An MAH can use an outsourced QPPV provider to perform the QPPV function, but it cannot outsource its ultimate responsibility for its pharmacovigilance system, product safety obligations or regulatory compliance. Under an imminent vacancy, the defensible response is not simply to appoint the fastest available individual: it is to confirm legal and operational suitability, document risk-based due diligence, put governance and access in place, update relevant authority data promptly through the applicable route, and maintain active MAH oversight from day one. This article addresses that provider-selection and governance task only; for the role itself, see GuideGxP’s guide to the QPPV role.
Start with the accountability boundary
Binding EU requirements establish the MAH’s pharmacovigilance responsibilities and require an appropriately qualified person responsible for pharmacovigilance to be permanently and continuously at the MAH’s disposal. The QPPV must reside and operate in the Union. The detailed system must be described and maintained through the pharmacovigilance system master file (PSMF), as set out in EU legislation.
Regulator guidance, including EMA Good Pharmacovigilance Practices (GVP) Modules I and II, explains expectations for the quality system, outsourcing arrangements, roles, documentation and the PSMF. Guidance should be applied proportionately and translated into the MAH’s procedures; it does not turn a supplier’s assertion of “GVP compliant” into evidence that the MAH’s own system is controlled.
GuideGxP implementation advice: designate a senior MAH owner for the outsourced arrangement, separate from the provider’s operational contact. That owner should be able to challenge performance, approve material decisions, escalate to management and trigger contingency action. Procurement may negotiate commercial terms, but Pharmacovigilance, QA and Regulatory Affairs should own the compliance assessment and approval.
Run rapid due diligence without reducing the evidence standard
A vacancy may justify an accelerated timetable, not a lower threshold for evidence. First define the actual service: named QPPV only, QPPV plus deputy, local safety support, case processing interfaces, literature oversight, aggregate-reporting coordination, signal support, or wider pharmacovigilance operations. A provider suitable for a small, stable portfolio may not have sufficient depth for products with extensive territories, multiple partners, ongoing post-authorisation commitments or complex safety governance.
Evaluate the named people, not only the provider brand
- Verify the proposed QPPV’s documented qualifications, relevant experience and understanding of the MAH’s products, territories and safety profile.
- Confirm that the QPPV resides and operates in the Union, and test how permanent and continuous availability will work in practice.
- Assess medically qualified support where the portfolio and decision-making needs warrant it; do not assume that access to a medical resource is equivalent to defined, available support.
- Identify a deputy or contingency arrangement, its authority, training, availability and handover mechanism.
- Review current workload, planned absences, conflicts of interest and the realistic capacity of both the named QPPV and support team.
Test system access and operational control
The proposed QPPV must be able to obtain and use the information needed to discharge the function. Due diligence should therefore demonstrate access pathways, permissions and response ownership for the PSMF, safety database, quality records, product information, agreements, safety data exchanges and authority communications. Ask the provider to show, rather than merely describe, its controlled approach to access requests, urgent safety issues, escalation and records retention.
Where subcontractors are proposed, identify them before appointment. The MAH should understand the activity, location, data flow, oversight model and continuity implications of each material subcontracted element. A chain of contracts must not obscure who performs an activity, who reviews it, who owns an overdue action or who can communicate with an authority.
Use a weighted decision matrix and hard stop criteria
A scored matrix makes the selection rationale retrievable for management review, vendor qualification and inspection. The weights below are examples of GuideGxP implementation advice, not regulatory acceptance limits. Score candidates consistently against pre-agreed descriptors, retain supporting evidence and record why a lower-scoring but better-controlled option was selected, if applicable.
| Assessment area | Example weight | Evidence to examine | Hard-stop question |
|---|---|---|---|
| Named QPPV suitability and EU location | 20% | CV, role history, availability model, residence/operation confirmation | Can the named QPPV meet the applicable EU requirement and be continuously available? |
| Portfolio, territory and partner fit | 15% | Relevant product experience, language and network coverage, proposed operating model | Can the provider support this portfolio without untested dependencies? |
| Access, systems and data interfaces | 15% | PSMF and database access design, authority-contact route, data-flow map | Will the QPPV have timely access to necessary information? |
| Continuity, deputy and escalation | 15% | Business continuity plan, deputy evidence, on-call arrangements, escalation examples | Is there a workable response if the named QPPV is unavailable? |
| Quality, audit and inspection evidence | 15% | Quality system overview, audit history made available, CAPA governance, inspection experience | Can the MAH audit and follow up meaningful evidence? |
| Capacity, conflicts and subcontracting | 10% | Resourcing plan, conflict declaration, subcontractor register and oversight | Are capacity and conflicts controlled rather than assumed? |
| Commercial, legal and exit readiness | 10% | Contract draft, pricing transparency, transition and termination assistance plan | Can the MAH recover control and transfer safely on exit? |
Do not average away a critical deficiency. Lack of a suitable named QPPV, inadequate EU location evidence, no credible continuity model, inability to provide required access, or refusal of appropriate audit and exit provisions should be treated as a decision-blocking issue until resolved.
