QPPV and Audit Oversight

Introduction

The QPPV occupies a unique position within the pharmacovigilance system.

Unlike operational teams, the QPPV is not expected to personally perform every pharmacovigilance activity.

Unlike auditors, the QPPV is not expected to independently assess every process.

Instead, the QPPV is expected to maintain oversight.

As pharmacovigilance systems grow, become more global and rely increasingly on outsourcing, direct visibility becomes more difficult. Audit programmes provide structured, independent evidence regarding whether the pharmacovigilance system is operating effectively. For the QPPV, audits are among the most important sources of assurance and a primary means to demonstrate inspection readiness.

This document extends foundational guidance by adding inspection‑ready, actionable elements — checklists, sample schedules, KPIs, templates and specific responsibilities — to make QPPV audit oversight practical, auditable and defensible.

Why Audits Matter to QPPVs

A fundamental question for every QPPV is:

How do I know the pharmacovigilance system is functioning effectively?

The answer cannot depend solely on verbal assurances, operational reports or informal discussions. Effective oversight requires evidence. Audit programmes provide that evidence and the traceable audit trail regulators expect.

Audits help the QPPV understand:

• Compliance performance against GVP and national requirements
• Effectiveness of governance and escalation
• Control effectiveness across processes and vendors
• Emerging and systemic risks
• Remediation progress and sustainability of fixes

Regulatory context: EMA GVP Module IV sets expectations for pharmacovigilance audits; GVP Module I and III describe quality systems and inspections. Inspectors will look for evidence that the QPPV receives, understands and acts on audit outputs.

Oversight Versus Operations

Clear differentiation of oversight versus operations is a cornerstone of pharmacovigilance governance.

Operations (examples) - Case intake, triage, medically qualified case review - Literature screening and signal detection - Aggregate safety reporting and safety database administration - Vendor management and SLA monitoring

Oversight (QPPV responsibilities) - Maintain system visibility and assurance - Interpret audit evidence and trend data - Escalate material compliance and safety risks - Approve and monitor CAPA plans for significant findings - Ensure audit outputs are reflected in the PSMF

Audits are a principal mechanism by which oversight transforms operational activity into documented assurance.

Regulatory and Inspection Relevance

Key regulatory references - EMA GVP Module IV — Pharmacovigilance Audits - EMA GVP Module I — Pharmacovigilance Systems and Their Quality Systems - EMA GVP Module III — Pharmacovigilance Inspections - ICH Q9 — Quality Risk Management - Directive 2001/83/EC and Regulation (EC) No 726/2004

Inspection focus areas related to QPPV and audits - Receipt and review of audit reports and CAPA status by the QPPV - Demonstrable escalation and decision-making from audit findings - Evidence that audit programmes are risk-based and proportionate - Vendor audit coverage and oversight of outsourced PV activities - Integration of audit outcomes into the PSMF and corporate governance

Inspectors expect not only the existence of audits, but traceable governance — meeting minutes, escalations, CAPA evidence, trend analyses and decisions that link back to the QPPV.

Audit Programme Elements: What the QPPV Needs to See

The QPPV should require structured outputs to support oversight. Minimum useful outputs include:

• Annual audit plan (risk‑based, with rationale and coverage)
• Audit reports (scope, findings, evidence reviewed, conclusions)
• CAPA plans and status reports (owners, due dates, verification evidence)
• Trend and KPI reports (consolidated view of findings, vendors, themes)
• Governance summaries and escalation logs (board/committee papers)
• Evidence packs for high-risk findings (root cause analysis, verification)
• Vendor audit schedules and integral SLA‑derived metrics

These outputs should be accessible to the QPPV in a timely manner and supported by a document management trail suitable for inspection.

Governance and Responsibilities — Practical RACI

For auditable oversight, responsibilities must be explicit. Adopt a RACI or similar matrix and retain signed/approved copies in the PSMF.

Sample high-level RACI (QPPV-centric)

• Audit programme design and annual plan — Responsible: QA Head; Accountable: QPPV; Consulted: PV Head, Legal; Informed: Exec Leadership
• Conduct of audits (internal) — Responsible: Internal Audit / QA auditors; Accountable: QA Head; Consulted: QPPV; Informed: PV Head, Vendor Oversight
• Vendor audits (3rd party on-site) — Responsible: QA/Vendor Management; Accountable: PV Head / QPPV; Consulted: Contract Owner; Informed: Procurement
• Audit report issuance — Responsible: Lead Auditor; Accountable: QA Head; Consulted: Process Owner; Informed: QPPV
• CAPA approval for critical/major findings — Responsible: Process Owner; Accountable: QPPV; Consulted: QA Head; Informed: Exec Leadership
• CAPA verification & closure — Responsible: QA Verification Team; Accountable: QA Head; Consulted: QPPV; Informed: Process Owner
• Trending and KPI reporting — Responsible: QA Analytics; Accountable: QA Head; Consulted: QPPV; Informed: PV Governance Committee

Maintain an auditable record of RACI approvals and updates.

