Selecting and Appointing a QPPV: In-House, External and Hybrid Models

Introduction

Selecting a Qualified Person Responsible for Pharmacovigilance (QPPV) is more than appointing an appropriately qualified pharmacovigilance professional. The appointment determines how the marketing authorisation holder (MAH) will maintain oversight of its pharmacovigilance system, how safety and compliance issues will reach management, and how the organisation will maintain continuity when the QPPV is unavailable.

EU legislation requires the MAH to have permanently and continuously at its disposal an appropriately qualified person responsible for pharmacovigilance. The QPPV must reside and operate in the Union and is responsible for the establishment and maintenance of the pharmacovigilance system.

The legislation does not require the QPPV to be an employee of the MAH. In practice, organisations use different operating models. The QPPV may be an internal employee, an external individual engaged under contract, or part of a broader arrangement in which internal and external pharmacovigilance resources work together.

The important question is therefore not simply who will be named as QPPV? It is:

Which appointment model gives the QPPV sufficient competence, capacity, access, authority and continuity to perform the role effectively within the MAH's actual pharmacovigilance system?

That distinction is particularly important for smaller companies and organisations that outsource significant parts of their pharmacovigilance activities. A QPPV who is technically qualified but lacks access to the system, sufficient time or an effective escalation route may provide much less effective oversight than the organisation assumes.

This article examines the three principal operating models and the controls that should support each of them.

Learning Objectives

After reading this article, the reader should be able to:

• explain the regulatory purpose of the QPPV;
• distinguish in-house, external and hybrid QPPV operating models;
• identify the factors that should determine the appropriate model;
• assess a QPPV candidate's competence, capacity, authority and independence;
• perform meaningful due diligence on an external QPPV provider;
• understand the governance controls needed for an external QPPV;
• design continuity arrangements for planned and unplanned QPPV absence;
• understand how QPPV arrangements should be reflected in the PSMF;
• identify potential inspection vulnerabilities associated with QPPV arrangements.

Regulatory Context

The QPPV Requirement

Article 104 of Directive 2001/83/EC requires an MAH to operate a pharmacovigilance system and, as part of that system, to have permanently and continuously at its disposal an appropriately qualified person responsible for pharmacovigilance. The QPPV must reside and operate in the Union and is responsible for establishing and maintaining the pharmacovigilance system.

This creates two distinct responsibilities.

First, the MAH remains responsible for the pharmacovigilance system.

Second, the QPPV is the appropriately qualified person placed within that system to provide pharmacovigilance oversight and fulfil the responsibilities assigned by the legislation and GVP framework.

The appointment therefore cannot be reduced to placing a person's name and contact details in regulatory records. The organisational arrangement must allow the QPPV to perform the role.

GVP Module I provides the framework for the pharmacovigilance system and its quality system, while GVP Module II addresses the pharmacovigilance system master file (PSMF).

The MAH Remains Responsible When Activities Are Outsourced

An MAH may outsource pharmacovigilance activities. Case processing, literature monitoring, signal management support, aggregate report preparation, safety database activities and other functions may be performed by affiliates or external service providers.

Outsourcing does not, however, remove the MAH's responsibility for the pharmacovigilance system.

This distinction is fundamental when selecting an external QPPV.

An external QPPV is not a mechanism by which an MAH transfers its regulatory accountability to a service provider. The MAH remains responsible for ensuring that its pharmacovigilance system operates appropriately and that the QPPV has the conditions necessary to perform the role.

The practical consequence is that the MAH should evaluate the whole operating model, rather than evaluating the QPPV in isolation.

For example, a highly experienced external QPPV may still be ineffective if:

• the safety database is inaccessible to the QPPV;
• vendors provide only delayed summary information;
• local affiliates do not have defined escalation routes;
• important compliance metrics are unavailable;
• the QPPV is not included in relevant governance meetings; or
• the contract does not support appropriate access and escalation.

The weakness in such a situation is not necessarily the individual QPPV. It is the system surrounding the QPPV.

What Does the Framework Require in Practice?

The legislation and GVP framework together create several practical requirements:

• the QPPV must be suitably qualified for the role;
• the QPPV must have appropriate access to relevant information;
• the pharmacovigilance system must be accurately described in the PSMF;
• the QPPV must be able to communicate with management and escalate concerns;
• continuity must be maintained during absence or transition;
• the appointment model must be consistent with actual operating practice.

