconsistencies Can Become System Findings

A PSMF discrepancy becomes more significant when it reveals that the organisation lacks a reliable mechanism for detecting changes to the pharmacovigilance system.

Consider a vendor transition. If the vendor changes but the PSMF, safety data exchange agreement, oversight plan, training arrangements and quality records are not synchronised, the organisation has more than a documentation problem. It has a system-change governance problem.

This is why inspectors can use the PSMF as an entry point into other areas of the system. The file provides a map. The inspection then tests whether the territory matches the map.

10. Product Scope and the Pharmacovigilance System

The PSMF needs to represent the relevant medicinal products and the system supporting them. GVP Module II includes requirements concerning the product list and information relevant to marketing status. citeturn0search25

An inspection may therefore test whether the product list and system description remain aligned with the MAH's actual portfolio. Changes in authorisation status, acquisitions, divestments, withdrawals, licensing arrangements and organisational restructuring can all create opportunities for discrepancies.

The practical control is not simply a periodic manual comparison. A mature system should have defined ownership and change-management triggers so that changes capable of affecting PSMF content are identified and assessed promptly.

11. Global, Regional and Local Arrangements

GVP Module II specifically clarified that the PSMF should reflect the global availability of safety information for medicinal products authorised in the EU and present the pharmacovigilance system applied at global, regional and local levels. citeturn0search25

This is particularly important for multinational organisations. The EU pharmacovigilance system may depend on activities performed outside the EU, while EU responsibilities remain with the MAH and its pharmacovigilance organisation.

An inspector may therefore follow an activity across organisational boundaries. If the PSMF describes a global process, the MAH should be able to demonstrate how the EU pharmacovigilance requirements are controlled within that global model, including interfaces, escalation routes and oversight.

12. Governance Information in the PSMF

The PSMF should make the governance architecture understandable. This includes the roles and responsibilities relevant to the pharmacovigilance system, interfaces between functions and the arrangements through which the system is overseen.

The inspection test is whether these descriptions correspond to actual accountability. An organisational chart alone does not demonstrate effective governance. Inspectors may examine meeting records, escalation decisions, deviation records, audit results, management review, QPPV communications and evidence of action when system performance deteriorates.

Governance is therefore demonstrated through decisions and evidence, not merely through names and boxes in an organisation chart.

13. The Difference Between Completeness and Accuracy

A PSMF can be complete in appearance but inaccurate in substance. It may contain all expected headings and attachments while still describing an obsolete operating model.

Conversely, a PSMF may contain a small documentation error that has no meaningful effect on system operation. The inspection significance of a discrepancy therefore depends on its nature, scope, persistence and relationship to the effectiveness of the underlying control.

This distinction should guide both internal assessment and CAPA. Not every PSMF discrepancy is evidence of a systemic pharmacovigilance failure, but neither should a material discrepancy be dismissed as a clerical issue without assessing why it occurred.

14. Change Control and PSMF Maintenance

The most reliable way to keep the PSMF current is to connect PSMF maintenance to the organisation's change-control and quality processes rather than treating the file as a separate documentation exercise.

A change to a safety database, vendor, affiliate responsibility, product portfolio, organisational structure, signal-management process or other safety-critical activity should be assessed for its potential effect on the pharmacovigilance system. Where the change affects the system represented in the PSMF, the assessment should lead to a controlled update or a documented conclusion that no update is required.

The inspection question is therefore not simply, "When was the PSMF last reviewed?" A more informative question is, "How does the organisation know when the PSMF needs to change?"

An effective process normally provides traceability between the change, its impact assessment, the resulting PSMF update and the approval or quality review that applies to the document. The exact workflow is an organisational control rather than a universal GVP-mandated form, and it should be proportionate to the nature of the change.

15. Periodic Review Does Not Replace Event-Driven Review

A periodic PSMF review can identify accumulated discrepancies, but periodic review alone is a weak control if important changes occur between review dates.

For example, if a major safety-system migration occurs shortly after an annual review, waiting until the next annual cycle to determine whether the PSMF remains accurate could leave the documented system materially out of date. A mature system therefore combines periodic review with event-driven assessment.

This distinction is useful during inspection because a recently reviewed PSMF is not necessarily a current PSMF. Inspectors can test recent system changes against the document and examine whether the organisation's maintenance mechanism identified them.

16. The PSMF as an Interface Document

The PSMF sits at the intersection of multiple processes. It may describe activities performed by pharmacovigilance, regulatory affairs, quality, medical functions, affiliates, information technology and external service providers.

