Common Vendor Oversight Inspection Findings

Introduction

Vendor oversight is one of the most frequently scrutinised areas during pharmacovigilance inspections.

This is not because regulators oppose outsourcing.

Modern pharmacovigilance systems depend heavily upon external providers.

Instead, inspectors focus on a different question:

Does the Marketing Authorisation Holder maintain effective control of outsourced activities?

Many inspection findings arise when organisations can demonstrate outsourcing but struggle to demonstrate oversight.

The purpose of this article is not to create anxiety.

The purpose is to identify recurring weaknesses and explain the governance failures that often sit behind them.

Understanding Inspection Expectations

Inspectors generally recognise that:

• Activities may be outsourced.
• Vendors may perform critical functions.
• Global operating models are common.

The expectation is not direct operational control.

The expectation is effective oversight.

Inspectors typically evaluate:

• Accountability
• Governance
• Risk management
• Visibility
• Escalation
• Continuous improvement

When weaknesses appear in these areas, findings often follow.

Finding 1: Incomplete Vendor Inventories

One of the most common observations involves incomplete visibility regarding outsourced activities.

Examples include:

• Missing vendors
• Outdated vendor lists
• Incorrect service descriptions
• Missing critical vendors

This creates a simple problem.

If the organisation cannot accurately identify vendors, effective oversight becomes difficult.

Root Cause

Often reflects weak governance rather than poor documentation.

Prevention

• Maintain formal inventories.
• Assign ownership.
• Integrate updates into change control.

For additional discussion see:

[[psmf-vendor-and-sdea-management]]

Finding 2: Weak Vendor Risk Assessment

Some organisations apply identical oversight to every vendor.

Others have risk assessment procedures that exist only on paper.

Inspectors frequently identify situations where:

• Critical vendors receive minimal oversight.
• Risk classifications are poorly justified.
• Assessments are outdated.

Root Cause

Failure to implement risk-based governance.

Prevention

• Establish risk categories.
• Define reassessment frequency.
• Document rationales.

For additional discussion see:

[[vendor-risk-assessment]]

Finding 3: Unclear Responsibilities

Responsibility gaps remain one of the most common outsourcing problems.

Examples include:

• Both parties assume the other will perform an activity.
• Escalation responsibilities are unclear.
• Safety reporting ownership is ambiguous.

Root Cause

Poor governance design.

Prevention

• Define responsibilities clearly.
• Review governance arrangements regularly.
• Align agreements with operational reality.

Finding 4: Weak or Outdated SDEAs

Inspectors frequently review Safety Data Exchange Agreements.

Common observations include:

• Outdated agreements.
• Missing activities.
• Incorrect timelines.
• Ambiguous wording.

An agreement that no longer reflects actual operations may create significant inspection concerns.

Root Cause

Failure to maintain agreements.

Prevention

• Periodic review.
• Change-triggered review.
• Governance ownership.

For additional discussion see:

[[what-is-a-sdea]]

Finding 5: Lack of Evidence of Oversight

This is one of the most significant findings categories.

The organisation states that oversight occurs.

However, evidence is limited.

Examples include:

• Missing meeting records.
• Missing performance reviews.
• Missing escalation records.
• Missing governance documentation.

Root Cause

Oversight activities occur informally.

Prevention

• Document governance activities.
• Maintain records.
• Track actions and decisions.

Finding 6: Ineffective KPI Monitoring

Many organisations collect large amounts of performance data.

Yet meaningful oversight remains limited.

Examples include:

• Metrics without thresholds.
• Metrics without action plans.
• Metrics reviewed but not acted upon.

Inspectors often ask:

What happens when performance deteriorates?

If the answer is unclear, findings may follow.

Root Cause

Metrics exist without governance integration.

Prevention

• Define thresholds.
• Define escalation pathways.
• Review trends.

For additional discussion see:

[[vendor-kpis-and-metrics]]

Finding 7: Weak Audit Programmes

Vendor audits frequently attract inspection attention.

Examples of weaknesses include:

• No audit programme.
• Audit frequency not risk-based.
• Significant findings not addressed.
• Long-overdue follow-up activities.

Root Cause

Audits treated as administrative requirements.

