Vendor Oversight for QPPVs

Introduction

Modern pharmacovigilance systems increasingly depend upon outsourced activities.

A typical Marketing Authorisation Holder may outsource:

• Case processing
• Literature surveillance
• Medical information
• Aggregate reporting
• Signal management support
• Safety database hosting

As outsourcing expands, an important question emerges:

How can a QPPV maintain oversight of activities they do not directly perform?

This question sits at the centre of modern pharmacovigilance governance.

The answer is not direct operational involvement.

The answer is effective oversight.

The QPPV's Role

The QPPV is responsible for oversight of the pharmacovigilance system.

This responsibility differs from operational management.

Operational teams perform activities.

The QPPV maintains visibility regarding:

• Compliance
• Governance
• Risk
• Escalation
• System effectiveness

A useful distinction is:

Operations

Perform the work.

Oversight

Verify that the work is performed appropriately.

The QPPV primarily operates within the second category.

Outsourcing Does Not Remove QPPV Responsibilities

A common misunderstanding is that outsourcing reduces QPPV accountability.

Regulatory expectations do not support this interpretation.

Although activities may be delegated, responsibility remains.

This means the QPPV should understand:

• Which activities are outsourced
• Which vendors perform them
• Which activities are critical
• How performance is monitored
• How issues are escalated

The objective is not detailed operational management.

The objective is informed oversight.

What the QPPV Needs to Know

A QPPV does not need to memorise every contract or KPI.

However, visibility regarding several areas is essential.

Vendor Landscape

The QPPV should understand:

• Which vendors exist
• Which activities they perform
• Which activities are critical

Risk Profile

The QPPV should understand:

• High-risk vendors
• Critical dependencies
• Significant vulnerabilities

Governance Structure

The QPPV should understand:

• Ownership
• Escalation pathways
• Review mechanisms

Compliance Performance

The QPPV should understand:

• Significant trends
• Significant deficiencies
• Emerging concerns

The QPPV and Critical Vendors

Not all vendors require equal attention.

QPPV visibility should be greatest where risk is highest.

Examples include:

• Safety database providers
• Case processing vendors
• Literature surveillance vendors
• Aggregate reporting providers

A useful question is:

If this vendor failed tomorrow, would pharmacovigilance compliance be affected?

If the answer is yes, the QPPV should understand the associated risks.

Vendor Risk Through the QPPV Lens

QPPVs often view vendor risk differently from operational teams.

Operational teams may focus on:

• Workload
• Throughput
• Service delivery

QPPVs often focus on:

• Compliance impact
• Patient safety impact
• Inspection risk
• Business continuity

These perspectives complement one another.

Together they provide a more complete understanding of risk.

Governance Information the QPPV Should Receive

A practical governance framework often provides the QPPV with visibility regarding:

Critical Vendor List

Current critical vendors.

Significant Deviations

Major compliance concerns.

Audit Outcomes

Important audit findings.

CAPA Status

Significant open actions.

Escalations

Issues requiring management attention.

The objective is meaningful visibility rather than information overload.

Vendor Dashboards for QPPVs

Dashboards can help support oversight.

However, QPPV dashboards should differ from operational dashboards.

Operational dashboards may contain:

• Work queues
• Volumes
• Resource metrics

QPPV dashboards should focus on:

• Compliance indicators
• Risk indicators
• Escalations
• Audit outcomes
• CAPA performance

The purpose is governance, not operations.

Vendor Audits and the QPPV

The QPPV may not perform audits directly.

Nevertheless, audit outcomes provide valuable oversight information.

Particularly relevant areas include:

• Critical findings
• Repeat findings
• Major CAPAs
• Systemic weaknesses

Audit results often reveal issues not visible through routine governance reporting.

For additional discussion see:

[[vendor-audits]]

CAPAs and the QPPV

A mature governance model ensures the QPPV has visibility regarding:

• Significant CAPAs
• Overdue CAPAs
• Repeat deficiencies
• Effectiveness concerns

CAPAs are often stronger indicators of organisational health than individual findings.

