Coordination of pharmacovigilance inspections

This Q&A aims at addressing the situation where a marketing authorisation holder (MAH) is using a system (as intended) from a vendor, including the built-in possibilities for configuration. The system in question may be a system validated by the supplier, but installed at the MAH, or a system provided as software-as-a-service (SaaS or cloud solution). Different requirements will apply in cases where the MAH is changing/adding functionalities to the system.

Today, the use of electronic systems e.g. for safety data collection has proved to be more the standard than the exception. A considerable number of electronic system for collection, assessment, submission etc. of safety data are provided by, or purchased from, vendors and customized to varying degrees. PhV inspectors receive an increasing amount of questions from MAHs, and deviations are given during PhV inspections, regarding the level of validation/qualification needed to be performed by an MAH when using a system that has already been (or is supposed to have been) validated by the supplier.

According to Commission Implementing Regulation (EU) No 520/2012 of 19 June 2012 on the performance of pharmacovigilance activities provided for in Regulation (EC) No 726/2004, article 6 on subcontracting, the marketing authorisation holder may subcontract certain activities of the pharmacovigilance system to third parties. It shall nevertheless retain full responsibility for the completeness and accuracy of the pharmacovigilance system master file, and according to Guideline on good pharmacovigilance practices (GVP) Module I - Pharmacovigilance systems and their quality systems section I.B.8, facilities and equipment which are critical for the conduct of pharmacovigilance should be subject to appropriate checks, qualification and/or validation activities to prove their suitability for the intended purpose.

The MAH is ultimately responsible for the validation of the pharmacovigilance processes, which are supported by electronic systems. The MAH may rely on qualification documentation provided by the vendor if the qualification activities performed by the vendor have been assessed as adequate, but may also have to perform additional qualification/validation activities based on a documented risk assessment.

The conditions for an MAH to use the vendor’s qualification documentation include, but are not limited to the following:

• the MAH has a thorough knowledge about the vendor’s quality system and qualification activities, which will usually be obtained through an in-depth assessment/audit;
• an assessment/audit has been performed by qualified staff, with sufficient time spent on the activities and with cooperation from the vendor; • an assessment/audit has gone sufficiently deep into the activities and that a suitable number of examples for relevant activities have been looked at (and documented);
• the assessment/audit report has documented the vendor’s qualification documentation to be satisfactory or that shortcomings can be mitigated by the MAH – e.g. that the MAH is performing part of the qualification;
• the MAH, or where applicable the service provider performing these activities for the MAH, has a detailed knowledge about the qualification documentation and can navigate in it and explain the activities as if they had performed the activities themselves;
• when required during an inspection, the qualification documentation is made available to the inspectors in a timely manner irrespective of whether it is provided by the MAH or the vendor.
• both the MAH and the vendor establish full configuration management for qualification and production environments and that the MAH can fully account for any differences between the vendor’s validation environment and the MAH’s production environment and subsequently, justify any differences that are considered insignificant. If not, the qualification effort potentially does not justify the use of the system.
• the MAH has performed an Installation Qualification/Performance Qualification where the system depends on trained users.

​​​​​​​MAHs and vendors should be aware that if the electronic systems are used for generating/handling pharmacovigilance data or maintain control and oversight of pharmacovigilance processes, during PhV inspections documentation regarding the qualification process and any other relevant documentation on the e-system maintained at the MAH level, as well as on the vendor level, could be inspected.

Documentation regarding the validation of processes and qualification of systems is considered essential by inspectors and it is likely to be requested during inspections. This is irrespective of whether or not the MAH has contracted out activities related to electronic systems and whether the MAH choses to consider the above mentioned assessment of vendor systems/processes/documentation as an audit

This Q&A aims at clarifying the interpretation of day zero for medical literature reports contained in physical/hard copy local journals received by an organisation/Marketing authorisation holder/Applicant.

Marketing authorisation holders are requested to review and assess reports of suspected adverse reactions from medical literature to identify and record individual case safety reports (ICSRs).

Marketing authorisation holders are expected to perform a global literature search through a systematic literature review of widely used reference databases and to monitor also scientific and medical publications in local journals in countries where medicinal products have a marketing authorisation. For

ICSRs, described in the medical literature containing the minimum criteria, the clock starts (day zero) on the day when the physical/hard copy local journal is received by the organisation/Marketing authorisation holder/Applicant, and this should be considered equal to performing a literature search in an electronic database.

Legal basis

Guideline on good pharmacovigilance practices (GVP) Module VI – Collection, management and submission of reports of suspected adverse reactions to medicinal products (Rev 2)

• VI.B.1.1.2. Literature report
  
  Medical literature is a significant source of information for the monitoring of the safety profile and of the risk-benefit balance of medicinal products, particularly in relation to the detection of new safety signals or emerging safety issues. Marketing authorisation holders are therefore expected to maintain awareness of possible publications through a systematic literature review of widely used reference databases (e.g. Medline, Excerpta Medica or Embase) no less frequently than once a week.
  
  The marketing authorisation holder should ensure that the literature review includes the use of reference databases that contain the largest reference of articles in relation to the medicinal product properties.
  
  In addition, marketing authorisation holders should have procedures in place to monitor scientific and medical publications in local journals in countries where medicinal products have a marketing authorisation, and to bring them to the attention of the company safety department as appropriate.
   
• VI.B.7. Submission of individual case safety reports (ICSRs)
  
  For ICSRs described in medical literature (see VI.B.1.1.2. for guidance on the management of medical literature reports), the clock starts (day zero) with awareness of a publication containing the minimum criteria (see VI.B.2. for ICSRs validation, and VI.App.2.7. for guidance on day zero estimation for medical literature reports). Where contractual arrangements are made with a person/organisation to perform literature searches and/or submit valid ICSRs, detailed agreements should exist to ensure that the marketing authorisation holder can comply with its regulatory submission obligations.
   
• VI.App.2.7. Day zero
  
  ​​​​​​​According to GVP VI.App.2.7. day zero is the date on which an organisation becomes aware of a publication containing the minimum information for an ICSR to qualify for submission. Awareness of a publication includes any personnel of that organisation, or third parties with contractual arrangements with the organisation. It is sometimes possible to identify the date on which a record was available on a database, although with weekly literature searching, day zero for the submission of an adverse reaction present in an abstract is taken to be the date on which the search was conducted. For articles that have been ordered as a result of literature search results, day zero is the date when the minimum information for an ICSR to be valid is available. Organisations should take appropriate measures to obtain articles promptly in order to confirm the validity of a case.