In many pharmaceutical companies, compliance grew up in pieces. The manufacturing site built its quality system around GMP. The distribution arm built one around GDP when it applied for a wholesale licence. Pharmacovigilance was set up separately, often outsourced, to meet the requirements of a marketing authorisation. Each system has its own procedures, its own deviation log, its own corrective action tracker, its own vendor list and its own training matrix. Each may be perfectly reasonable on its own.
The trouble is that regulators do not see your company as three separate systems. They see one company, one product and one patient at the end of the chain. When something goes wrong, it rarely respects the boundaries between departments, and when an inspector finds a weakness in one area, they have good reason to ask whether it exists elsewhere. This guide explains how findings travel between GxP areas, which processes are worth unifying, which must stay separate, and how to build a single quality framework without losing the specialist depth each area needs. If you are searching for an integrated GxP quality system, GxP consultancy for pharmaceutical companies, MHRA inspection readiness across GMP, GDP and pharmacovigilance, or how to reduce duplicated compliance effort, this is written for you.
How a Finding in One Area Reaches Another
The EU guidance on pharmacovigilance inspections makes the connection explicit. Among the triggers it lists for a for-cause pharmacovigilance inspection are information from other types of inspection, including GCP, GMP, GLP and GDP inspections, as well as delays or inappropriate implementation of corrective and preventive actions. In other words, a weak corrective action culture found by a GDP inspector, or a data integrity problem noted at a manufacturing site, is recognised as a reason to look at pharmacovigilance.
The same logic works in every direction. Consider the ways a single event can cross boundaries:
- A product complaint about a damaged pack also describes a patient who took a degraded product and was unwell. It is a quality defect and a potential adverse event at the same moment
- A temperature excursion in a warehouse leads to stock being supplied to customers. The distribution team treats it as a deviation. If any patient reports a problem, pharmacovigilance needs to know the batch history
- A change to a manufacturing process alters the appearance of a tablet. Pharmacovigilance sees an increase in reports about the medicine looking different, long before the quality team connects them to the change
- A labelling error on a repackaged pack is a GMP matter. It may also be a medication error report
- A recall requires coordinated action from quality, regulatory, distribution and safety teams, usually under time pressure
Companies that run these as separate silos depend on someone remembering to pass information on. Inspectors know that this fails, and they look for the evidence.
Where Silos Quietly Create Findings
The patterns below recur across inspections of companies with more than one GxP activity.
- Two complaint routes: product complaints go to quality, adverse events go to pharmacovigilance, and nobody checks that a complaint containing a safety element is forwarded within the required timelines
- Several corrective action systems, each with a different definition of closure. A weak standard of effectiveness checking in one will often be found in all
- The same vendor qualified three times by three teams, each reaching a different conclusion about its risk
- Training matrices that do not match across areas, so that a person who handles both complaints and safety reports is trained for one and not the other
- Data integrity controls that differ between the laboratory system, the warehouse system and the safety database, even though the same principles apply to all
- Document control run differently in each area, leaving inspectors unsure which version of a procedure applies
- Management review that covers one area in depth and ignores the rest
- Change control that does not ask whether a change affects product information, risk minimisation or safety reporting
None of these is a headline failure. Together they describe an organisation that cannot see itself clearly, which is exactly what inspectors are trained to detect.
What Is Worth Unifying
The best candidates for a single process are those where the underlying principle is the same, whatever the GxP area.
- Deviation, complaint and event intake: one front door with routing rules, so every report is triaged once for quality, safety and regulatory impact
- CAPA: one system, one definition of root cause, and one standard for effectiveness checks, with tags showing which area owns each action
- Change control: one workflow with a built-in impact assessment that covers manufacturing, distribution, product information, pharmacovigilance and regulatory submissions
- Supplier and vendor management: one register, one risk classification, and a shared audit calendar so vendors are audited once for several purposes
- Document control and training: one library, one numbering convention, and one learning management system
- Data governance: a common set of principles for access, audit trails, review and retention across laboratory, warehouse and safety systems
- Internal audit and self-inspection: one programme that schedules audits by risk across all areas
- Management review: one forum that sees quality, safety and compliance data together
- Regulatory change tracking: one register of new rules and guidance, with an owner for each item
What Must Stay Separate
Integration does not mean merging everything, and trying to do so is a common mistake.
- Legal roles and accountabilities remain distinct. The QPPV, the Responsible Person and the Qualified Person each carry personal responsibilities under different legislation, and their authority and independence must be preserved
- Specialist procedures remain specialist. The detail of ICSR processing, batch certification and temperature controlled storage requires dedicated work instructions
- Regulatory timelines remain driven by the relevant authority. A single intake does not change the fact that an expedited safety report and a recall notification run on different clocks
- Inspection preparation remains area specific, because inspectors from different teams focus on different things
The aim is a common framework with specialist modules, not one generic system that serves nobody well.