Audit Frequency and Vendor Audit Matrix

Risk-based frequency recommendations (examples only; adjust by risk and performance):

• Critical PV vendors (e.g., global safety database provider, core case processing vendor): on-site audit every 12 months
• High-risk vendors (e.g., outsourced signal detection, aggregate reporting): on-site or remote audit every 12–24 months
• Medium-risk vendors (e.g., literature screening, medical coding): remote audit every 24 months; on-site if findings trend upward
• Low-risk vendors (non-core IT, logistics): review of controls and SLA metrics annually; audit as indicated by risk triggers

Sample vendor audit matrix (columns to retain and present for inspection) - Vendor name | Service(s) provided | Risk rating | Last audit date | Findings (critical/major/minor) | CAPA status | Next audit due

Evidence to retain: - Audit scope and objectives - Audit team CVs and independence statements - Audit report with objective evidence (de-identified as needed) - CAPA plan, timelines, owner assignments - Verification evidence of CAPA effectiveness - Contractual QA access and audit rights documentation

Sample Annual Audit Schedule (inspectable)

Quarterly divisions are useful for governance calendars. A sample 12-month cycle:

Q1 - Finalise annual audit plan; QPPV sign-off - Audit: Safety database provider (on-site) - Audit: Case processing vendor (remote focused review) - Prepare PV governance quarterly report (include audit updates)

Q2 - Audit: Aggregate report vendor (on-site) - Internal audit: Pharmacovigilance process walkthrough (select product-lines) - Mid-year CAPA review with QPPV and Exec

Q3 - Audit: Literature surveillance vendor (remote) - Audit: Local affiliate PV compliance (country-level review) - Trend analysis and KPI refresh; revise next year's plan if needed

Q4 - Internal audit of PV governance and CAPA management processes - Final CAPA closures verification and year-end audit summary - Draft next year’s risk-based audit plan; QPPV approval

Maintain a master calendar (include audit start/end dates, report issuance, CAPA due dates, CAPA verification dates) and provide the QPPV with monthly status dashboards.

Inspection‑Ready Audit Report Template

Audit reports should be consistent and contain sufficient detail to support QPPV oversight and inspector review.

Minimum required sections: 1. Audit title and unique identifier 2. Objective and scope (reference to SOPs and standards) 3. Audit date(s) and location (including remote) 4. Audit team and independence confirmation 5. Processes/systems reviewed and selection rationale 6. Methods used (interviews, records review, sampling approach) 7. Summary of findings (by severity: Critical/Major/Minor/Observations) 8. Detailed findings (each with objective evidence, root cause, impact assessment) 9. CAPA recommendations (owner, SMART actions, milestones) 10. Conclusion and overall assessment (acceptable / acceptable with CAPAs / unacceptable) 11. Appendices: evidence list (redacted as needed), interview list, documents reviewed 12. Distribution list and sign-off by lead auditor and QA Head 13. Date of report issuance

For inspection, provide an evidence pack for critical and major findings that includes copies of the evidence cited, CAPA approvals and verification evidence.

Severity definitions and timelines: - Critical: immediate patient safety/compliance risk — CAPA within 24–72 hours, corrective action within 14 days, QPPV notification immediate - Major: significant systemic deficiency — CAPA within 30 days, verification within 90 days - Minor: local or process issue — CAPA within 90 days, verification within 6 months

These timelines should be adapted to organisational policy and referenced to GVP risk expectations.

CAPA Governance — Template and Management

A documented, auditable CAPA lifecycle enables QPPV oversight. Maintain a CAPA register with the following fields at minimum:

• CAPA ID
• Source (audit ID, inspection finding, quality event)
• Finding summary and severity
• Root cause analysis summary
• Corrective actions (what)
• Preventive actions (what)
• Owner (name, role)
• Planned start date and target completion date
• Priority and impact rating
• Evidence of completion (documents, screenshots, meeting minutes)
• Verification of effectiveness (metrics, re-audit, sample review)
• Closure approval (name, role, date)
• Escalation history (if overdue)

Governance checkpoints: - Weekly CAPA highlight report to QPPV for critical/major CAPAs - Monthly CAPA review meeting (QA, QPPV, PV Head) - Quarterly governance committee (exec-level) review with CAPA heatmap

Retention: CAPA records should be archived according to regulatory requirements and corporate retention policies and be retrievable for inspections.

KPIs, Metrics and Dashboards — What to Measure

A concise set of KPIs supports QPPV oversight and inspection-readiness. Keep dashboards lean and risk-focused.

