If your company holds a marketing authorisation for a drug sold in India, your obligations to the Pharmacovigilance Programme of India do not end once the product is approved and launched. CDSCO expects a functioning, auditable pharmacovigilance system running continuously in the background, and the guidance document governing this was written specifically because too many MAHs treated adverse event reporting as an occasional compliance task rather than a standing operational system. When an audit actually happens, that difference becomes very visible very quickly.
This guide goes deep into what Indian pharmacovigilance law actually requires of a Marketing Authorisation Holder, or MAH, what the reporting timelines genuinely are, what a Pharmacovigilance System Master File needs to contain, and what real audit readiness looks like rather than what a checklist implies it looks like. If you are searching for PvPI compliance for MAH India, CDSCO pharmacovigilance audit preparation, India ADR reporting timelines, or pharmacovigilance system master file consultants India, this is written for you.
The Legal Framework Behind PvPI
The Pharmacovigilance Programme of India, established in 2010 under the Central Drugs Standard Control Organisation, is India’s national system for monitoring, assessing, and preventing adverse drug reactions. It operates through a network of ADR Monitoring Centres located across medical colleges and institutions nationwide, all feeding into the National Coordinating Centre at the Indian Pharmacopoeia Commission in Ghaziabad, which analyses aggregated data, detects safety signals, and shares findings with CDSCO for regulatory action such as labelling changes, market withdrawals, and risk communication.
For MAHs specifically, the obligations were formalised through a guidance document issued by the National Coordination Centre for PvPI, prepared under the aegis of and in collaboration with CDSCO, aligned with amendments to the Drugs and Cosmetics Act 1940 and Rules 1945. This is the document that turned pharmacovigilance in India from a general expectation into a structured, auditable set of MAH obligations, organised around six distinct modules that most companies preparing for an audit have not fully internalised.
The Six Modules Every MAH Needs to Understand
The guidance document structures MAH pharmacovigilance obligations into six modules, and audit readiness genuinely means being able to demonstrate compliance across all six, not just the ones related to case reporting.
- Module I, the Pharmacovigilance System Master File, or PSMF, containing all information relating to the MAH’s PV system
- Module II, the collection, processing, and reporting of Individual Case Safety Reports, or ICSRs
- Module III, the preparation and submission of the Periodic Safety Update Report, or PSUR
- Module IV, the Quality Management System operated at the MAH organisation
- Module V, audit and inspection of the PV system at the MAH organisation
- Module VI, submission of the Risk Management Plan, or RMP
Companies that focus preparation almost entirely on Module II, because ADR case handling feels like the most visible and urgent obligation, frequently find themselves exposed during an audit on Modules IV and V specifically, because those two modules test whether the entire system is genuinely governed, not just whether individual cases were processed correctly.
Reporting Timelines That Actually Apply
Timing failures are one of the most common and most easily avoidable audit findings, because the timelines themselves are unambiguous:
- Serious adverse events and serious adverse drug reactions must be reported to PvPI within 15 days
- Non-serious adverse events and adverse drug reactions must be reported within 30 days
- Causality assessment is mandatory for new drugs, and the guidance document specifies the WHO-UMC causality assessment scale as the preferred tool
One detail that genuinely trips up MAHs, particularly those managing both a domestic and an international safety database, is that the guidance leaves some ambiguity around whether serious ADRs need to be reported to both the drug regulatory authority and to PvPI separately, or whether reporting to one is sufficient. In practice, well-prepared MAHs treat this ambiguity as a reason to over-comply rather than under-comply, reporting through both channels and documenting that decision clearly in internal SOPs, since an auditor is far more likely to flag an unexplained gap than an unnecessary duplicate report.
Indications for suspected and concomitant drugs must be coded using the latest version of the International Classification of Diseases, and inconsistent or outdated coding across a case series is a recurring, entirely preventable audit finding.
The Pharmacovigilance Officer In-charge: More Than a Named Contact
One of the most important, and most commonly under-resourced, obligations is the appointment of a Pharmacovigilance Officer In-charge, or PVOIC, defined within Module I of the PSMF. Unlike some international equivalents of this role, the PVOIC in India is specifically mandated to be a Medical Officer or a Pharmacist trained in the collection and analysis of adverse event data, not simply a regulatory affairs generalist with pharmacovigilance added to their title.
The PVOIC carries real operational responsibility, including:
- Sufficient authority over the pharmacovigilance system to actually enforce compliance, not just report on it
- Development and delivery of training modules for staff involved in PV activities
- Framing and revision of standard operating procedures as the system matures or regulations change
- Establishment and ongoing maintenance of the Quality Management System underpinning the entire PV function
Auditors testing this area are not just checking whether a PVOIC is named on paper. They are testing whether that individual can demonstrate real authority within the organisation, genuine familiarity with current case data, and evidence that they have actually exercised the SOP revision and training responsibilities the role requires, not delegated them silently to someone else.