This makes interface management a recurring source of risk. A function may change its process without recognising that the change has pharmacovigilance-system implications. Conversely, pharmacovigilance may update its description without the underlying operational process having changed.

An effective governance model therefore gives appropriate functions a defined role in identifying changes affecting PSMF content while retaining clear pharmacovigilance ownership of the system description.

17. Vendor and Service-Provider Arrangements

Outsourced activities deserve particular attention because the MAH may rely on a third party to perform safety-critical work while retaining responsibility for the pharmacovigilance system.

The PSMF should allow an inspector to understand the relevant outsourced activities and the interfaces through which they are controlled. Supporting evidence may include contracts, safety data exchange agreements, quality agreements where applicable, procedures, oversight records, performance metrics, audit activity and issue escalation.

A potential finding arises when the PSMF describes outsourcing accurately at a high level but the organisation cannot demonstrate how it assures the quality and performance of the outsourced activity. The problem is then not the PSMF alone; the PSMF has exposed a weakness in oversight.

18. Affiliates and Local Pharmacovigilance Arrangements

The same principle applies to affiliates. A multinational MAH may operate through numerous national organisations, each with defined responsibilities for case intake, local reporting, literature monitoring, medical review, risk-minimisation implementation or regulatory interaction.

The PSMF should describe the system in a way that makes these relationships understandable without turning the document into an uncontrolled collection of local procedures.

Inspectors may test whether local arrangements correspond to the central description by selecting an affiliate and tracing an activity from the PSMF to the local procedure, responsible person, training record and operational evidence. Material discrepancies can indicate inadequate system oversight or ineffective communication of responsibilities.

19. The PSMF and Safety-System Technology

Changes to technology can have direct consequences for the pharmacovigilance system. Database migrations, workflow changes, interfaces, automated triage, electronic transmission and access-control changes may alter how safety information is received, processed, assessed or reported.

The PSMF does not need to become a technical validation document. It does, however, need to remain an accurate description of the relevant system and its controls at the level required by GVP Module II.

During inspection, the important evidence may therefore sit outside the PSMF: validation documentation, change controls, system specifications, access records, issue logs and performance monitoring can be used to test whether the documented description reflects operational reality.

20. Training and Awareness

A PSMF can only function as a reliable system description if the people who own or operate the underlying processes understand the responsibilities represented in it.

Training is not necessarily required every time a PSMF sentence changes. The relevant question is whether a change to the pharmacovigilance system creates a need for communication, training or reassignment of responsibilities.

Inspectors may therefore examine whether personnel performing safety-critical activities understood their roles, particularly after organisational changes, outsourcing transitions or procedural changes. A mismatch between the PSMF, procedures and staff understanding may indicate a broader change-management weakness.

21. PSMF Sections That Should Be Tested Against Evidence

An effective internal inspection should sample statements from different parts of the PSMF and trace them to operational evidence. Useful tests include:

The table is an internal testing framework, not a regulatory checklist. The appropriate evidence depends on the system and the inspection scope.

22. Common PSMF Finding Patterns

Several patterns are particularly useful for understanding how PSMF findings develop.

Obsolete description

A process changed but the PSMF retained the former arrangement.

Incomplete description

A material activity exists but is absent or insufficiently represented.

Internal inconsistency

Different PSMF sections describe the same system differently.

PSMF-to-procedure inconsistency

The PSMF describes one responsibility while current procedures assign another.

PSMF-to-operational inconsistency

The documented arrangement differs from what personnel actually do.

Inadequate change control

The organisation cannot demonstrate how it identified or assessed the need for a PSMF update.

Inadequate oversight

The PSMF is maintained, but the organisation cannot demonstrate effective governance of the underlying system.

These patterns are analytical categories. Unless a particular regulator has published the finding, they should not be presented as a reported inspection observation.

23. When Does a PSMF Finding Become Systemic?

The distinction between an isolated documentation discrepancy and a systemic governance deficiency depends on evidence.

A single typographical error is unlikely to demonstrate the same underlying problem as repeated discrepancies across several sections, products or affiliates. Similarly, one obsolete description caused by a recently completed change may require a different response from a pattern showing that changes routinely fail to trigger PSMF review.

The assessment should therefore consider scope, duration, recurrence, patient-safety relevance and the effectiveness of the control intended to prevent the discrepancy.

This is consistent with the broader inspection principle established in I1: inspectors are interested not only in the observed error but in what the error reveals about the control environment.

