How to Keep Delegated PV Responsibilities Inspection-Ready
An inspector requests the current Pharmacovigilance System Master File and the agreements supporting outsourced pharmacovigilance activities.
The pharmacovigilance agreement says the service provider performs signal detection. The PSMF still assigns the activity to the internal safety team. The operational procedure shows that part of the work is being completed by another subcontractor.
Every document exists, but none of them describes the same pharmacovigilance system.
This is the delegation gap. It develops when the agreement, the PSMF, and the organizational processes are maintained separately instead of being governed as connected evidence.
Key Takeaways: Pharmacovigilance activities may be delegated, but the MAH remains accountable for the PSMF and the quality of outsourced work. Each delegated activity should be traceable across the agreement, relevant PSMF content, procedures, products, territories, oversight evidence, and change history. Material agreement changes should trigger a documented PSMF impact assessment and appropriate QPPV review.
The Compliance Link Between the PVA and the PSMF
A pharmacovigilance agreement defines how safety responsibilities are divided between the MAH and another party, such as a CRO, distributor, licensing partner, co-marketing partner, or specialised service provider.
The PSMF describes how those responsibilities operate within the pharmacovigilance system.
The two records serve different purposes, but they must present one consistent operating model.
Under Article 6 of Commission Implementing Regulation (EU) No 520/2012, an MAH may subcontract pharmacovigilance activities but retains full responsibility for the completeness and accuracy of the PSMF. The MAH must also maintain a list of subcontracts identifying the products and territories concerned.
Relevant agreements should define:
- The roles and responsibilities of each party
- Safety-data exchange responsibilities and methods, where applicable
- Audit and inspection arrangements
- The third party's obligation to accept MAH audits and regulatory inspections
- Requirements for obtaining written MAH consent before further subcontracting assigned PV activities
A signed agreement is therefore only the starting point. The MAH must also demonstrate that the contracted responsibilities are accurately reflected in the organizational processes and remain under effective oversight.
Where Delegated Responsibilities Appear in the PSMF
EMA GVP Module II expects the PSMF to describe subcontracted activities and the organisations involved. The supporting information should identify the parties, their roles, and the applicable products and territories.
Related information may appear across several annexes:
- Annex A: Tasks delegated by the QPPV
- Annex B: Lists of contracts and agreements
- Annex C: Sources of safety data and relevant third-party contacts
- Annex G: Audit schedules and completed audits
- Annex I: The logbook and history of changes affecting annex content
This distribution matters. A PVA should not be treated as a single Annex B entry with no connection to the rest of the PSMF.
A delegated activity may also affect safety-data sources, procedures, performance measures, audits, and document control.
Four Ways the Delegation Gap Develops
1. The Agreement Changes Without a PSMF Assessment
A product, territory, service, reporting timeline, contact, or vendor responsibility changes in the agreement. The PSMF remains unchanged until the next scheduled review.
EMA GVP Module II expects organisations to maintain processes that continuously identify relevant changes. Significant contractual arrangements and transferred PV services should be assessed through change control and communicated to the QPPV where applicable.
Not every wording change requires a new PSMF version. However, every material change should receive a documented PSMF impact assessment.
2. The Agreement and the Procedure Do Not Match
A PVA may require safety information to be exchanged within one timeframe while the operational SOP applies another.
Similar inconsistencies may affect:
- Case intake and reporting
- Reconciliation
- Signal escalation
- Aggregate-report contributions
- Literature activities
- Business continuity
- Audit rights
- Evidence access
A practical traceability test is:
Agreement requirement → PSMF description → applicable procedure → operational evidence
A broken connection at any point means the documented system may no longer reflect the operating system.
3. Downstream Subcontracting Is Not Visible
A primary service provider may use another organisation for translation, literature screening, medical review, technology hosting, or case processing.
If the downstream arrangement is not communicated, assessed, and approved, the QPPV may not have visibility over the complete delivery chain.