These requirements are not separate from the appointment. They are what makes the appointment credible.

Choosing the QPPV Operating Model

There are three practical models commonly encountered:

1. in-house QPPV;
2. external QPPV;
3. hybrid QPPV and PV operating model.

These should be regarded as organisational models rather than three distinct regulatory categories.

The choice should follow the needs and risk profile of the pharmacovigilance system.

In-House QPPV

An in-house QPPV is employed within the MAH or an appropriately structured group organisation.

The principal advantage is integration. An internal QPPV may have direct access to company systems, management, product teams and operational information. The individual may also have greater visibility of informal issues that do not yet appear in formal reports.

An in-house model may be particularly appropriate where the organisation has:

• a large or complex product portfolio;
• multiple affiliates;
• substantial internal PV operations;
• significant regulatory interaction;
• complex outsourcing arrangements;
• frequent safety governance activity; or
• a need for close integration between PV and senior management.

However, internal employment does not automatically create effective oversight.

An internal QPPV can still be weakly positioned if the individual:

• lacks access to senior management;
• has insufficient time for QPPV responsibilities;
• is primarily occupied with operational work;
• cannot challenge other functions;
• lacks visibility of outsourced activities; or
• has no effective continuity arrangement.

The key advantage of an internal QPPV is therefore potential integration, not automatic compliance.

External QPPV

An external QPPV is an appropriately qualified individual engaged under a contractual arrangement with the MAH, either directly or through a specialist service provider.

This model can be practical for:

• small or virtual MAHs;
• start-up companies;
• organisations with limited EU portfolios;
• companies with extensive PV outsourcing;
• companies that do not require a full-time internal QPPV; or
• organisations that need access to experienced QPPV expertise without establishing a large internal PV function.

An external model can work effectively, but it creates a different governance challenge.

The central question becomes:

How does the MAH ensure that an individual who is not embedded in the organisation still has sufficient visibility, authority and capacity to exercise meaningful oversight?

The answer should be found in the operating model, not merely in the service agreement.

An external QPPV should be integrated into the pharmacovigilance system sufficiently to understand its performance and identify situations requiring action.

A QPPV who receives only monthly summaries is in a very different position from one who can directly review relevant performance information, participate in governance, access the PSMF and escalate issues immediately.

Hybrid Model

A hybrid model combines internal and external resources.

Examples include:

• an internal PV team with an external QPPV;
• an internal QPPV supported by external PV operations;
• an internal PV lead supported by an external QPPV;
• internal global PV functions combined with external local or regional support.

Hybrid arrangements can be highly effective because they allow an organisation to retain internal knowledge while accessing specialist external expertise.

They also create more interfaces.

The organisation therefore needs to define:

• who owns each PV process;
• who performs each activity;
• who reviews the output;
• what reaches the QPPV;
• what requires escalation;
• who makes decisions; and
• who tracks resulting actions.

A hybrid model becomes risky when the boundaries are assumed rather than documented.

For example, an internal PV manager may assume that the external QPPV will identify a vendor problem, while the QPPV assumes that the PV manager will escalate it. Neither assumption is necessarily unreasonable, but together they create a control gap.

Selecting the Appropriate Model

The correct model should be determined by the characteristics of the pharmacovigilance system rather than by the QPPV's employment status.

The MAH should consider at least the following.

Portfolio complexity

The number, type and geographic distribution of products affect the volume and complexity of pharmacovigilance activity.

Geographic scope

Multiple affiliates, local safety contacts and different national requirements increase the number of interfaces that the QPPV must oversee.

Outsourcing

Extensive outsourcing increases the importance of vendor governance, performance monitoring and information flow.

PV system maturity

A mature organisation with established processes may require a different level of direct involvement than a newly established PV system.

Safety profile

Products with complex safety profiles, significant ongoing safety evaluation or substantial regulatory commitments may require greater QPPV involvement.

Regulatory activity

Frequent interactions with competent authorities, inspections, referrals, significant variations or other regulatory activity can increase the demands on the QPPV.

Organisational resources

The MAH should assess not only whether it can appoint a QPPV, but whether it can provide the infrastructure required for that person to function effectively.