A Simple Governance Model
A workable model for a small or mid-sized company has four layers:
- A single quality manual or policy that sets principles for the whole organisation and shows how each GxP area fits
- Shared core processes, such as CAPA, change control, vendor management, document control, training and audit, owned by quality with defined input from each area
- Area modules, covering GMP, GDP, pharmacovigilance and medical devices where relevant, each owned by the person with the legal responsibility
- A single reporting line to senior management, with one integrated quality review, so that leaders see the full picture and cannot treat one area as somebody else’s problem
Warning Signs Your Compliance Is Siloed
Ask yourself the following questions. Several “no” answers suggest a silo problem.
- Can one person show you every open corrective action across all areas?
- Does every product complaint get screened for safety information, and is there a record that it was?
- When a change is raised, does the form prompt a pharmacovigilance impact assessment?
- Is each vendor assigned the same risk level by every team that uses it?
- Do your QPPV, Responsible Person and quality head meet regularly, and is there a record?
- Could you demonstrate, from one set of records, that a recall decision was shared with safety within hours?
- Does your internal audit programme cover all areas, with findings compared across them?
A Realistic 90 Day Plan
- Days 1 to 20: map your current systems, listing every deviation log, CAPA tracker, vendor list and document store, with owners
- Days 21 to 40: choose two or three high value shared processes, typically complaint and event intake, CAPA and vendor management, and design the common version
- Days 41 to 70: pilot the new intake route and the CAPA standard, check that safety screening is occurring, and fix routing problems
- Days 71 to 90: align the vendor register and audit calendar, set up integrated management review, and brief all three legal role holders on how information will flow
Do not try to rebuild everything at once. Early wins on intake and CAPA usually pay for the rest of the programme.
A Worked Example: One Complaint, Three Systems
The example below is invented, but it shows how a single event moves through a siloed company and an integrated one.
A pharmacist phones to say that several tablets from one pack were crumbling, and that an elderly patient took one and then felt unwell. In a siloed company, the call goes to customer service, who log it as a product complaint and pass it to quality. Quality opens an investigation into the manufacturing batch. The patient’s symptoms are mentioned in a free text field. Nobody forwards the report to pharmacovigilance, because the complaint was categorised as a quality defect. Three weeks later, a separate call from the same pharmacist is logged as an adverse event. The safety team now has a late report, no link to the complaint, and no knowledge that the batch is under investigation. The distribution team, meanwhile, has not been told to hold stock from the same batch.
In an integrated company, the same call enters one intake point. The person taking it is trained to ask about patient effects as well as pack condition. The system flags a possible adverse event and a possible quality defect at the same moment, and starts both clocks. Pharmacovigilance and quality see the same record. The batch number triggers a stock check in the warehouse, and the Responsible Person is told that a hold may be needed. When the investigation concludes, the corrective action goes into the single CAPA system, with the effectiveness check shared across teams.
The second version is not more expensive. It simply relies on design rather than memory. It is also much easier to defend to an inspector, who can follow one record from the pharmacist’s call to the final decision.
What Inspectors Will See
An integrated system is not a goal in itself. It matters because it changes what an inspector finds. They will see one set of records in which a complaint, a deviation and a safety case can be linked. They will see a CAPA process with a consistent standard of proof. They will see that the people with legal responsibility talk to each other. And they will see an organisation that understands its own risks across the lifecycle, which tends to produce shorter inspections and fewer repeat findings.
One Quality Partner for Every GxP Area
Few companies have a specialist in every area in house, and few consultancies cover pharmacovigilance, GMP, GDP and medical devices with equal depth. That is the gap Quality and Vigilance Ltd is built to fill. The firm works across GvP, GMP and GDP audits and inspection support, as well as pharmacovigilance services and medical device audits, which means it can look at how your systems connect, not just at how each performs in isolation. The support that clients find most useful typically includes:
- A cross-functional gap assessment that traces events such as complaints, deviations and changes through quality, distribution and pharmacovigilance
- Design of shared processes for intake, CAPA, change control and vendor management, with the specialist modules each area needs
- Integrated internal audit programmes that cover GvP, GMP, GDP and device requirements on a risk basis
- Mock inspections that test how well your teams share information under pressure
- Support for QPPV, Responsible Person and Qualified Person roles so that accountability stays clear within a joined-up system
Get in touch with Quality and Vigilance Ltd today to bring your pharmacovigilance, GMP and GDP compliance into one clear, inspection-ready system.