Prevention

• Apply risk-based planning.
• Monitor CAPAs.
• Conduct effectiveness checks.

For additional discussion see:

[[vendor-audits]]

Finding 8: CAPA Failures

A finding is not necessarily a problem.

Failure to resolve a finding is.

Common observations include:

• Overdue CAPAs.
• Weak root cause analysis.
• Repeat deficiencies.
• Ineffective actions.

Root Cause

Focus on symptom correction rather than system improvement.

Prevention

• Perform meaningful root cause analysis.
• Verify effectiveness.
• Monitor recurrence.

Finding 9: Limited QPPV Visibility

Inspectors often assess whether the QPPV understands outsourced activities.

Examples of concerns include:

• Limited awareness of critical vendors.
• Limited awareness of significant issues.
• Limited visibility of vendor performance.

Root Cause

Weak escalation pathways.

Prevention

• Define reporting requirements.
• Include critical vendor review in governance processes.

For additional discussion see:

[[vendor-oversight-for-qppvs]]

Finding 10: Failure to Align Documentation

Inspectors frequently compare:

• PSMF
• Vendor inventories
• SDEAs
• SOPs
• Audit records

Differences between documents may generate concerns regarding governance effectiveness.

Root Cause

Independent document maintenance.

Prevention

• Periodic reconciliation.
• Integrated governance reviews.

Finding 11: Over-Reliance on Vendors

A subtle but important issue involves excessive dependence.

Examples include:

• No internal expertise.
• Limited oversight capability.
• Limited understanding of outsourced activities.

Inspectors may question whether meaningful oversight is possible under such circumstances.

Root Cause

Governance capability has not evolved with outsourcing.

Prevention

• Maintain internal expertise.
• Strengthen oversight functions.

Finding 12: Weak Change Control

Vendor relationships evolve continuously.

Examples include:

• Scope changes.
• New products.
• New regions.
• Technology changes.

When change control is weak:

• Agreements become outdated.
• Risk assessments become inaccurate.
• Oversight becomes misaligned.

Root Cause

Poor integration between outsourcing governance and quality systems.

Prevention

• Link change control to vendor governance.
• Trigger reviews automatically.

What Inspectors Are Really Assessing

Although findings may appear diverse, most relate to a small number of governance questions.

Visibility

Does the organisation understand its vendor landscape?

Accountability

Are responsibilities clear?

Control

Can oversight effectiveness be demonstrated?

Risk Management

Is oversight proportional to risk?

Continuous Improvement

Are problems identified and resolved?

Most findings ultimately reflect weaknesses in one or more of these areas.

Characteristics of Inspection-Ready Vendor Oversight

Organisations that perform well during inspections commonly demonstrate:

Accurate Vendor Inventories

Vendor relationships are visible.

Current Agreements

Responsibilities remain clear.

Risk-Based Oversight

Controls reflect risk.

Active Governance

Performance is reviewed regularly.

Effective Audits

Independent verification exists.

Sustainable CAPAs

Problems are resolved systematically.

QPPV Visibility

Critical outsourced activities remain visible to senior pharmacovigilance leadership.

Key Takeaways

• Most vendor oversight findings reflect governance weaknesses rather than operational failures.
• Incomplete inventories, weak risk assessments and outdated SDEAs are common issues.
• Metrics, audits and CAPAs must support active oversight.
• QPPV visibility remains an important inspection consideration.
• Documentation should remain aligned across governance systems.
• Effective oversight depends upon visibility, accountability, control and continuous improvement.
• Mature organisations treat vendor oversight as a permanent governance activity rather than an inspection preparation exercise.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module I – Pharmacovigilance Systems and Their Quality Systems.
2. EMA Good Pharmacovigilance Practices (GVP) Module II – Pharmacovigilance System Master File.
3. EMA Good Pharmacovigilance Practices (GVP) Module III – Pharmacovigilance Inspections.
4. Regulation (EC) No 726/2004.
5. Directive 2001/83/EC.
6. Commission Implementing Regulation (EU) No 520/2012.
7. ICH Q9 Quality Risk Management.
8. PIC/S Guidance on Pharmacovigilance Inspections.