Risk-Based Audit Planning in Pharmacovigilance

It should be ignored once the audit report is issued It can inform the Historical Performance factor and may support an adjusted priority when improvement is demonstrated It should automatically reduce every risk factor to the minimum score It should be used only to determine auditor performance ratings

Unwritten expert judgement and flexible thresholds Defined factors, scoring anchors, weights, calculation rules and evidence requirements A single factor based only on historical audit findings Different scoring methods selected by each auditor

They allow inspectors and governance bodies to reconstruct how each factor and conclusion was derived They prevent future reassessment of the activity They are needed only to calculate auditor travel expenses They demonstrate that all activities received identical scores

A CAPA record marked closed by the responsible owner A revised procedure with no implementation evidence Documented verification against predefined effectiveness criteria, supported by relevant results A statement that the next audit will consider the issue

To ensure the unit can be identified, assessed and assigned accountability for follow-up To allow the owner to approve the unit's own audit findings To avoid including outsourced activities in the audit universe To make audit scoring unnecessary

They require no assurance because they are not High or Critical They may be addressed through targeted audits, desktop reviews or thematic audits on a longer cycle, with reassessment if risk changes They must always receive a comprehensive annual audit They should be excluded from the audit universe

Because operational disruption is never relevant to PV Because the weighting should reflect organisational priorities and the consequences most important to patients and compliance Because patient safety scores are always objective and require no evidence Because weighted models must always use a 35% patient safety factor

Wait until the next annual planning cycle because the calendar is fixed Remove the vendor from the audit universe until migration is complete Assess the change as a trigger, reassess risk and consider a targeted audit or readiness review Automatically classify every PV process as Critical

The plan links each audit to its risk score, source evidence and governance approval A high-risk vendor is audited after documented review of findings and data-integrity concerns An audit is scheduled because it appears on last year's calendar, with no current risk assessment or rationale A triggered audit is added after a documented system migration assessment

Select audits based mainly on which departments request them Audit the oldest processes first regardless of risk Document the risk criteria, evidence and rationale used to select and schedule audits Schedule audits randomly to demonstrate independence