The EU implementing regulation requires written MAH consent before a service provider further subcontracts assigned pharmacovigilance work. Relevant audit and inspection controls should also extend to the downstream party.
The PSMF must describe the system that actually performs the activity, not only the organisation named in the original agreement.
4. QPPV Oversight Is Described but Not Demonstrated
A well-written governance section does not prove that oversight occurred.
Depending on the activity and its risk, supporting evidence may include:
- Vendor performance reviews
- Reconciliation records
- Governance meeting minutes
- Escalation and deviation records
- Audit reports
- CAPA status
- Documented reviews and approvals
- Evidence of access to current system information
The QPPV should be able to verify that the PSMF remains an accurate and current description of the pharmacovigilance system.
Read more about strengthening QPPV oversight and PSMF inspection readiness.
Build One PVA-to-PSMF Control Loop
Maintain a Controlled Delegation Register
The register should connect each delegated activity to its:
- Responsible organisation
- Products and territories
- Agreement reference and effective date
- Applicable PSMF sections and annexes
- Governing procedures
- Oversight evidence
- Audit status
- Change owner
The register does not replace the agreement or the PSMF. It helps the team identify missing, outdated, or contradictory connections.
Make Agreement Changes a Formal Trigger
Legal, procurement, alliance management, commercial, quality, and PV teams often manage different parts of the relationship. The governance process must connect them.
A new or revised agreement should trigger an assessment of:
- PSMF narrative
- Annex entries
- Procedures
- System descriptions
- Contacts
- Product and territory scope
- QPPV oversight requirements
- Audit and inspection arrangements
The outcome should be documented even when the assessment concludes that no PSMF update is required.
Preserve the Historical Relationship
An inspector may ask which agreement and operating arrangement applied when a historical case, deviation, audit, or CAPA occurred.
The team should be able to retrieve the approved PSMF version and corresponding agreement that were effective at that time.
This is why version history and an audit trail serve different inspection purposes. The version shows the approved system description, while the audit trail records the activities that produced it.
Test the Arrangement Before an Inspector Does
EMA GVP Module II states that the PSMF should be provided within seven days of a competent-authority request. Immediate access may also be required at the registered PSMF location or QPPV site.
A mock inspection should test more than PDF generation. The organisation should be able to:
- Produce the current approved PSMF
- Retrieve the relevant agreement
- Confirm the delegated products, territories, and activities
- Explain recent contractual changes
- Show QPPV oversight evidence
- Retrieve applicable historical versions
- Provide audit and CAPA information
- Identify authorised downstream subcontractors
The test should begin with the accuracy of the underlying system information, not with document formatting.
The PSMF seven-day requirement becomes difficult when teams must reconstruct these connections after receiving a regulatory request.
How PSMF Manager Supports Delegated PV Governance
Technology cannot determine whether an agreement is adequate or whether a delegated arrangement complies with every applicable requirement. Those decisions remain with the MAH, QPPV, and responsible PV and quality functions.
PSMF Manager supports the control process by making changes, reviews, approvals, and historical states easier to trace.
Its Tracked Changes workflow highlights modifications, records user attribution, and preserves review activity. Its Version History controls retain previous approved PSMF states and the actions associated with them.
Where an agreement or supporting record is maintained in a compatible external repository, External Data Sources integration can raise a corresponding change for review when the source file updated. Human assessment and approval remain part of the controlled workflow.
Once the relevant content has been reviewed and approved, the PSMF Generation workflow compiles the approved sections, annexes, bookmarks, and Annex I information into a read-only PDF.
A Signed Agreement Is Only the Starting Point
The main inspection risk is not that an activity has been outsourced.
The risk is that the MAH cannot clearly demonstrate who performs it, under which agreement, for which products and territories, through which procedure, and under whose oversight.
When an agreement changes, the PSMF should not discover the change months later.
Request a demo of PSMF Manager to see how controlled changes, approvals, version history, and external source monitoring can support delegated PV governance.