Pharmacovigilance (PV) is a cornerstone of patient safety, and compliance with Good Pharmacovigilance Practices (GVP) is non-negotiable for Marketing Authorisation Holders (MAHs). Yet, even the most experienced PV teams can be caught off guard during inspections. Regulatory bodies such as the EMA, MHRA, and FDA routinely uncover deficiencies that result in critical or major findings, many of which are preventable.
In this blog, we explore the most common GVP audit findings and offer practical, actionable strategies to stay compliant — with a focus on CAPA, documentation practices, QPPV roles, and risk minimisation measures.
Common GVP Audit Findings — What Inspectors Often Discover
1. Inadequate or Missing CAPA Management
The Finding:
Audit teams often report that companies either lack proper Corrective and Preventive Action (CAPA) processes or fail to close CAPAs within the required timelines.
Why It’s a Problem:
CAPA is not just about fixing issues — it’s about ensuring they don’t recur. Inadequate CAPA reflects poor quality oversight and systemic weaknesses.
How to Avoid It:
- Establish a robust, risk-based CAPA system.
- Assign CAPA owners with clear responsibilities and deadlines.
- Include root cause analysis (RCA) as a mandatory step.
- Monitor CAPA effectiveness post-implementation.
2. Incomplete or Poor Pharmacovigilance Documentation
The Finding:
Documentation issues are among the most frequently cited findings — ranging from incomplete case files to missing PSMF updates and unsigned SOPs.
Why It’s a Problem:
Regulators expect ALCOA+ principles in PV documentation: Attributable, Legible, Contemporaneous, Original, Accurate — plus Complete, Consistent, Enduring, and Available.
How to Avoid It:
- Ensure all documentation is timely, traceable, and version-controlled.
- Regularly update the Pharmacovigilance System Master File (PSMF).
- Audit SOPs annually and keep training records up to date.
- Perform documentation reviews before audits or inspections.
3. Undefined or Weak QPPV Oversight
The Finding:
Auditors often find that the Qualified Person Responsible for Pharmacovigilance (QPPV) lacks adequate oversight, especially in global or outsourced PV systems.
Why It’s a Problem:
The QPPV is legally responsible for the PV system in the EU. Limited involvement or visibility can signal non-compliance with GVP Module I.
How to Avoid It:
- Ensure the QPPV is formally integrated into governance and decision-making processes.
- Document QPPV responsibilities in the PSMF and SDEAs.
- Schedule routine QPPV reviews of safety reports, signals, and CAPAs.
- Appoint a deputy QPPV and define roles clearly.
4. Ineffective Risk Minimisation Measures (RMMs)
The Finding:
MAHs often fail to implement or evaluate the effectiveness of RMMs such as patient alert cards, educational materials, or controlled distribution programs.
Why It’s a Problem:
GVP Module V requires that RMMs not only be implemented but also monitored and adjusted based on effectiveness.
How to Avoid It:
- Design clear implementation plans for each RMM.
- Define effectiveness indicators (e.g., HCP awareness, product usage data).
- Conduct periodic reviews and adapt RMMs as needed.
- Include RMM performance in PSURs and RMP updates.
5. Gaps in Safety Data Exchange Agreements (SDEAs)
The Finding:
SDEAs are often outdated, missing, or incomplete — particularly in outsourced models or partnerships.
Why It’s a Problem:
SDEAs ensure timely and accurate exchange of safety data between MAHs and vendors/partners. Weak SDEAs jeopardise PV compliance.
How to Avoid It:
- Maintain a centralised SDEA repository with regular review cycles.
- Clearly define roles, timelines (especially for ICSRs), and QPPV obligations.
- Periodically audit your partners’ compliance with the SDEA terms.
6. Delays in ICSR Processing and Reporting
The Finding:
Late submission of Individual Case Safety Reports (ICSRs), especially expedited cases, is a serious and common finding.
Why It’s a Problem:
Timely ICSR reporting is critical for regulatory compliance and public health. GVP Module VI requires strict adherence to reporting timelines.
How to Avoid It:
- Automate ICSR tracking and implement escalation workflows for late cases.
- Train staff on reportability criteria and global timelines (e.g., 15-day or 7-day rules).
- Routinely measure case processing KPIs to detect bottlenecks.
7. Insufficient Signal Management Processes
The Finding:
Many companies struggle to establish a structured and documented signal detection and management process.
Why It’s a Problem:
Signal management is essential to detect emerging safety issues. GVP Module IX mandates formal procedures and decision-making records.
How to Avoid It:
- Implement a signal management SOP aligned with GVP IX.
- Maintain a signal tracking log and document all signal evaluations.
- Hold regular Safety Review Team (SRT) meetings with minutes and actions.
How to Prepare for a GVP Audit — Best Practices
- Conduct mock audits and gap assessments at least once a year.
- Integrate PV with quality systems, especially change control, deviation, and training management.
- Maintain an up-to-date PSMF with real-time data and contact information.
- Train all PV and non-PV stakeholders (e.g., regulatory, commercial) on their safety responsibilities.
- Use KPIs to monitor performance in CAPA, ICSR, RMP, and signal management.
Need Help Navigating GVP Compliance?
At Q&V, we specialise in helping pharma and biotech companies build, audit, and optimise their pharmacovigilance systems to meet global GVP expectations. Whether you need:
- Support in closing critical audit findings
- QPPV or deputy QPPV services
- Creation or update of your PSMF and SOPs
- Risk management plan development or evaluation
We’re here to help you stay compliant, confident, and inspection-ready.
Contact Q&V today to discuss how we can support your pharmacovigilance compliance goals.