EU PV Regulatory Intelligence news: EU Commission Implementing Regulation 2025/1466 Other
guides
NextPV Services

PV Systems: full outsourcing, gap analysis, PSMF & QMS development

What does it take to build a pharmacovigilance system that passes an EMA inspection?

A functioning pharmacovigilance system is a legal prerequisite for holding a marketing authorization in the EU. Under EU Directive 2001/83/EC, Articles 101-108, every marketing authorization holder (MAH) must operate a pharmacovigilance system proportionate to the risks of their products. The system must be described in a Pharmacovigilance System Master File (PSMF), maintained under a quality management system (QMS), and available for inspection at any time.

This article covers the three core aspects of PV system management: full system outsourcing, gap analysis and audits, and PSMF/QMS development.

Full Pharmacovigilance System Outsourcing

When Does Full PV Outsourcing Make Sense?

Full pharmacovigilance system outsourcing means delegating all PV operations — adverse event collection, case processing, signal detection, periodic reporting, regulatory submissions, and QPPV services — to an external provider. This approach is most common among:

  • Phase 3 biotechs preparing for EU market entry that lack existing PV infrastructure
  • Small MAHs with 1–2 products where the cost of a full in-house PV team is disproportionate
  • Companies transitioning between PV providers that need continuity during the handover

Under EMA GVP Module I (EMA/541760/2011 Rev 2), the MAH retains ultimate responsibility for pharmacovigilance regardless of outsourcing arrangements. This means the MAH must maintain oversight of the outsourced PV system — documented through quality agreements, regular performance reviews, and QPPV oversight records.

Benefits of Full PV System Outsourcing

  • Cost efficiency: A fully outsourced PV system for a single EU product typically costs 20–30% less than equivalent in-house operations (QPPV, safety officers, database, training, IT infrastructure combined)
  • Speed to compliance: An experienced PV provider can establish a full PV system in 3–6 months, compared to 12–18 months for in-house builds
  • Access to expertise: Outsourcing provides immediate access to QPPVs, signal management specialists, medical reviewers, and regulatory writers — roles that are difficult and expensive to recruit individually
  • Scalability: PV workload fluctuates (e.g., PSUR preparation periods, post-launch ICSR surges). An outsourced model scales with demand without permanent headcount increases

Choosing an Outsourcing Partner

Key evaluation criteria:

  • Documented experience with EU pharmacovigilance (GVP compliance track record)
  • Availability of EU QPPV and local QPPV network
  • Inspection track record (how many inspections supported, findings history)
  • Safety database capabilities (validated database, EudraVigilance gateway)
  • Flexibility of scope (ability to handle full outsourcing or specific activities)
  • Transition experience (documented handover processes from previous providers)

Gap Analysis and Audits: Finding and Fixing Compliance Gaps

What is a PV Gap Analysis?

A pharmacovigilance gap analysis is a systematic comparison of an MAH's current PV practices against the requirements set out in EMA GVP Modules I-XVI. The goal is to identify discrepancies — areas where the MAH's actual practices fall short of regulatory expectations — and provide a prioritized remediation plan.

Gap analysis is especially critical for:

  • Companies that have never undergone a PV inspection
  • MAHs that have changed PV service providers
  • Organizations preparing for an upcoming EMA or NCA inspection
  • Companies expanding from one EU market to multiple markets

How a PV Gap Analysis Works

Step 1: Preparation

Define the scope (which GVP modules, which products, which processes) and gather all relevant documentation — PSMF, SOPs, training records, quality agreements, audit reports, and CAPA logs.

Step 2: Assessment

Review each GVP module requirement against the MAH's actual documentation and practices. Key areas assessed include:

  • QPPV oversight and availability (GVP Module I)
  • PSMF completeness and currency (GVP Module II)
  • ICSR handling and reporting timelines (GVP Module VI)
  • Signal management processes (GVP Module IX)
  • Periodic reporting (PSUR/PBRER) processes (GVP Module VII)
  • Training documentation (GVP Module I, Section I.B.8)
  • Safety database validation (EU Annex 11)
  • Quality system and audit trail integrity (GVP Module I)

Step 3: Findings and Prioritization

Classify each gap by severity (critical, major, minor) using the same classification system that EMA inspectors use, as described in EMA GVP Module III and the EMA Compilation of Union Procedures on Inspections (EMA/572454/2014 Rev 17):

  • Critical: A deficiency that adversely affects the rights, safety, or well-being of patients, or that poses a significant risk to data integrity
  • Major: A deficiency that could potentially affect the rights, safety, or well-being of patients, or indicates a significant deviation from applicable guidelines
  • Minor: A deficiency that does not fall into the critical or major category but indicates a departure from good practices

Step 4: Remediation Plan

Deliver a prioritized remediation roadmap with specific actions, responsible parties, and deadlines for each identified gap.