Persistent CAPA issues frequently suggest broader governance weaknesses.

The QPPV and SDEAs

Safety Data Exchange Agreements define responsibilities across organisational boundaries.

The QPPV should understand:

• Which relationships require SDEAs
• Which responsibilities are shared
• Which responsibilities remain internal
• Which activities create significant risk

The objective is not contract management.

The objective is governance awareness.

For additional discussion see:

[[what-is-a-sdea]]

Vendor Oversight and the PSMF

The Pharmacovigilance System Master File provides a structured description of the pharmacovigilance system.

For QPPVs, the PSMF often serves as an important oversight tool.

The PSMF should help answer questions such as:

• Which vendors perform critical activities?
• How is oversight maintained?
• How are responsibilities allocated?
• How are risks controlled?

A well-maintained PSMF supports effective oversight significantly.

For additional discussion see:

[[psmf-qppv-oversight]]

Common QPPV Oversight Failures

Several weaknesses appear repeatedly.

Limited Vendor Visibility

The QPPV cannot clearly identify critical vendors.

Weak Escalation Pathways

Important issues do not reach the QPPV.

Over-Reliance on Operational Reports

Oversight becomes dependent on filtered information.

Insufficient Risk Focus

High-risk vendors receive inadequate attention.

Weak Governance Integration

Vendor oversight operates separately from broader PV governance.

These weaknesses frequently become apparent during inspections.

Inspection Perspective

Inspectors often explore several questions.

Does the QPPV Understand Outsourced Activities?

Can the QPPV Explain Oversight Arrangements?

Does the QPPV Receive Significant Vendor Information?

Can the QPPV Discuss Critical Risks?

The objective is not testing memory.

The objective is assessing oversight effectiveness.

What Inspectors Want to See

Strong inspection performance often includes:

• Clear vendor inventories
• Risk-based oversight
• Effective governance
• Meaningful escalation
• QPPV visibility
• Documented evidence

Inspectors generally seek confidence that outsourced activities remain under organisational control.

Characteristics of Mature QPPV Oversight

High-performing organisations commonly demonstrate:

Visibility

The QPPV understands outsourced activities.

Risk Awareness

Critical risks are visible.

Governance Integration

Vendor oversight supports broader PV governance.

Effective Escalation

Significant issues reach appropriate stakeholders.

Continuous Review

Oversight remains active throughout the year.

These characteristics support both compliance and inspection readiness.

A Practical Question for Every QPPV

A useful self-assessment question is:

If a critical vendor experienced a major compliance failure today, how quickly would I know?

The answer often reveals the maturity of the oversight framework.

Strong organisations provide rapid visibility.

Weak organisations often discover issues much later.

Key Takeaways

• The QPPV is responsible for oversight rather than operational execution.
• Outsourcing activities does not remove accountability.
• QPPVs should maintain visibility regarding critical vendors, risks and compliance performance.
• Dashboards, audits, CAPAs and governance reviews all support oversight.
• Effective escalation pathways are essential.
• The PSMF and vendor governance framework should support QPPV visibility.
• Inspectors frequently assess whether the QPPV understands outsourced pharmacovigilance activities.
• Mature organisations treat vendor oversight as a core governance responsibility.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module I – Pharmacovigilance Systems and Their Quality Systems.
2. EMA Good Pharmacovigilance Practices (GVP) Module II – Pharmacovigilance System Master File.
3. EMA Good Pharmacovigilance Practices (GVP) Module III – Pharmacovigilance Inspections.
4. Regulation (EC) No 726/2004.
5. Directive 2001/83/EC.
6. Commission Implementing Regulation (EU) No 520/2012.
7. ICH Q9 Quality Risk Management.
8. ICH E2E Pharmacovigilance Planning.