Pharmacovigilance Audits and requirements you need to know

Q: What is requirement to perform an audit?

A: The marketing authorisation holder in the EU is required to perform regular risk-based audits of their pharmacovigilance system [DIR Art 104(2)]. The dates and results of audits and follow-up audits shall be documented.

Q: What is Audit strategy?

A: The audit strategy is a high level statement of how the audit activities will be delivered over a period of time, usually for a period of 2-5 years

Strategy need to be with

1. List of audits that could reasonably be performed.
2. governance, risk management and internal controls of all parts of the pharmacovigilance system
3. all pharmacovigilance processes and tasks
4. the quality system for pharmacovigilance activities
5. interactions and interfaces with other departments, as appropriate
6. pharmacovigilance activities conducted by affiliated organisations or activities delegated to another organisation
7. changes to legislation and guidance
8. major re-organisation or other re-structuring of the pharmacovigilance system, mergers, acquisitions
9. change in key managerial function(s)
10. risk to availability of adequately trained and experienced pharmacovigilance staff
11. significant changes to the system since the time of a previous audit, e.g. introduction of a new database, upgrade to the existing database, changes to processes, new or amended regulatory requirements
12. first medicinal product on the market
13. medicinal product on the market with specific risk minimisation measures or other specific safety conditions such as requirements for additional monitoring
14. outcome of previous audits

Q: What is Audit Programme?

A: An audit programme is a set of one or more audits planned for a specific timeframe, normally for a year. It should be prepared in line with the long term audit strategy. The audit programme should be approved by upper management with overall responsibility for operational and governance structure

Q: What is Risk based audit programme?

A: The risk-based audit programme should be based on an appropriate risk assessment. Risk-based pharmacovigilance audits should be performed at regular intervals, which are in line with legislative requirements. This should focus on

1. The quality system for pharmacovigilance activities
2. Critical pharmacovigilance processes
3. Key control systems relied on for pharmacovigilance activities
4. Areas identified as high risk, after controls have been put in place or mitigating action taken.

Q: Do Audit findings need to be reported?

A: The findings of the auditors should be documented in an audit report and should be communicated to management in a timely manner. The audit process should include

1. Mechanisms for communicating the audit findings to the auditee
2. Receiving feedback
3. Reporting the audit findings to management and relevant parties, including those responsible for pharmacovigilance systems

Q: What can be considered as critical finding?

A: Critical is a fundamental weakness in one or more pharmacovigilance processes or practices that

1. Adversely affects the whole pharmacovigilance system and/or the rights,
2. Adversely affects the safety or well-being of patients
3. That poses a potential risk to public health
4. Represents a serious violation of applicable regulatory requirements

Q: What can be considered as Major finding?

A: Major is a significant weakness in one or more pharmacovigilance processes or practices that

1. Detrimental to the whole process
2. Could potentially adversely affect the rights, safety or well-being of patients
3. Could potentially pose a risk to public health
4. Represents a violation of applicable regulatory requirements which is however not considered serious.

Q: What can be considered as Minor finding?

A: Minor is a weakness in the part of one or more pharmacovigilance processes or practices that

1. Which is not expected to adversely affect the whole pharmacovigilance system
2. Not expected to adversely affects the rights, safety or well-being of patients

Q: What are Actions based on audit outcomes?

A: Actions referenced in this section as per the guideline

1. Immediate action
2. Prompt action
3. Action within a reasonable timeframe
4. Issues that need to be urgently addressed, or communicated in an expedited manner,
5. Issues are intended to convey timelines that are appropriate, relevant, and in line with the relative risk to the pharmacovigilance system.

Actions should include root cause analysis and impact analysis of identified audit findings and preparation of a corrective and preventive action plan, where appropriate.

Q: Is there any priority to address the critical and major issues?

A: Corrective and preventive actions to address critical and major issues should be prioritised. The precise timeframe for actions related to a given critical findings need to be fixed.

Q: What are critical parameters in an auditor in terms of Qualification, skill and experience?

A: Auditors should demonstrate and maintain proficiency in terms of the knowledge, skills and abilities required to effectively conduct and/or participate in pharmacovigilance audit activities.

The proficiency of audit team members must be with knowledge on

1. Education
2. Work experience
3. Training
4. Audit principles
5. Audit procedures and techniques
6. Applicable laws, regulations, and other requirements relevant to pharmacovigilance
7. Pharmacovigilance activities, processes and systems
8. Management systems and organisational systems

Q: What is evaluation of Audit and How to check the Quality of audit activities?

A: Evaluation of audit work can be undertaken by means of ongoing and periodic assessment of all audit activities, auditee feedback and self-assessment of audit activities

Q: Who is with responsibility of Audit?

A: Ultimate responsibility for the operation and effectiveness of the pharmacovigilance system resides within the organisation though the audit is out sourced to service providers.

Q: What parameters to be considered while outsourcing the Audit to a 3^rd party?

A: Where the organisation decides to use an outsourced audit service provider

1. The requirements and preparation of the audit risk assessment, the audit strategy and audit programme and individual engagements should be specified to the outsourced service providers, by the organisation, in writing
2. The scope, objectives and procedural requirements for the audit should be specified to the outsourced service provider, by the organisation, in writing
3. The organisation should obtain and document assurance of the independence and objectivity of outsourced service providers
4. The outsourced audit service provider should also follow the relevant parts of this GVP Module