Step 5: Follow-Up

Re-assess remediated areas to confirm that gaps have been closed effectively.

PV System Audits

While gap analysis is typically a one-time or periodic assessment, PV system audits are a continuous quality requirement under GVP Module I. The MAH must conduct regular internal audits of its pharmacovigilance system and may also undergo external audits by regulatory authorities or third-party auditors.

Audit scope should cover:

  • Process compliance (are SOPs being followed in practice?)
  • Data integrity (are ICSRs accurate, complete, and submitted on time?)
  • PSMF currency (does the PSMF reflect the actual PV system?)
  • Training currency (are all PV staff trained and are records current?)
  • Subcontractor oversight (are outsourced activities monitored per quality agreements?)

PSMF and QMS: The Documentation Foundation

Pharmacovigilance System Master File (PSMF)

The PSMF is the single document that describes the MAH's entire pharmacovigilance system. Its content, structure, and maintenance requirements are defined in EMA GVP Module II (EMA/838713/2011 Rev 2).

Required PSMF content includes:

  • QPPV details and contact information
  • Organizational structure of the PV system
  • Data sources used (clinical trials, spontaneous reports, literature, registries)
  • Computerized systems and databases used for PV activities
  • Description of PV processes (ICSR management, signal management, periodic reporting)
  • Contractual arrangements for outsourced PV activities
  • Quality system description (SOPs, audit schedule, training program)
  • Performance indicators and compliance metrics
  • List of products covered by the PV system

The PSMF must be kept continuously up to date. Any change in the PV system — new personnel, new SOPs, new safety database, new outsourcing partner — must be reflected in the PSMF. GVP Module II requires a logbook tracking all significant changes. An outdated PSMF is one of the most common major findings during PV inspections.

Quality Management System (QMS)

GVP Module I requires every MAH to implement a quality management system for pharmacovigilance that covers:

  • Standard Operating Procedures (SOPs): Written procedures for all PV activities — ICSR handling, signal detection, PSUR preparation, PSMF maintenance, training, auditing, CAPA management
  • Quality control: Systematic checks to ensure PV deliverables (ICSRs, PSURs, RMPs) meet quality standards before submission
  • Quality assurance: Planned audits and management reviews to verify that the QMS is functioning and that processes are being followed
  • Change management: Documented processes for implementing changes to the PV system (new SOPs, new databases, new personnel) without disrupting operations
  • CAPA management: Corrective and Preventive Action processes for addressing audit findings, inspection findings, and quality deviations
  • Document control: Version control, approval workflows, and archiving for all PV-related documentation
  • Training management: Ensuring all PV personnel are trained on relevant SOPs and GVP requirements, with documented training records per GVP Module I, Section I.B.8

Implementation Timeline

For a biotech company building a PV system from scratch:

  • Phase 1 — Design (4–6 weeks): Requirements gathering, PSMF structure, SOP list, database selection
  • Phase 2 — Development (6–10 weeks): SOP writing, PSMF drafting, database configuration, EudraVigilance registration
  • Phase 3 — Validation (4–6 weeks): Database validation (CSV), process testing, training delivery
  • Phase 4 — Go-Live (2–4 weeks): PSMF finalization, QPPV notification to authorities, operational start

Total: 3–6 months with an experienced PV partner — versus 12–18 months for a first-time in-house build.

Conclusion

The pharmacovigilance system — comprising the QPPV, documented processes, validated databases, and quality oversight — is the foundation on which all drug safety activities rest. EU legislation (Directive 2001/83/EC) and EMA guidelines (GVP Modules I and II) define what the system must contain and how it must be maintained.

For biotech companies, the decision between building in-house and outsourcing should be driven by cost, timeline, and the availability of PV expertise. Full outsourcing provides the fastest path to compliance, while gap analysis and audit services help existing systems stay inspection-ready.