24. How Inspectors Can Trace a PSMF Finding

A typical inspection pathway can be represented as:

PSMF statement
      ↓
Current procedure
      ↓
Responsible person/function
      ↓
Actual transaction or record
      ↓
Quality control / oversight
      ↓
Change history and governance

If the first five stages agree, the PSMF statement is supported by operational evidence. If they diverge, the inspector can investigate the reason for the divergence.

For example, if the PSMF identifies an affiliate as responsible for local case intake, the inspector can select recent cases and determine who actually received them, who triaged them, what system was used, which procedure governed the activity and how performance was monitored. The inspection can then establish whether the discrepancy is documentation-only or reflects a deeper control problem.

25. QPPV Oversight: What Evidence Is Persuasive?

The QPPV's role should not be reduced to signing or approving documents. Effective oversight is demonstrated by evidence that the QPPV receives information relevant to the pharmacovigilance system and can act when risks or deficiencies are identified.

Persuasive evidence may include governance meeting records, escalation decisions, review of significant deviations, oversight of audits, vendor-performance review, awareness of major system changes and documented involvement in decisions affecting the pharmacovigilance system.

The exact evidence will vary by organisation. The central principle is that responsibility must be supported by visibility and the ability to influence the system.

26. PSMF Inspection Questions

An inspector could use questions such as:

• Who owns each major PSMF section?
• How are changes to the pharmacovigilance system identified?
• What triggers an assessment of whether the PSMF needs updating?
• How does the QPPV know that the PSMF remains accurate?
• When was the last material system change and how was its PSMF impact assessed?
• Can the organisation demonstrate that outsourced activities operate as described?
• Can an affiliate demonstrate the responsibilities assigned to it in the PSMF?
• Can the organisation trace a PSMF statement to operational evidence?
• How are inconsistencies between the PSMF and procedures detected?
• How are discrepancies escalated and corrected?
• How is the PSMF controlled during major organisational or IT changes?

These are illustrative inspection questions, not a published regulator checklist.

27. Responding to a PSMF Finding

When a discrepancy is identified, the first response should establish its scope and significance rather than immediately editing the PSMF.

The organisation should determine what changed, when it changed, which products or markets are affected, which responsibilities are involved and whether the discrepancy has any effect on actual pharmacovigilance performance. It should then determine whether the failure arose from document maintenance, change control, governance, communication, training or another underlying process.

The PSMF correction is only one part of the response if the underlying control failed.

28. Root Cause Analysis

A useful root-cause analysis asks why the discrepancy was possible.

For example:

Why was the PSMF outdated?

Because the vendor transition did not trigger a PSMF review.

Why did the transition not trigger a review?

Because the change-control procedure did not identify PSMF impact as a required assessment.

Why was that control absent?

Because ownership of PSMF impact assessment had never been clearly assigned.

The resulting CAPA would need to address the governance mechanism, not merely update the document.

This is an illustrative reasoning chain rather than a claim about a published inspection finding.

29. CAPA for PSMF Findings

A proportionate CAPA may contain several layers:

1. Correct the inaccurate or incomplete PSMF content.
2. Determine whether other PSMF sections are affected.
3. Assess the historical period during which the description was inaccurate.
4. Identify the control failure that allowed the discrepancy.
5. Strengthen change-control triggers or ownership where necessary.
6. Review relevant procedures, training and governance arrangements.
7. Verify that the revised control works over an appropriate period.

The final step matters. A document update demonstrates correction; it does not necessarily demonstrate prevention of recurrence.

30. Effectiveness Verification

Effectiveness should be linked to the failed control.

If the finding resulted from missing change-control triggers, an effectiveness measure could test a defined sample of material system changes over a monitoring period to determine whether PSMF impact was consistently assessed.

If the problem involved discrepancies between affiliate operations and the PSMF, effectiveness could involve targeted sampling of selected affiliates and activities to establish whether documented and operational responsibilities remain aligned.

The precise measure should be designed around the root cause. A generic statement that "the PSMF was updated and training completed" is not, by itself, evidence that the underlying control is effective.

31. Inspection Evidence Package

For a PSMF finding, a coherent evidence package should allow an inspector to reconstruct the remediation without relying on unsupported assertions.

It may include the original finding, risk assessment, scope analysis, root-cause analysis, CAPA plan, revised PSMF, change-control records, relevant procedural changes, training evidence, governance records and effectiveness results.

The package should preserve traceability between each corrective action and the evidence demonstrating completion and effectiveness.

32. Practical Self-Inspection Exercise

A useful internal exercise is to select five statements from different PSMF sections and attempt to prove each one using current operational evidence.

For each statement ask:

Is it true?

How do we know?

Who owns the underlying process?

What document or system provides the evidence?

