EU PV Regulatory Intelligence news: EU Commission Implementing Regulation 2025/1466 Other
guides
NextPV Services

Signal and benefit/risk management in pharmacovigilance

How should a biotech company set up signal management to avoid the most common EMA inspection findings?

Signal management is the most critical — and most scrutinized — pharmacovigilance activity during EMA inspections. It is the process through which new safety information about a medicine is identified, evaluated, and acted upon. Inadequate signal management is consistently cited as one of the top areas for critical and major findings in EMA's published inspection data.

The regulatory framework for signal management is defined in EMA GVP Module IX (EMA/827661/2011 Rev 1). Risk management — closely connected to signal management — is governed by EMA GVP Module V and ICH E2E (pharmacovigilance planning).

Risk Management Plans (RMPs)

What is an RMP?

A Risk Management Plan is a mandatory document that describes how the MAH will identify, characterize, prevent, or minimize the risks associated with a medicinal product. RMPs are required under Regulation (EC) No 726/2004 for centrally authorized products and EU Directive 2001/83/EC for nationally/mutually recognized products.

RMP Structure (per GVP Module V)

Safety Specification

The safety specification is the core of the RMP. It classifies the product's safety profile into three categories:

  • Identified risks: Safety concerns supported by adequate evidence of an association with the product (e.g., confirmed ADRs, known class effects)
  • Potential risks: Safety concerns where evidence is suggestive but not conclusive (e.g., non-clinical findings, signals under evaluation, theoretical risks based on mechanism of action)
  • Missing information: Patient populations or clinical situations where safety data is insufficient to characterize the risk profile (e.g., elderly, pediatric, pregnant women, patients with hepatic/renal impairment, long-term use data)

Pharmacovigilance Plan

Describes both routine pharmacovigilance activities (signal detection, PSUR preparation, ICSR management) and any additional pharmacovigilance activities needed to address specific safety concerns — such as Post-Authorization Safety Studies (PASS), targeted follow-up questionnaires, or specific surveillance programs.

Risk Minimization Measures

  • Routine measures: Product labeling (SmPC, package leaflet), pack size restrictions, legal status (prescription-only)
  • Additional measures: When routine measures are insufficient to manage a risk. Examples include educational materials for HCPs, patient alert cards, controlled distribution systems, pregnancy prevention programs, and patient registries. These must be designed per GVP Module XVI, which also requires evaluation of their effectiveness.

RMP Lifecycle

RMPs are living documents. They must be updated when:

  • New safety information emerges (new identified risk, new potential risk, new signal)
  • Risk minimization measures change
  • PASS results become available
  • The PRAC requests an update following PSUR review or signal assessment
  • Regulatory milestones are reached (e.g., first PSUR, renewal)

Practical Tips for RMP Writing

  • Be specific in the safety specification. Vague risk descriptions (e.g., "hepatic events") are insufficient. Specify the nature of the risk, the evidence supporting it, the population most affected, and the severity.
  • Justify the pharmacovigilance plan. Every additional PV activity must be linked to a specific safety concern from the safety specification. If there's no gap in knowledge, additional studies are not needed.
  • Design measurable risk minimization. Additional risk minimization measures should have defined success metrics and evaluation timelines per GVP Module XVI.

EVDAS: The Signal Detection Tool

What is EVDAS?

The EudraVigilance Data Analysis System (EVDAS) is the tool provided by EMA for MAHs and regulators to access and analyze aggregated adverse reaction data reported through EudraVigilance. EVDAS provides:

  • Line listings: Detailed case-level data for ICSRs reported for a specific product
  • Statistical signal detection: Disproportionality analysis using the Reporting Odds Ratio (ROR) and other statistical methods
  • Aggregate data summaries: Tabulations of adverse reactions by System Organ Class (SOC), Preferred Term (PT), seriousness, outcome, age, and gender

MAH Obligation for EVDAS Screening

Per GVP Module IX, MAHs are required to routinely screen EVDAS for potential signals related to their products. This includes:

  • Reviewing EMA's Electronic Reaction Monitoring Reports (eRMRs) when published
  • Performing independent EVDAS queries at regular intervals (frequency proportionate to the product's risk profile — typically monthly or quarterly)
  • Documenting all screening activities and the outcomes (signal detected / no signal detected)

