EMA pharmacovigilance inspection readiness: what small biotechs consistently get wrong

The EMA PV inspection notice arrives on a Tuesday morning. The CMO calls the QPPV. The QPPV asks for the PSMF. It was last updated 14 months ago. The SOP for ICSR processing has not been reviewed since it was drafted. The SUSAR line listing in the last DSUR is missing three cases that appear in the safety database. The inspection is in six weeks. This is a preventable situation — and it happens at small biotechs more often than you might expect.

Mistake 1: The PSMF does not reflect actual operations

The most common critical finding at EMA PV inspections is a disconnect between what the PSMF describes and what actually happens. Your PSMF might say the QPPV reviews all expedited ICSRs within 3 working days. Your records might show that the last 12 expedited reports were reviewed at day 8-10. That is not a paperwork problem — it is a systemic PV failure that will be cited as a critical finding.

The fix is not to change the PSMF to match your processes — it is to ensure your processes match your PSMF, or to update your PSMF when you change your processes. The PSMF must be reviewed at least annually per GVP Module I, and updated whenever there is a material change to the PV system.

Mistake 2: SOPs exist but training records do not

GVP Module I requires a quality system that includes documented procedures, training, and evidence that training has been completed. At small companies, SOPs often exist but training logs do not. Or training logs exist but the training was not against the current SOP version. Inspectors check the SOP version history against the training records. If staff were trained on v1.0 of an SOP but the current version is v3.2, and there is no record of training on v2.0 or v3.0, that is a finding.

Mistake 3: Contractor oversight is not documented

If you have outsourced ICSR processing, literature surveillance, or aggregate reporting to a CRO, you must have documented oversight of that contractor. GVP Module I requires the MAH to maintain oversight of all contracted PV activities. This means: a written Quality Agreement or Technical Agreement specifying responsibilities, documented evidence that the contractor's work is reviewed (audit findings, quality metrics, ICSR quality checks), and evidence that the MAH QPPV has access to the contractor's data.

A common failure: the MAH has a contract with a CRO that specifies responsibilities, but there is no evidence the MAH has ever reviewed the CRO's work. The contract alone is not oversight.

Mistake 4: Signal detection is not documented

GVP Module IX requires documented signal detection activities. Small biotechs often conduct informal signal detection — the medical director reads the ICSR summaries — but do not document it. Inspectors want to see: a documented signal detection plan, records of literature searches (date, database, search terms, results), records of signal assessment meetings or decisions, and a signal log showing all potential signals identified, assessed, and concluded.

Mistake 5: Audit trail in the safety database is incomplete

EMA inspectors commonly request database audit trails for selected ICSRs — the full edit history showing who changed what field and when. Incomplete audit trails (cases with missing entry dates, assessments with no author record, follow-up data added without documentation of source) suggest data integrity issues and may trigger a For Cause inspection. Ensure your safety database is configured to capture a complete audit trail and that you have never disabled audit trail functions.

If you are preparing for a first MAA or facing an EMA inspection notice, Nimble PV can conduct a gap assessment and remediation plan within 5 working days. Talk to Vera at nimblepv.com.