When was the statement last affected by a change?

Can the QPPV demonstrate appropriate oversight?

If the organisation cannot answer these questions efficiently, that is a useful signal for internal improvement even if no regulatory finding has occurred.

33. Relationship to the Wider Inspection Series

PSMF findings rarely exist completely independently from the rest of the pharmacovigilance system. A PSMF discrepancy may expose weaknesses in vendor oversight, case processing, signal management, quality systems or QPPV governance.

The subsequent articles in this series will examine those domains directly. The purpose is not to repeat the PSMF discussion in every article, but to show how inspectors can move from a documented system description to the operational process it represents.

The recurring analytical model remains:

requirement → system description → operational control → evidence → finding → root cause → remediation → effectiveness.

34. Key Takeaways

• The PSMF is a regulatory description of the pharmacovigilance system, not merely a document repository.
• Inspection significance depends on the relationship between the PSMF and the system that actually operates.
• Completeness and accuracy are different qualities; a complete-looking PSMF can still describe an obsolete system.
• PSMF maintenance should be connected to appropriate change-control processes as well as periodic review.
• Global, regional, local, affiliate and outsourced arrangements should be traceable and governed.
• The QPPV does not need to personally perform every PSMF activity, but effective oversight must be demonstrable.
• A PSMF discrepancy should be assessed for scope, duration, recurrence and underlying control failure before its significance is determined.
• Correcting the PSMF is not necessarily sufficient CAPA when the underlying failure is governance or change control.
• Effectiveness verification should test whether the failed control now works, not simply whether the corrective action was completed.
• Published inspection findings and illustrative scenarios must remain clearly distinguished.

35. References

1. European Medicines Agency. Good pharmacovigilance practices (GVP) Module II — Pharmacovigilance system master file (PSMF), current revision. EMA. urlEMA GVP Module IIhttps://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/pharmacovigilance-post-authorisation/good-pharmacovigilance-practices-gvp/gvp-modules
2. European Medicines Agency. Good pharmacovigilance practices (GVP) Module I — Pharmacovigilance systems and their quality systems, current revision. EMA. urlEMA GVP Module Ihttps://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/pharmacovigilance-post-authorisation/good-pharmacovigilance-practices-gvp/gvp-modules
3. European Medicines Agency. Good pharmacovigilance practices (GVP) Module III — Pharmacovigilance inspections, current revision. EMA. urlEMA GVP Module IIIhttps://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/pharmacovigilance-post-authorisation/good-pharmacovigilance-practices-gvp/gvp-modules
4. European Commission. Commission Implementing Regulation (EU) No 520/2012, as amended, on the performance of pharmacovigilance activities provided for in Regulation (EC) No 726/2004 and Directive 2001/83/EC. urlEUR-Lex — Regulation 520/2012https://eur-lex.europa.eu/eli/reg_impl/2012/520/oj
5. European Medicines Agency. Pharmacovigilance inspection procedures: human, Union procedures covering preparation, conduct, reporting, coordination and follow-up. urlEMA human pharmacovigilance inspection procedureshttps://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/pharmacovigilance-post-authorisation/pharmacovigilance-inspections
6. European Medicines Agency. Annual report of the Pharmacovigilance Inspectors' Working Group for 2024, EMA/INS/PhV/122716/2025. Published inspection activity and findings. urlEMA PhV IWG Annual Report 2024https://www.ema.europa.eu/en/documents/report/annual-report-pharmacovigilance-inspectors-working-group-2024_en.pdf
7. European Medicines Agency. Annual report of the Pharmacovigilance Inspectors' Working Group for 2023, EMA/INS/PhV/471069/2024. Published inspection activity and findings. urlEMA PhV IWG Annual Report 2023https://www.ema.europa.eu/en/documents/report/annual-report-pharmacovigilance-inspectors-working-group-2023_en.pdf
8. European Medicines Agency. Coordination of pharmacovigilance inspections. EMA information on the role of the Pharmacovigilance Inspectors Working Group and EU inspection coordination. urlEMA coordination of pharmacovigilance inspectionshttps://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/pharmacovigilance-post-authorisation/pharmacovigilance-inspections

Regulatory Note

This article is an educational analysis of the EU pharmacovigilance inspection framework and PSMF governance. Regulatory requirements are distinguished from illustrative inspection questions, examples and recommended operational practice. Examples that are not attributed to an authoritative regulatory source are illustrative and must not be interpreted as published inspection findings. Current legislation, GVP guidance, Union procedures, national requirements and product-specific obligations should be checked before using this material for operational or regulatory decisions.