Recommended core KPIs (frequency of reporting in parentheses) - Number of audits completed vs. plan (monthly/quarterly) - Percentage of open CAPAs overdue (monthly) - Time to CAPA remediation by severity (median days) (monthly) - Number of critical/major findings by period (quarterly) - Repeat findings rate (percentage of findings reoccurring within 12 months) (quarterly) - Vendor audit coverage (% of high-risk vendors audited within planned frequency) (quarterly) - Time from finding to QPPV notification for critical findings (real-time / monthly) - CAPA verification pass rate (percentage with sustained effectiveness) (quarterly) - Audit report issuance timeliness (days from last audit day to report issuance) (monthly)

Target examples (organisation-specific): - Report issuance within 30 calendar days for regular audits; 10 days for critical vendor audits - 100% of critical CAPAs verified within 30 days of target completion - <5% of CAPAs overdue at any time - 0 critical audit findings that are unresolved beyond 14 days

Present KPIs with trend lines and drill-down capability (e.g., vendor, product line, region) and retain source data for audits and inspections.

Audit Checklists — QPPV Focused (Sample Items)

Use checklists as part of evidence packs. Below are sample checklist items for QPPV oversight review:

Audit programme governance checklist (for use by QPPV/QA) - Is there an approved annual audit plan with risk rationale? - Has the QPPV approved the audit plan and received a copy? - Are audit team qualifications and independence documented? - Are audit reports consistent with the report template and contain objective evidence? - Are CAPA plans created for all Major/Critical findings? - Are CAPAs tracked in a register with owners and dates? - Is there documented verification evidence for CAPA closure? - Are trend reports presented to governance committees at least quarterly? - Are vendor audit rights and contractual obligations documented and enforced? - Is the PSMF updated to reflect structural or process changes identified by audits?

Vendor audit checklist (sample topical items) - Demonstration of end-to-end case processing workflow (timeliness, data integrity) - Database access controls and audit trails - Signal detection and literature surveillance methodologies (documented SOPs) - Training and qualification evidence for medically-qualified reviewers - Business continuity and disaster recovery plans for PV-critical systems - Data transfer validation and reconciliation procedures - SLA adherence and KPI reporting accuracy - Evidence of previous CAPA implementation and effectiveness

Inspection evidence checklist (what to compile rapidly) - Signed annual audit plan and approvals - Audit reports and distribution lists for the last 3 years - CAPA register and evidence of closure for critical/major items - Trend/KPI dashboards and underlying data - RACI matrix and governance committee minutes referencing audits - Evidence of vendor audits and contractual audit rights - PSMF entries referencing the audit programme - QPPV correspondence showing escalation and decision-making

Trend Analysis and Reporting — Practical Approach

Implement a standard trend template to reveal systemic issues:

Trend report components - Time series of findings by severity (rolling 12 months) - Findings by process area (case management, reporting, signal detection) - Findings by vendor and by region - Repeat findings heatmap - CAPA aging distribution (days open) - Root cause themes (human factors, IT controls, SOPs) - Actionable recommendations for governance (top 3 priorities)

Use statistical process control charts for metrics where sample sizes allow; otherwise use simple moving averages to highlight changes. For inspection, provide trend reports with source datasets and methodology notes.

Document and Evidence Management — Inspection Readiness

Maintain an inspection-friendly evidence repository: - Single source of truth for audit plan, reports and CAPAs (with versioning) - Readable index for inspectors linking audit IDs to CAPA IDs and evidence - Redaction policy for confidential vendor data while preserving evidentiary integrity - Audit report master file (signed copies) and evidence pack PDFs - Access logs showing who retrieved/approved key audit and CAPA documents

Retention policies must comply with applicable regulations and corporate requirements; ensure document timestamps and signatures are preserved.

Meeting Cadences and Escalation Pathways

Establish and document formal meeting schedules:

• Weekly operational QA/PV sync (short updates, CAPA blockers)
• Monthly PV Quality Review (detailed CAPA status, newly opened findings)
• Quarterly PV Governance Committee (QPPV-led; executive summary, KPIs, escalations)
• Annual audit plan approval meeting (QPPV approval required)
• Ad-hoc escalation for critical findings (immediate notification to QPPV and Exec; documented in an escalation log)

Escalation matrix (sample) - Finding severity: Critical — Notify QPPV & Exec within 24 hours; emergency CAPA initiation within 72 hours - Finding severity: Major — Notify QPPV within 7 days; CAPA initiation within 30 days - Finding severity: Minor — Documented in monthly CAPA report; CAPA initiation within 90 days

Document all escalations, responses and decisions in meeting minutes and the CAPA system.

PSMF Integration — Demonstrable Linkages

Audits should feed the PSMF content. Maintain a PSMF section that documents the audit programme, including: - Description of audit objectives and scope - Reference to the annual audit plan and recent summaries - RACI for audit oversight and QPPV responsibilities - Summary of recent significant findings and CAPA status - Evidence of periodic management reviews and QPPV sign-offs

Inspectors often cross-check PSMF statements with audit evidence; ensure consistent language and referential traceability (audit IDs, report dates).