Effective EVDAS Use

  • Regular screening schedule: Establish a documented schedule for EVDAS screening and adhere to it. Missing a screening cycle is a common inspection finding.
  • Statistical interpretation: A statistical signal (elevated ROR) does not automatically equal a safety signal. Context matters — consider the background rate of the event, reporting biases (e.g., stimulated reporting), confounding factors (e.g., underlying disease), and the clinical plausibility of the association.
  • Documentation: Document every EVDAS screening — date, products reviewed, PTs screened, statistical outputs, and the conclusion (signal detected or no signal). This documentation must be available during inspections. NextPV maintains standardized signal tracking logs for all clients that meet the documentation standards inspectors expect.

Signal Management Process

The Signal Management Lifecycle

GVP Module IX defines a structured process:

Step 1: Signal Detection

Identify potential safety signals from multiple sources:

  • EudraVigilance/EVDAS (spontaneous reports)
  • Company safety database (own reported cases)
  • Published medical literature
  • Clinical trial data (ongoing and completed)
  • Registries and observational studies
  • Regulatory authority communications (PRAC recommendations, referrals)

Use multiple detection methods:

  • Disproportionality analysis: Statistical methods (PRR, ROR, BCPNN, MGPS) that compare the observed reporting rate of a drug-event combination against the expected rate based on all other drugs/events in the database
  • Clinical review: Medical review of individual cases and case series to identify patterns that statistical methods may miss
  • Literature review: Systematic monitoring of published literature for new safety information

Step 2: Signal Validation

Once a potential signal is detected, validate it:

  • Is the data quality sufficient? (Are cases well-documented, or are they based on poor-quality reports?)
  • Is there biological plausibility? (Does the mechanism of action support the association?)
  • Is the signal new? (Is this information already included in the product labeling?)
  • Is the signal based on a sufficient number of cases?

Not every statistical signal becomes a validated signal. The validation step filters noise from genuine safety concerns.

Step 3: Signal Prioritization

Prioritize validated signals based on:

  • Potential public health impact (severity of the outcome, size of the affected population)
  • Strength of the evidence (number of cases, quality of data, consistency across sources)
  • Novelty (completely new risk vs. change in the known safety profile)
  • Urgency (is immediate action needed, or can evaluation proceed on a standard timeline?)

Step 4: Signal Assessment

Comprehensive evaluation of the signal including:

  • Detailed case review (all available cases)
  • Epidemiological analysis (background rates, comparative data)
  • Clinical and pharmacological assessment
  • Literature review
  • Benefit-risk impact assessment
  • Regulatory implications (does this require a label change, DHPC, or risk minimization measure?)

Step 5: Recommended Action

Based on the assessment, determine the appropriate action:

  • Update product information (SmPC, package leaflet)
  • Update the RMP (add to identified risks, modify risk minimization)
  • Issue a Direct Healthcare Professional Communication (DHPC)
  • Initiate a PASS study
  • Update the Investigator's Brochure (for products in development)
  • Report to the PRAC (for centrally authorized products)
  • No action required (signal refuted or insufficient evidence)

Step 6: Documentation and Tracking

Every step must be documented with dates, responsible persons, data reviewed, and conclusions. Signal tracking logs should include the signal name, detection date, data sources, validation outcome, assessment timeline, and action taken. This documentation is the primary focus of inspectors reviewing signal management.

Integrating Signal Management and Risk Management

Signal management feeds directly into risk management:

  • A validated signal may lead to a new identified risk in the RMP safety specification
  • Signal assessment may reveal a new potential risk requiring additional pharmacovigilance
  • Signal data contributes to the benefit-risk analysis in PSURs/PBRERs
  • Signal outcomes may trigger updates to risk minimization measures

The connection between signal management and RMP maintenance should be documented in your SOPs, ensuring that signal assessment outcomes are systematically evaluated for RMP impact.

Conclusion

Signal management and benefit-risk assessment are the highest-value pharmacovigilance activities — they directly protect patient safety by identifying and responding to new safety information. They are also the most heavily scrutinized during inspections. A documented, systematic signal management process per GVP Module IX, combined with well-maintained Risk Management Plans per GVP Module V, is essential for every MAH.