QPPV.COM

RMP Governance and Version Control

A practical guide to RMP governance, document ownership, change control, global-to-local management and regulatory expectations.

RMP Governance and Version Control

Introduction

Risk Management Plans are among the most complex pharmacovigilance documents maintained throughout the lifecycle of a medicinal product. Unlike many regulatory documents, RMPs evolve continuously as new safety information becomes available and as regulatory obligations change.

A single product may have multiple related risk management documents across different jurisdictions and regulatory procedures. Updates may be triggered by signal assessments, study results, product information changes, new indications or regulatory requests.

Effective governance and version control are therefore essential. Without them, organisations may struggle to maintain consistency, implement changes appropriately or demonstrate regulatory compliance.

Why Governance Matters

Governance provides the framework through which RMP decisions are reviewed, approved and implemented.

The objective is to ensure that:

Governance is particularly important because RMP decisions frequently affect pharmacovigilance activities, risk minimisation measures and benefit-risk evaluation.

Governance Objectives

A mature governance framework should support:

The goal is not administrative control for its own sake. The goal is to ensure that risk management activities remain accurate, current and defensible.

RMP Ownership

Ownership should be defined clearly.

Different organisations allocate responsibilities differently, but ownership commonly involves collaboration between:

The governance framework should identify:

Ambiguity regarding ownership is a common source of lifecycle management problems.

Global and Local Ownership Models

Large multinational organisations frequently operate multiple ownership layers.

For example:

Global Core RMP Owner
          ↓
Regional RMP Leads
          ↓
Local Affiliates

This structure allows global consistency while supporting local regulatory obligations.

However, effective communication between levels is essential.

Governance Committees

Many organisations review significant RMP changes through governance committees.

Examples include:

Committee review may be appropriate when changes involve:

Committee oversight provides documentation and accountability for important decisions.

Relationship to Signal Management

Signal management and RMP governance are closely connected.

Signal outcomes may result in:

Governance frameworks should ensure that signal management outputs are evaluated systematically for potential RMP impact.

A frequent inspection question is:

How are significant signal outcomes evaluated for RMP updates?

Organisations should be able to demonstrate a clear process.

Relationship to Product Information

Changes to product information may affect the RMP.

Examples include:

Governance processes should assess whether product information changes require corresponding updates to:

Consistency between these documents is important.

Version Control Principles

Version control ensures that organisations can identify:

Without robust version control, inconsistencies may develop across jurisdictions and product teams.

Version control is therefore a core component of RMP governance.

Version Numbering

Version numbering practices vary.

Common approaches include:

Version 1.0
Version 1.1
Version 2.0
Version 3.0

Major versions often reflect substantial updates.

Minor versions may reflect administrative or limited content changes.

The specific approach is less important than consistency and traceability.

Change Histories

Each update should be supported by a documented change history.

Typical change logs may include:

Change histories support transparency and facilitate inspection review.

Inspectors frequently examine update rationale.

Trigger-Based Change Management

Many organisations operate trigger-based update systems.

Common triggers include:

Signal Assessments

New evidence affecting safety concerns.

PASS Results

Completion of post-authorisation studies.

Regulatory Requests

Health authority requirements.

New Indications

Expansion of product use.

Product Information Changes

Safety-related labelling updates.

Trigger-based approaches help ensure consistent evaluation of update requirements.

Core RMP and Derived Documents

Many companies maintain a hierarchy of risk management documents.

For example:

Global Core RMP
        ↓
EU-RMP
        ↓
Country Annexes

or

Reference RMP
        ↓
Local Adaptations

Governance processes should define:

Failure to define document hierarchy frequently results in inconsistencies.

Global-to-Local Change Control

When changes occur within the core document, local impacts should be evaluated systematically.

Examples include:

The organisation should be able to demonstrate:

This process is particularly important for products marketed in multiple jurisdictions.

Regulatory Commitment Tracking

Many RMPs contain commitments.

Examples include:

Governance frameworks should ensure that commitments are:

Open commitments should remain visible within governance processes.

Document Repositories

RMPs should be maintained within controlled document management systems.

Systems should support:

Inspectors may review how organisations manage controlled copies of RMPs.

Inspection Focus Areas

Inspectors commonly review:

The objective is to determine whether RMPs are maintained systematically and remain aligned with current product knowledge.

Common Governance Failures

Several recurring issues are observed.

Unclear Ownership

Personnel cannot identify who is responsible for updates.

Weak Change Control

Updates occur without documented rationale.

Inconsistent Documents

Different jurisdictions contain conflicting information.

Poor Commitment Tracking

Studies and actions are not monitored effectively.

Delayed Updates

Important safety information is not incorporated promptly.

Weak Governance Documentation

Approval decisions cannot be reconstructed.

These deficiencies may lead to inspection findings.

Role of the QPPV

The QPPV should maintain visibility of significant risk management activities.

This includes awareness of:

The QPPV is not necessarily the author of the RMP, but inspectors often expect the QPPV to understand how important risk management decisions are governed and implemented.

Characteristics of Mature Governance Systems

Mature RMP governance systems generally demonstrate:

The objective is to maintain an accurate and scientifically justified risk management strategy throughout the product lifecycle.

Key Takeaways

RMP governance ensures that risk management decisions are reviewed, approved and implemented consistently.

Version control and change management are essential because RMPs evolve continuously throughout the product lifecycle.

Signal assessments, study results, regulatory actions and product information changes frequently trigger updates.

Global and local document management requires strong governance and clearly defined ownership.

Inspectors commonly review governance arrangements, change histories and commitment tracking when assessing RMP compliance.

References

  1. EMA Good Pharmacovigilance Practices (GVP) Module V – Risk Management Systems.
  2. EMA Risk Management Plan Template.
  3. Commission Implementing Regulation (EU) No 520/2012.
  4. Regulation (EC) No 726/2004.
  5. Directive 2001/83/EC.
  6. ICH E2E Pharmacovigilance Planning.
  7. EMA Guidance on Risk Management Systems.
  8. CIOMS IX Practical Approaches to Risk Minimisation.

Related Articles

Country-Specific RMP Annexes

A practical guide to managing country-specific RMP annexes, local commitments, version control and global risk management strategies.

RMP Lifecycle Management

A practical guide to managing Risk Management Plans after approval, including update triggers, governance, version control and inspection expectations.

Common PSMF Inspection Findings

A practical inspection-focused guide to understanding recurring PSMF deficiencies and how to prevent them.

Last reviewed: 2026-06-11