What the Pharmacovigilance System Master File Needs to Contain
The PSMF is not a marketing authorisation dossier attachment. It is a standalone, continuously maintained document, and this distinction matters because MAHs sometimes treat it as a one-time submission rather than a living record. A properly maintained PSMF should include:
- Details of the PVOIC and the full pharmacovigilance organisational structure
- A list of PV tasks delegated by the PVOIC to other individuals or teams, with clear accountability for each
- Documentation of deviations from pharmacovigilance procedures, including their impact and how they were managed until resolution
- A list of completed internal and external audits and inspections of the PV system
- A forward-looking schedule of planned audits and inspections, not just a historical record
That last point, a forward-looking audit schedule, is one of the details most frequently missing from PSMFs that otherwise look complete. Auditors reviewing a PSMF that only documents past activity, with no visible forward plan, reasonably question whether the PV system is being actively managed or simply maintained defensively after the fact.
The PSMF can be maintained electronically, and physical copies are not mandatory, but it must be searchable, printable, and genuinely accessible to competent authorities on request. A PSMF that exists but cannot be produced promptly and completely during an audit visit functions, for audit purposes, no differently to a PSMF that does not exist at all.
What Module IV and V Audits Actually Test
This is where genuine audit readiness diverges sharply from surface-level compliance. Module IV, the Quality Management System, and Module V, audit and inspection of the PV system itself, are where CDSCO and PvPI inspectors probe whether the pharmacovigilance function is a real operational system or a documentation exercise built to survive a single review.
In practice, this means being able to demonstrate:
- A functioning quality management system specific to pharmacovigilance, not simply the company’s general quality manual with a PV section added
- Documented deviations from PV procedures, with evidence that each was actually investigated and closed, not just logged
- A genuine internal audit history for the PV system, distinct from broader manufacturing or GMP audits
- Training records for all staff involved in PV activities that demonstrate real competence, not just attendance at a session
- Clear evidence that corrective actions from any previous internal or external PV audit were implemented and verified, not just documented as closed
PSUR and RMP Obligations Feed Directly Into Audit Readiness
Module III, the PSUR, and Module VI, the Risk Management Plan, are often treated as separate regulatory submissions rather than as evidence that feeds directly into audit readiness. In reality, a PSUR that consistently and accurately reflects the safety profile emerging from your own ICSR data is one of the clearest pieces of evidence an auditor can use to judge whether your Module II case processing and your Module III reporting are genuinely connected systems, rather than two separate teams working from different versions of the truth. Discrepancies between what your ICSR data shows and what your PSUR reports are among the most serious findings an audit can surface, because they suggest either a data integrity problem or a governance problem, and sometimes both.
Practical Steps for Genuine Audit Readiness
- Treat the PSMF as a living document with an owner responsible for keeping it current, not a document produced once and revisited only before an audit
- Build a forward-looking internal audit schedule for the PV system specifically, separate from general company audit planning
- Confirm the PVOIC meets the mandated medical or pharmacist qualification and can demonstrate real, current authority over the PV system, not a title alone
- Reconcile ICSR case data against PSUR content periodically, not only at submission time, to catch discrepancies before an auditor does
- Document every deviation from PV procedure with a clear resolution trail, since undocumented or unresolved deviations are one of the most common Module IV findings
- Clarify and document your organisation’s position on dual reporting to the regulatory authority and PvPI, so the ambiguity in the guidance does not become an inconsistency an auditor can flag
- Standardise ICD coding practices across all case handlers to avoid inconsistent terminology showing up across a case series
Building a PvPI System That Survives Real Scrutiny
Building and sustaining an audit-ready pharmacovigilance system is exactly the kind of work Quality and Vigilance Ltd supports MAHs through, alongside its core pharmacovigilance and regulatory affairs remit covering EMA, FDA, and MHRA requirements. The gap between a PSMF that exists and a PSMF that genuinely survives an inspector’s questioning is rarely about missing paperwork. It is about whether the underlying system was built to be governed continuously or assembled defensively before an audit. For MAHs strengthening their PvPI compliance, preparing for a first CDSCO pharmacovigilance audit, or remediating findings from a previous inspection, the support that genuinely changes the outcome looks like this:
- Structuring a PSMF that reads as a living operational record, not a static compliance document
- Establishing PVOIC authority and training programmes that hold up under direct questioning
- Reconciling ICSR, PSUR, and RMP data so the story they tell is consistent across every document
- Building a forward-looking internal audit schedule for the PV system that demonstrates active, ongoing governance
Get in touch with Quality and Vigilance Ltd today to build a PvPI compliance system that is genuinely ready when CDSCO comes to audit it.