Risk-Based Audit Planning in Pharmacovigilance

Introduction

Every pharmacovigilance system contains more auditable activities than available audit resources.

Potential audit targets may include:

• Case processing
• Literature surveillance
• Signal management
• Aggregate reporting
• Risk management systems
• Vendors
• Affiliates
• Safety databases
• QPPV oversight processes
• Quality systems

Attempting to audit everything equally is rarely practical.

Modern pharmacovigilance audit programmes therefore rely upon risk-based planning.

Risk-based planning helps organisations focus audit resources where assurance is needed most.

What Is Risk-Based Audit Planning?

Risk-based audit planning is the process of prioritising audit activities according to risk.

Rather than asking:

What can we audit?

The organisation asks:

What should we audit?

The objective is to direct audit attention toward areas where failures would have the greatest consequences.

Why Risk-Based Planning Matters

Resources are always limited.

Audit teams face constraints involving:

• Time
• Personnel
• Budget
• Expertise

Risk-based planning helps ensure those resources produce maximum value.

Benefits include:

• Better assurance
• Better resource allocation
• Better inspection readiness
• Better risk management
• Better governance visibility

Regulatory Expectations

Regulators generally expect audit programmes to be risk-based.

Inspectors may review:

• Risk assessment methodologies
• Audit plans
• Audit justifications
• Audit frequencies

The key question is often:

Can the organisation explain why certain activities were audited and others were not?

Risk-based planning provides that rationale.

Understanding Risk in Pharmacovigilance

Risk can be viewed through several lenses.

Patient Safety Risk

Could failure affect patient safety?

Regulatory Risk

Could failure create non-compliance?

Operational Risk

Could failure disrupt pharmacovigilance activities?

Reputational Risk

Could failure damage organisational credibility?

Data Integrity Risk

Could safety data become inaccurate, incomplete or unavailable?

These dimensions help determine audit priorities.

Risk Assessment Inputs

Several information sources may support planning.

Previous Audit Results

Past findings often predict future risk.

Inspection Findings

Regulatory observations may highlight vulnerabilities.

KPI Trends

Performance deterioration may indicate emerging concerns.

CAPA Performance

Repeated CAPA failures may suggest systemic weaknesses.

Significant Deviations

Major deviations frequently warrant additional attention.

Organisational Changes

Structural changes may increase uncertainty.

The strongest plans use multiple data sources.

The Audit Universe

Risk-based planning begins with the audit universe.

The audit universe represents all auditable activities.

Examples include:

Core PV Activities

• ICSR management
• Signal management
• Aggregate reporting

Governance Activities

• QPPV oversight
• Escalation processes

Vendor Activities

• Outsourced services
• Technology providers

Quality Activities

• CAPAs
• Training
• Deviations

Every activity within the universe should be capable of risk assessment.

Risk Scoring Models

Many organisations use structured scoring approaches.

Example:

Higher scores generally indicate higher audit priority.

The exact methodology is less important than consistency.

Common High-Risk Areas

Certain areas frequently receive greater audit attention.

Case Processing

Direct impact on reporting compliance.

Signal Management

Direct impact on benefit-risk monitoring.

Aggregate Reporting

Critical regulatory obligation.

Critical Vendors

Outsourced activities with significant dependency.

Safety Databases

High data integrity importance.

Major Organisational Changes

Periods of elevated uncertainty.

These areas are often considered audit priorities.

Audit Frequency and Risk

Risk frequently influences audit frequency.

Example:

The principle is straightforward:

Higher risk generally warrants greater assurance.

Dynamic Risk Assessment

Risk is not static.

Examples of changing risk include:

• New products
• New vendors
• Acquisitions
• Regulatory changes
• Technology migrations

Audit plans should therefore remain flexible.

An annual plan should not prevent response to emerging risks.

Vendor Risk and Audit Planning

Vendor audits are frequently risk-driven.

Questions may include:

• Is the vendor critical?
• Has performance deteriorated?
• Have significant findings occurred?
• Is organisational dependency increasing?

Risk assessment helps determine audit priorities.

For additional discussion see:

[[vendor-risk-assessment]]

[[critical-vendor-management]]

QPPV Input into Audit Planning

The QPPV can provide valuable insight regarding:

• Emerging risks
• Compliance concerns
• Regulatory priorities
• Vendor oversight concerns

Although the QPPV may not own the audit programme, their perspective can strengthen planning significantly.

Inspection Perspective

Inspectors frequently review whether audit plans reflect organisational risks.

Common questions include:

• Why was this area selected?
• Why was this area excluded?
• How was risk assessed?
• How are changes managed?

Strong risk-based planning provides defensible answers.

Common Planning Failures

Several weaknesses occur repeatedly.

Equal Treatment of All Activities

Resources become diluted.

Static Risk Assessments

Plans fail to adapt.

Weak Documentation

Priorities cannot be explained.

Over-Reliance on Historical Schedules

Previous plans drive future plans without reassessment.

Ignoring Emerging Risks

New threats remain unaudited.

These weaknesses reduce assurance significantly.

Characteristics of Mature Risk-Based Planning

High-performing organisations generally demonstrate:

Structured Risk Assessment

Methodologies are documented.

Multiple Information Sources

Decisions are evidence-based.

Dynamic Planning

Plans can evolve.

Governance Integration

Risk information influences priorities.

QPPV Visibility

Important risks remain visible.

Inspection Readiness

Planning rationales are defendable.

These characteristics strengthen audit effectiveness considerably.

Key Takeaways

• Risk-based planning directs audit resources toward areas of greatest importance.
• Risk assessment should consider patient safety, compliance, operational and data integrity impacts.
• Audit universes provide the foundation for planning.
• Audit frequency should generally reflect risk.
• Risk assessments should be reviewed periodically.
• Vendor risks and organisational changes should influence priorities.
• Inspectors frequently evaluate planning rationales.
• Mature audit programmes use dynamic, evidence-based planning approaches.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module IV – Pharmacovigilance Audits.
2. EMA Good Pharmacovigilance Practices (GVP) Module I – Pharmacovigilance Systems and Their Quality Systems.
3. EMA Good Pharmacovigilance Practices (GVP) Module III – Pharmacovigilance Inspections.
4. Regulation (EC) No 726/2004.
5. Directive 2001/83/EC.
6. Commission Implementing Regulation (EU) No 520/2012.
7. ICH Q9 Quality Risk Management.
8. ICH E2E Pharmacovigilance Planning.