Pharmacovigilance is the discipline of detecting, assessing, understanding and preventing adverse effects and other medicine-related problems, above all once a product is in real use. For a marketing authorization holder (MAH), it is a system you operate for as long as the product stays on the market, not a task that ends at registration. This guide explains what the system contains, who does what and where companies most often fall short.
Why must a marketing authorization holder run a pharmacovigilance system?
Clinical trials follow a limited number of selected patients for a limited time. Once a medicine is approved it reaches far more people, including children, older adults, pregnant women and patients on several treatments at once. Rare reactions, effects that appear only after long use, interactions, medication errors, misuse and quality defects often surface only then.
Because the holder owns the product information and decides how the product is supplied and sold, authorities generally place the duty to monitor safety on the holder. In practice that means collecting safety information from every source, assessing it, reporting it where required and updating the product information when the balance of benefit and risk changes. The duty stays with you even when distributors or outsourced providers do part of the work.
What are the building blocks of a pharmacovigilance system?
Systems differ in size, but a credible one is built from the same parts:
- A named responsible person, usually called the QPPV
- A system master file (PSMF) describing how the system works
- Handling of individual case safety reports
- Aggregate reports and risk management plans
- Signal detection and literature monitoring
- Agreements with partners and distributors
- Training, a quality system and inspection readiness
The QPPV: the person responsible for the system
The qualified person responsible for pharmacovigilance (QPPV) is the named individual who holds overall responsibility for setting up and running the company's system. In most systems the QPPV has the authority and resources to influence how the system performs, oversees the quality and timeliness of its outputs, keeps an overview of product safety profiles and typically acts as the contact for the authority, including during inspections.
Titles and duties vary. Some authorities speak of a QPPV, others of a responsible person for pharmacovigilance or a local safety officer, and some expect both a central QPPV and a national contact. Where the person must be based, which qualifications are expected, whether the role can be outsourced and how a deputy must be arranged all depend on the authority's current requirements. Confirm these points before you nominate anyone, and keep evidence of what the QPPV actually does: a name on a form is not proof of oversight.
The PSMF: the description of your system
The system master file describes the system as it really operates. It typically covers the QPPV and cover for absence, the safety team's structure, the sources of safety data, the electronic systems in use, how cases and reports flow, the tasks delegated to partners, and how performance and quality are monitored. Annexes usually list products, agreements and procedures.
Whether an authority requires a full master file, a summary or a similar description under another name, and where and how fast it must be produced on request, depends on its own rules. Whatever the format, keep it current: an inspector who finds a PSMF that no longer matches reality will question every other document.
How are individual case safety reports collected, assessed and reported?
An individual case safety report (ICSR) records a suspected adverse reaction in one patient. A case is generally valid when it has four elements: an identifiable reporter, an identifiable patient, at least one suspect product and at least one adverse event. Reports reach you from healthcare professionals, patients, sales representatives, customer service, product complaints, studies, the literature and your partners. Each case then follows the same path:
- Receive and log every report, whatever the channel, and record the date the company first became aware of it.
- Check validity against the minimum criteria and chase missing details through targeted follow-up.
- Code and assess the case: event terms in a standard dictionary such as MedDRA, seriousness, whether the event is expected against the approved product information, and causality.
- Report to the authority and to partners in the format and within the timelines the authority sets, with serious cases normally expedited.
- Check, reconcile and archive so that the case file, the safety database and your partners' records agree.
A case is serious if it results in death, is life-threatening, requires hospital admission or a longer stay, causes lasting disability, is a congenital anomaly or has another medically important outcome. ICH E2B defines the data elements and electronic message format used to exchange ICSRs between companies and authorities. Which version, transmission route and cases (serious only or all, local only or worldwide) an authority expects differ, so settle this before you design your workflow.
One point catches many teams out. The reporting clock generally starts when anyone working for you or your partners first receives the minimum information, so every employee must know how to pass an adverse event on through a defined channel.
What are aggregate reports, risk management plans and signals?
PSUR and PBRER
Aggregate reports step back from single cases. The periodic benefit-risk evaluation report (PBRER), described in ICH E2C, is the common international format. It combines exposure estimates, case data, signals, literature and study findings in one integrated evaluation of benefit and risk. The older periodic safety update report (PSUR) covered similar ground with less emphasis on benefit. Intervals are often counted from the international birth date of the active substance, and each report stops at a data lock point.