Contract for governance, not just service delivery
The written agreement should describe activities, responsibilities, interfaces and oversight in sufficient operational detail. This reflects GVP’s outsourcing principles: the MAH remains responsible, and delegation must be documented, controlled and monitored. Competent legal and regulatory review is essential because contract wording, data-protection roles and authority-notification routes depend on the MAH’s circumstances and applicable law.
- Scope and responsibility map: named QPPV, deputy, MAH process owners, delegated tasks, approval rights and interfaces with affiliates, distributors and other vendors.
- Availability and escalation: contact arrangements, urgent safety and authority escalation paths, decision authority and management notification.
- Access and information: timely access to the PSMF, safety data, quality information and records needed by the QPPV.
- Quality governance: training, deviations, CAPAs, change control, periodic reporting, KPIs, management review and documented service reviews.
- Audit and inspection: MAH audit rights, access to relevant records and subcontractor oversight, notification and support arrangements for inspections.
- Data and security interfaces: roles for personal-data handling, controlled access, incident escalation and return or transfer of records. This is not a substitute for specialist data-protection advice.
- Termination assistance: notice-period obligations, knowledge transfer, record transfer, access continuity and cooperation with the incoming arrangement.
Control the transition and authority-data changes
A transition plan should have a single accountable MAH lead, named provider lead, risk register and documented go/no-go decision. It should not declare a rushed change compliant before access, responsibility and continuity are demonstrably working. Authority information concerning the QPPV must be kept current using the applicable regulatory process; confirm the relevant route and timing with competent Regulatory Affairs and legal advisers rather than relying on a generic supplier timetable.
Inspection-ready transition checklist
- Document the vacancy risk, interim controls, selection rationale and approval of the chosen provider.
- Confirm the appointed QPPV’s EU residence and operation, qualifications, capacity, conflicts and permanent/continuous availability arrangements.
- Approve the agreement, responsibility matrix, escalation tree, subcontractor controls and audit plan.
- Provide and test controlled access to the PSMF, safety database, product information, quality records and relevant partner agreements.
- Complete a documented handover of open cases, signals, aggregate-reporting work, commitments, CAPAs, audits, inspections and authority correspondence.
- Update applicable authority or regulatory database information promptly, retain evidence of submission or update, and reconcile it against internal records.
- Train the provider on the MAH’s procedures and portfolio; retain completion and effectiveness evidence where applicable.
- Test urgent escalation, deputy activation and a representative authority-contact pathway before relying on them.
- Record residual risks, owners, due dates and management acceptance where risks cannot yet be eliminated.
Oversee performance at 30, 60 and 90 days
Early oversight should focus on control effectiveness, not on a cosmetic supplier scorecard. The MAH should define metrics that reveal whether the QPPV function is informed, connected and able to act. Metrics are management tools, not regulatory thresholds.
| Review point | Suggested focus | Evidence for the MAH file |
|---|---|---|
| 30 days | Access completion, handover gaps, training, open urgent matters, first escalation test | Access log, issue register, meeting minutes, corrective actions |
| 60 days | Quality of governance interfaces, overdue items, deputy readiness, partner and subcontractor controls | Service review, KPI trend, risk review, CAPA status |
| 90 days | Operating stability, QPPV visibility of safety system, authority-contact readiness and improvement priorities | Formal performance review, management decisions, updated oversight plan |
Continue periodic service reviews thereafter, with QA involvement proportionate to risk. Escalate material non-performance through the contractual route and the MAH quality system. An audit right has little value unless audit observations, CAPAs, effectiveness checks and overdue actions receive documented MAH follow-up.
Plan the exit before it is needed
Exit planning is a continuity control, not a sign of distrust. Maintain a current inventory of provider-held records, system permissions, subcontractors, open actions and knowledge dependencies. Require reasonable cooperation for transfer to the MAH or successor, while protecting confidentiality and data obligations. Periodically test whether the MAH can identify a replacement, retrieve essential records and preserve QPPV coverage without a governance gap.
FAQ
Does appointing an external QPPV transfer MAH accountability?
No. Outsourcing can allocate work and specify service responsibilities, but the MAH retains ultimate responsibility for its pharmacovigilance system and compliance.
Can an urgent vacancy justify skipping provider qualification?
No. It may require an accelerated, risk-based process, but the MAH still needs evidence that the appointment, access, continuity and governance arrangements are workable. Seek competent legal and regulatory review for the specific situation.
What should trigger immediate escalation?
Examples include inability of the QPPV to access necessary information, unplanned loss of QPPV or deputy availability, serious data or cyber incidents affecting pharmacovigilance information, material missed obligations, or an authority contact requiring action. Define exact triggers and owners in the agreement and procedures.
Primary sources
- Commission Implementing Regulation (EU) No 520/2012, current consolidated version
- Directive 2001/83/EC, consolidated version
- EMA Good Pharmacovigilance Practices modules I and II
- EMA Pharmacovigilance System Questions and Answers
- EMA Coordination of Pharmacovigilance Inspections
Turn the method into an audit-ready system
Guide to the Pharmacovigilance Manager (QPPV) and Their Team is an optional GuideGxP operational resource for deeper methods, checklists and ready-to-adapt tools. It is not regulator-endorsed.
Stay practical: The Pragmatic GMP
Subscribe to The Pragmatic GMP for evidence-led GMP analysis, practical checklists and regulatory updates.