Continuity risk

The organisation should consider whether the absence or departure of one individual could create a material interruption in PV oversight.

The decision should therefore be based on the system that the QPPV must oversee, rather than simply on the availability or cost of a candidate.

What Does Effective QPPV Oversight Require?

The QPPV does not need to perform every pharmacovigilance activity personally.

The more important question is whether the QPPV has sufficient visibility of the system to determine whether it is functioning appropriately.

Depending on the organisation, meaningful oversight may require visibility of:

• case-processing performance;
• serious and expedited reporting performance;
• case backlog and ageing;
• literature-monitoring performance;
• signal detection and evaluation;
• aggregate safety assessments;
• risk management activities;
• important safety communications;
• compliance deviations;
• overdue regulatory activities;
• audit findings;
• CAPA status;
• vendor performance;
• quality trends;
• safety database or interface problems;
• regulatory commitments;
• significant changes to the PV organisation or processes.

The exact information required will vary according to the system.

The principle is constant:

The QPPV should not be dependent solely on assurances that the system is functioning. The QPPV needs sufficient evidence to exercise informed oversight.

The PSMF itself must remain accessible to the QPPV and reflect the current pharmacovigilance system.

Selecting the QPPV

The selection process should evaluate more than qualifications.

A useful assessment considers four dimensions:

1. competence;
2. capacity;
3. authority;
4. access.

A fifth dimension—continuity—should then be assessed at the system level.

Competence

The QPPV should have appropriate pharmacovigilance knowledge and experience for the responsibilities being undertaken.

The MAH should consider experience in areas such as:

• pharmacovigilance systems;
• safety case management;
• signal management;
• aggregate safety reporting;
• risk management;
• benefit-risk evaluation;
• safety database governance;
• vendor oversight;
• audits and inspections;
• CAPA management;
• regulatory interactions.

The assessment should be proportionate to the organisation.

A small MAH with one established product does not necessarily need a QPPV with identical experience to a global organisation managing a large portfolio of complex products.

The relevant question is whether the candidate's experience is sufficient to understand, challenge and oversee the actual system.

Capacity

A candidate may be highly experienced and still be unsuitable if there is insufficient capacity to perform the role.

The MAH should understand:

• what other QPPV roles the individual holds;
• how many products and organisations they support;
• whether they have operational responsibilities elsewhere;
• their expected availability;
• how much time will be allocated to the MAH;
• how urgent issues will be handled outside scheduled meetings.

This is particularly important when selecting an external QPPV.

A person who technically meets the qualification requirements but cannot respond when a significant safety or compliance issue arises does not provide the same practical protection as an appropriately available QPPV.

Authority

Authority should not be confused with line management.

A QPPV does not necessarily need direct managerial authority over every person involved in pharmacovigilance. The individual does, however, need an effective ability to:

• obtain relevant information;
• challenge inadequate processes;
• request investigation of safety or compliance concerns;
• escalate unresolved issues;
• communicate with appropriate management;
• participate in relevant governance;
• ensure that important issues receive appropriate attention.

The appointment should therefore be examined in terms of practical authority, not organisational title.

Access

Access has several dimensions.

The QPPV may require access to:

• the PSMF;
• relevant safety information;
• compliance information;
• performance indicators;
• audit and CAPA information;
• vendor performance information;
• governance forums;
• relevant procedures;
• personnel responsible for key PV processes.

An external QPPV may be especially dependent on contractual and technical arrangements to obtain this access.

A contract stating that the QPPV has "access to all necessary information" is less useful than an operating model that demonstrates how the access actually works.

Independence and Objectivity

The QPPV should be able to raise concerns even when those concerns are inconvenient for the organisation.

The issue is not that the QPPV must be organisationally independent of the MAH. The QPPV is part of the MAH's pharmacovigilance system.

The issue is whether the organisational structure permits appropriate professional challenge.

The MAH should consider whether the QPPV can:

• raise concerns without obstruction;
• challenge inadequate performance;
• escalate unresolved compliance issues;
• communicate concerns to senior management;
• identify safety issues that may conflict with commercial priorities.

A QPPV with no effective escalation route may be formally appointed but practically constrained.

Due Diligence Before Appointment

Due diligence should be proportionate to the proposed model.