Sample Templates (Concise)

Audit Report Cover Page (fields) - Audit title & ID - Service/process audited - Dates (audit / report) - Lead auditor - QA Head sign-off - QPPV notified (Y/N, date) - Confidentiality notice

CAPA Action Item Template (fields) - CAPA ID - Finding ID & audit reference - Severity - Action description - Owner (name, title) - Start date / Target completion - Resources required - Verification method (e.g., sample re-audit, metric improvement) - Closure evidence (document links) - QPPV approval for closure (signature/date)

CAPA Register Export (columns) - CAPA ID | Audit ID | Finding severity | Owner | Planned complete | Actual complete | Verification result | Closed by | Closure date

Audit Plan Template (sections) - Executive summary and risk rationale - Annual schedule (by quarter) - Resource plan (internal & external auditors) - Vendor audit coverage map - Prioritisation criteria (risk scoring) - Escalation and reporting routes - Document control and confidentiality

Case Studies — How Audit Oversight Prevents Escalations (Illustrative)

Example 1 — Vendor trending - Issue: Multiple minor findings in case processing vendor trending upward over 6 months. - Audit action: On-site follow-up audit of case handling controls; found training gaps. - QPPV action: Required immediate CAPA and monthly metrics; linked to PSMF update. - Outcome: Trend reversed within two quarters; evidence retained for future inspection.

Example 2 — Critical finding rapid escalation - Issue: Critical deficiency in safety database reconciliation discovered during internal audit. - Audit action: Immediate notification to QPPV and Exec; emergency CAPA deployed. - QPPV action: Oversaw verification and required third-party validation. - Outcome: Corrective action implemented in 10 days; verification and independent review documented.

Documented examples, with dates, actions and outcomes, provide powerful inspection evidence of effective oversight.

Preparing for Inspections — QPPV Checklist

Before an inspection, compile an audit evidence pack:

• Signed annual audit plan(s) for last 3 years
• Audit reports and distribution lists for the last 3 years
• CAPA register with links to evidence for all critical/major items (last 24 months)
• Trend/KPI dashboards and source data
• RACI and governance committee minutes that reference audit outcomes
• Vendor audit schedules and recent reports
• PSMF sections that describe audit oversight
• QPPV communications showing escalations and decisions
• Audit team CVs and independence statements

Be ready to produce digital and, where required, redacted supporting documents within timelines stipulated by inspectors.

Common Deficiencies and How They Appear in Inspections

Deficiencies inspectors frequently note: - Lack of QPPV visibility into critical audit findings (no meeting minutes or notification) - Poor CAPA documentation (no verification evidence or vague actions) - Inconsistent audit reporting formats and missing evidence trail - Insufficient vendor audit rights or lack of audit execution per contractual obligations - PSMF descriptions not aligned with observed practices or audit evidence

These weaknesses are remediable but require documented process changes, evidence of implementation and time‑bound verification.

Final Practical Considerations

• Keep audit outputs concise and risk-focused: regulators prefer quality over volume.
• Ensure the QPPV receives and signs off key audit deliverables (plan, critical report summaries, CAPA closures) and document those approvals.
• Use a centralised, version-controlled system for audit and CAPA documents to support rapid inspection requests.
• Align audit severity definitions and CAPA timelines with regulatory expectations and organisational risk appetite.
• Maintain periodic training for audit leads on GVP expectations and inspector perspectives.

Key Takeaways

• Audits are the QPPV’s principal, auditable evidence source for system effectiveness.
• Structured governance, documented responsibilities and traceable CAPA management are essential for inspection readiness.
• Implement practical tools — RACI, templates, schedules, checklists, KPIs and evidence packs — to make oversight auditable and defensible.
• Vendors require risk-based audit coverage and clear contractual audit rights.
• Trend analysis and rapid escalation pathways increase the likelihood that audits provide early warning rather than after-the-fact findings.
• Inspectors assess not only the existence of audit programmes but whether audit outputs have driven appropriate governance actions.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module IV – Pharmacovigilance Audits.
2. EMA Good Pharmacovigilance Practices (GVP) Module I – Pharmacovigilance Systems and Their Quality Systems.
3. EMA Good Pharmacovigilance Practices (GVP) Module II – Pharmacovigilance System Master File.
4. EMA Good Pharmacovigilance Practices (GVP) Module III – Pharmacovigilance Inspections.
5. Regulation (EC) No 726/2004.
6. Directive 2001/83/EC.
7. Commission Implementing Regulation (EU) No 520/2012.
8. ICH Q9 Quality Risk Management.
9. ICH Q10 Pharmaceutical Quality System.