Whether an authority wants a PSUR, a PBRER or a local summary, how often, and how soon after the data lock point depend on its own rules and can vary with the product's age and risk profile.
Risk management plans
A risk management plan states what is known and not known about a product's safety and what you will do about it. ICH E2E describes the approach: a safety specification covering important identified and potential risks and missing information, and a plan listing routine activities and, where needed, additional ones such as safety studies. Many authorities add measures to minimize risk, from product information wording to educational materials, and some expect a local version. Track every commitment until it is completed.
Signal detection and management
A signal is information suggesting a new, possibly causal link between a medicine and an event, or a new aspect of a known link, that deserves checking. Signals come from cases, aggregate data, studies, the literature and actions on similar products. A workable process states who reviews which data and how often, how potential signals are validated, assessed and prioritized, and what actions can follow: a change to the product information, a risk management plan update or a safety study. Record every review, including those where nothing was found.
How do literature monitoring, partner agreements and training fit in?
Literature monitoring
Regular screening of scientific and medical literature finds individual cases and spots new safety findings on your active substances. Define the databases and search terms, who screens and how often, how results are recorded and how relevant articles become cases. Include local and regional journals, and keep the search strategy and screening log, because inspectors ask to see them.
Agreements with partners and distributors
Most products reach patients through more than one company, and safety information can stall at every handover. A written agreement states who collects and assesses reports, who submits them to which authority, how cases are exchanged and reconciled, who screens the literature and prepares aggregate reports, and who speaks to the authority. Agree exchange timelines in writing and review the agreement whenever products, partners or requirements change.
Training
Safety information often reaches you through people who are not specialists: sales representatives, medical advisers, customer service, warehouse and quality staff. Train them to recognize an adverse event and send it promptly to the right place. Train the safety team by role, and keep records showing who was trained on which version of each procedure.
What does a quality system add, and how do you prepare for inspection?
The system needs its own quality management: written procedures, controlled documents, performance indicators such as timely and complete reporting, a process for deviations and corrective and preventive actions (CAPA), and validated electronic systems with access control, audit trails and a plan for when the safety database is unavailable. A general framework such as ISO 9001 can help structure documents and reviews, although it was not written for safety systems.
Audits and mock inspections test the system from the inside. Plan them on a risk basis across your own team, your partners and your service providers, and track every finding to closure. Inspection readiness then becomes a habit: a current PSMF, case files, aggregate reports and agreements that can be retrieved quickly, complete training records, and a QPPV and team who can explain how the system works.
Which gaps appear most often, and what about outsourcing?
Inspectors tend to find the same problems again and again:
- A QPPV or local responsible person with little real oversight, no deputy or no documented activity
- A master file that is missing, out of date or different from actual practice
- Late or missed reports because adverse events stay with distributors, sales teams or customer service
- Weak case quality: no seriousness or causality assessment, inconsistent coding, no follow-up
- No reconciliation with partners, and agreements that are unsigned or silent on key tasks
- Literature searches that are undocumented, irregular or limited to one product name
- Missing training records and deviations closed without root cause analysis
Many companies outsource part or all of their safety work, which can make sense for a small portfolio. The holder generally remains accountable, so choose providers by due diligence, set the scope in a written agreement, agree performance indicators and review meetings, keep the right to audit and keep access to your own safety data. List delegated tasks in the master file.
What should you confirm with the Egyptian Drug Authority?
The Egyptian Drug Authority (EDA) publishes its own pharmacovigilance guidance for registration holders, and this article is general orientation only. Guidance is revised from time to time, so check the current version, or ask a regulatory consultant to do so, before you design or change your system. In particular, confirm who must be named and where, what must be reported, in which format and by when, and which aggregate reports the authority expects for your products.
Next step: build a system you can defend at inspection
A sound system joins an empowered QPPV, an accurate master file, disciplined case handling, reliable aggregate reporting and documented oversight of partners. Start with a gap review against the current EDA guidance and close first the gaps that put reporting or accountability at risk.
Our team supports marketing authorization holders with pharmacovigilance services, from system design and QPPV support to case handling, periodic reports and inspection readiness, and with a quality management system for pharmacovigilance offices covering procedures, training, CAPA and oversight of outsourced work. If you are still at the registration stage, our roadmap to register a product in Egypt shows where safety obligations fit in.