For an internal appointment, it may include:

• review of qualifications;
• review of relevant experience;
• assessment of current workload;
• conflict-of-interest assessment;
• discussion of the role's authority;
• confirmation of management support;
• assessment of continuity arrangements.

For an external QPPV, the assessment should go further.

External QPPV Provider Due Diligence

The MAH should not assess only the consultancy or provider. It should assess the specific individual who will perform the QPPV role and the system supporting that individual.

Useful questions include:

1. Is a specific individual identified as the QPPV?
2. Is the individual permanently and continuously available to the MAH as required?
3. Does the individual reside and operate in the Union?
4. Does the individual have appropriate pharmacovigilance and EU regulatory experience?
5. What other QPPV or major PV responsibilities does the individual hold?
6. What proportion of the individual's capacity is realistically available to this MAH?
7. Are there conflicts of interest?
8. What information will the QPPV receive automatically?
9. What systems and records can the QPPV access directly?
10. Can the QPPV participate in relevant governance meetings?
11. Can the QPPV escalate directly to appropriate management?
12. Can the QPPV interact with competent authorities and inspectors when required?
13. Is subcontracting used?
14. What happens if the individual becomes unavailable?
15. What happens if the provider relationship terminates?

The answers should be evaluated against the MAH's actual operating model.

A provider with an excellent reputation is not necessarily the right provider if the proposed individual has insufficient capacity or if the service model does not provide the access required.

Testing the Candidate's Judgment

An interview should not rely exclusively on questions about regulations.

Scenario-based questions are often more informative.

Vendor failure

A critical vendor has repeatedly missed reporting deadlines. The vendor's latest performance report is still within the contractual tolerance, but the trend is worsening. What would you do?

This tests whether the candidate thinks beyond binary compliance.

Emerging safety concern

A possible new safety issue is identified shortly before a major regulatory submission. How would you determine what needs to be escalated and when?

This tests prioritisation and judgement.

Poor information flow

You discover that an affiliate has been sending safety information through a process that is not reflected accurately in the PSMF. What would you do?

This tests system oversight.

Management disagreement

Senior management does not agree with your assessment that a PV process requires corrective action. How would you proceed?

This tests escalation capability.

The objective is not to find a candidate who gives a predetermined answer to every scenario. It is to determine whether the person understands how to recognise risk, gather evidence, make proportionate decisions and escalate when necessary.

Contracting an External QPPV

The contract should support the QPPV function rather than simply describe the provision of a named individual.

The agreement should define, as appropriate:

• identity and role of the QPPV;
• scope of responsibilities;
• access to relevant information and systems;
• governance participation;
• escalation mechanisms;
• communication arrangements;
• inspection support;
• confidentiality;
• data protection;
• absence arrangements;
• replacement arrangements;
• transition and handover;
• termination arrangements;
• management of subcontractors where applicable.

The contractual document should be consistent with the actual operating model.

For example, it is not useful to promise "24/7 availability" if the operating procedures provide no mechanism for contacting the QPPV outside normal working hours.

Likewise, a contract that states that the QPPV has authority to escalate issues is weak if the organisation has not established an actual escalation route.

The contract and the operating system should therefore be considered together.

Defining the Boundary Between Oversight and Operations

An external QPPV does not necessarily need to perform operational PV activities.

In fact, excessive operational involvement can create a different problem: the QPPV may become so involved in executing processes that insufficient time remains for independent oversight.

The MAH should therefore distinguish between:

Operational responsibility

• processing cases;
• conducting literature searches;
• drafting reports;
• performing routine data entry;
• operating the safety database.

and:

Oversight responsibility

• assessing whether processes are functioning;
• reviewing performance and compliance;
• identifying systemic weaknesses;
• challenging deficiencies;
• ensuring appropriate escalation;
• overseeing corrective actions.

The precise division will vary by organisation.

The important point is that the QPPV should retain sufficient perspective to evaluate whether the system is functioning effectively.

Continuity and Backup Arrangements

The QPPV requirement is continuous. Planned leave, illness, resignation or unexpected unavailability should therefore be addressed before the event occurs.

Backup procedures should provide continuity during QPPV absence. The backup person should have sufficient information and access to perform the functions necessary to maintain oversight during the absence.

Continuity planning should address:

• planned absence;
• unexpected absence;
• access to current safety information;
• access to relevant systems and records;
• open safety issues;
• open compliance issues;
• pending regulatory commitments;
• inspections and audits;
• CAPAs;
• communication routes;
• escalation of urgent matters;
• prolonged vacancy.

The backup arrangement should provide a person who is appropriately informed, trained for the role and able to perform the functions necessary to maintain continuity during the QPPV's absence.

Continuity should therefore be treated as a system control, rather than simply a human-resources arrangement.

Avoiding a Single Point of Failure

A small MAH may have only one person formally designated as QPPV.

That does not necessarily mean that the pharmacovigilance system must depend entirely on that individual's personal knowledge.

The organisation should retain sufficient institutional knowledge through:

• controlled procedures;
• current PSMF information;
• documented governance decisions;
• accessible performance information;
• documented open actions;
• defined escalation routes;
• trained backup personnel.

The objective is not to create a second QPPV merely for redundancy.

The objective is to ensure that the pharmacovigilance system remains controllable if the primary QPPV becomes temporarily unavailable.

PSMF Alignment

The PSMF should describe the pharmacovigilance system that actually exists.

This includes the organisational structure, relevant delegated activities, contracts and arrangements, processes, systems and performance information.

The organisation should therefore ensure that the PSMF remains aligned with:

• the identity and contact information of the QPPV;
• applicable backup arrangements;
• organisational structure;
• outsourced PV activities;
• relevant contracts and interfaces;
• PV systems and databases;
• key PV processes;
• performance information.

Changes to the pharmacovigilance system should be managed through appropriate change control, and changes affecting QPPV information should be managed through the applicable regulatory processes.

The PSMF should not describe an idealised operating model while the actual organisation operates differently.

That discrepancy is particularly problematic during inspection.

Inspection Considerations

A QPPV arrangement should be capable of being demonstrated, not merely described.

During inspection, the MAH may need to demonstrate how the QPPV actually exercises oversight.

Potential areas of examination include:

• how the QPPV was appointed;
• how suitability was assessed;
• how the QPPV accesses information;
• how the QPPV participates in governance;
• how safety issues are escalated;
• how outsourced activities are overseen;
• how performance is monitored;
• how absence is managed;
• how the PSMF reflects the actual system;
• how changes to the PV organisation are controlled.

The organisation should be able to connect the written description of the system with evidence that the system actually operates as described.

Potential Inspection Vulnerabilities

Nominal appointment

The QPPV is formally appointed but has little practical involvement in the PV system.

Insufficient access

The QPPV receives summaries but cannot readily access the underlying information needed to investigate concerns.

Capacity constraints

The QPPV has too many competing responsibilities to provide meaningful oversight.

Weak escalation

The QPPV can identify problems but has no effective route to management.

Outsourcing blind spots

The QPPV is unaware of important failures or trends within outsourced activities.

PSMF mismatch

The PSMF describes a different organisational structure from the one actually operating.

Weak continuity

The organisation has no credible arrangement for maintaining oversight during QPPV absence.

Contractual ambiguity

An external agreement does not clearly define access, escalation, responsibilities or transition.

These weaknesses are interconnected. A nominal QPPV, for example, may be the consequence of weak governance rather than an unsuitable individual.

Common Selection Mistakes

Choosing on credentials alone

A strong CV does not establish that the candidate has the time, authority or access needed for the specific role.

Choosing on cost alone

The cheapest QPPV arrangement may become expensive if inadequate oversight contributes to compliance failures, vendor problems or regulatory intervention.

Treating the QPPV as a service provider rather than a governance role

An external QPPV should be integrated into the pharmacovigilance system sufficiently to perform the responsibilities of the role.

Assuming outsourcing removes accountability

The MAH remains responsible for its pharmacovigilance system.

Failing to assess workload

An external QPPV supporting numerous organisations may have limited capacity for another complex appointment.

Confusing operational activity with oversight

A QPPV who performs large amounts of operational work may have less time to evaluate the effectiveness of the system.

Treating continuity as an afterthought

Backup arrangements should exist before absence occurs.

Allowing the PSMF to become outdated

The PSMF should describe the current system and remain controlled as the system changes.

Worked Example: Small MAH With an Outsourced PV System

Consider a small MAH with one authorised medicinal product.

The company has outsourced:

• individual case processing;
• medical literature monitoring;
• safety database administration; and
• preparation of the periodic safety report.

The company is deciding between an internal part-time QPPV and an external QPPV.

The decision should not begin with price.

The MAH should first map the system that the QPPV will oversee.

Who receives safety information?

Who monitors vendor performance?

Who reviews compliance?

Who evaluates signals?

Who decides when an issue requires escalation?

Who maintains the PSMF?

Who attends safety governance meetings?

Who is available when the QPPV is absent?

If the internal candidate has appropriate experience but is heavily occupied with unrelated responsibilities and cannot access vendor performance information, the apparent advantage of an internal appointment may be illusory.

Conversely, an external QPPV may provide strong expertise and availability but still be ineffective if the company expects the individual to oversee the system without giving them access to vendor metrics, safety information or management.

The appropriate model is therefore the one in which the QPPV can actually perform the required oversight.

A Practical Selection Test

Before appointing a QPPV, the MAH should be able to answer five questions.

1. Competence

Does this person understand pharmacovigilance sufficiently to oversee our system?

2. Capacity

Does this person have sufficient time and availability to perform the role?

3. Access

Will this person receive and be able to obtain the information needed to identify problems?

4. Authority

Can this person challenge, escalate and obtain action when necessary?

5. Continuity

Will the pharmacovigilance system remain under effective oversight if this person becomes unavailable?

If any answer is uncertain, the appointment should not be considered complete.

The weakness may be in the individual, the organisational structure, the contract, the information systems or the continuity model.

Practical QPPV Considerations

The strongest QPPV appointment is not necessarily the most senior, the most expensive or the most operationally involved.

It is the appointment that gives an appropriately qualified person the conditions necessary to exercise meaningful pharmacovigilance oversight.

For an in-house model, that usually means sufficient organisational position, resources, access and management support.

For an external model, it additionally means a contractual and operational framework that integrates the QPPV into the MAH's system rather than leaving the person at arm's length.

For a hybrid model, it means clear interfaces and ownership so that internal and external participants do not create gaps between activities.

Across all three models, the same principles apply:

• competence;
• capacity;
• access;
• authority;
• continuity;
• accurate documentation.

These are more important than whether the QPPV is labelled "internal" or "external".

Key Takeaways

The MAH must have permanently and continuously at its disposal an appropriately qualified QPPV who resides and operates in the Union and is responsible for establishing and maintaining the pharmacovigilance system.

The legislation does not make employment status the central issue. The effectiveness of the arrangement depends on whether the QPPV can perform the role within the MAH's actual pharmacovigilance system.

An in-house QPPV can provide strong organisational integration, but employment alone does not guarantee effective oversight.

An external QPPV can be an effective model, particularly for smaller or highly outsourced organisations, provided the individual has sufficient capacity, access, authority and integration into the PV system.

Hybrid models can work well but require particularly clear definition of responsibilities and information flows.

Outsourcing PV activities does not remove the MAH's responsibility for its pharmacovigilance system.

Continuity and backup arrangements should be established before the QPPV becomes unavailable.

The PSMF should reflect the actual pharmacovigilance system and remain aligned with the QPPV arrangement and applicable backup arrangements.

The most useful test of a QPPV appointment is therefore not whether the appointment exists on paper, but whether the person can see, understand, challenge and escalate what is happening in the pharmacovigilance system.

References

1. European Parliament and Council. Directive 2001/83/EC on the Community code relating to medicinal products for human use, Article 104. Consolidated text.
2. European Commission. Commission Implementing Regulation (EU) No 520/2012 on the performance of pharmacovigilance activities, as amended.
3. European Medicines Agency. Guideline on good pharmacovigilance practices (GVP), Module I – Pharmacovigilance systems and their quality systems.
4. European Medicines Agency. Guideline on good pharmacovigilance practices (GVP), Module II – Pharmacovigilance system master file (Rev. 2).
5. European Medicines Agency. Guideline on good pharmacovigilance practices (GVP), Module III – Pharmacovigilance inspections (Rev. 1).
6. European Medicines Agency. Questions and answers and guidance concerning the pharmacovigilance system, QPPV and PSMF.