Are You GVP-Compliant or Just Audit-Ready? The Operational Gap in PV Systems

GVP Compliance vs Audit Readiness Is Tested Through System Traceability

Most pharmacovigilance systems look compliant before an inspection.

Documentation is aligned. The PSMF is updated. Training records are complete.

But inspections do not test documentation. They test whether the system works without intervention.

Regulators use traceback and audit trails. They follow a case from intake to submission, check timelines, verify decisions, and compare outcomes against what the system claims to do.

That is where the gap appears.

How EMA GVP Modules I, II, and IV Define System Performance

GVP does not define compliance as documentation completeness.

• Under Module I, a pharmacovigilance system is defined by structures, processes, and outcomes.
• Under Module II, the PSMF must reflect the system as it operates in real time.
• Under Module IV, audits must be risk-based and assess system effectiveness, not just process existence.

This creates a clear expectation. A compliant system must demonstrate:

• Continuous control
• Traceable decisions
• Timely execution
• Measurable oversight

A system supported by structured PV quality management systems aligns governance, execution, and oversight into a single operating model.

Anything less is presentation, not compliance.

Audit Readiness in Pharmacovigilance Is Often Retrospective Compliance

Audit readiness is typically a preparation cycle.

Teams reconcile deviations, update documents, and align outputs before inspection. The system appears stable because it has been corrected.

But regulators are not assessing corrected systems. They are assessing normal operations.

This is why systems that appear compliant still generate findings.

The issue is not missing SOPs. The issue is whether those SOPs are followed when no one is preparing.

Regulatory Findings Show the Gap Between Design and Execution

The gap is not theoretical.

In recent inspections, the FDA has issued warning letters to top pharmaceutical companies following pharmacovigilance system findings.

The failures were not about missing documentation. They were about execution.

• Adverse events were rejected based on perceived causality.
• Cases were invalidated despite available patient identifiers.
• Medical review timelines were missed.

One reported case involving serious safety concerns remained unreviewed for weeks until identified during inspection.

The FDA classified these as systemic failures, not isolated errors.

This is the difference between audit readiness and compliance. The system existed. The system did not function.

CAPA, PSMF, and Vendor Oversight Failures Are Recurring Inspection Patterns

Across inspections, three areas consistently expose weak systems.

CAPA systems often close records without resolving root causes. Recurrence is common because effectiveness is not verified.

The PSMF frequently reflects an idealized system rather than the current one. Misalignment in governance structures, vendor roles, and process ownership is a repeated finding. Tools like PVCON's PSMF Manager help maintain alignment between documented systems and real-time operations, but only if the underlying system is controlled.

Vendor oversight is another major gap. Agreements exist, but operational monitoring is weak. Without reconciliation, KPI tracking, and risk-based audits, accountability remains fragmented.

Independent validation through pharmacovigilance audits often reveals these gaps before regulators do.

Data Integrity and ALCOA+ Failures Expose System Weakness

Data integrity is one of the most tested areas in inspections.

Regulators apply ALCOA+ principles. Data must be attributable, legible, contemporaneous, original, and accurate.

Failures rarely occur because systems lack audit trails. They occur because:

• Audit trails are not reviewed
• Access controls are not enforced
• Inconsistencies are not investigated

This is a system behavior issue.

A compliant system demonstrates active control over data, not just technical capability.

Why PV Systems Drift Between Inspections

The gap exists because compliance is treated as a milestone.

Teams focus on inspection outcomes instead of system stability. Documentation creates confidence, even when execution weakens.

Resource constraints amplify the problem. High case volumes reduce review quality. Oversight becomes reactive.

Training gaps also contribute. Without structured alignment through programs like a defined training matrix or targeted regulatory compliance training, process deviations become normalized.

Over time, the system drifts away from its documented design.

GVP Compliance Indicators That Distinguish Mature PV Systems

Mature systems operate consistently without inspection pressure.

• CAPA effectiveness prevents recurrence.
• PSMF updates occur in real time.
• Vendor oversight is measurable and documented.
• Signal detection is proactive and traceable.

The QPPV plays a central role, with demonstrable oversight through access to the PSMF, safety data, audit outcomes, and vendor activities.

These are not inspection activities. They are daily operations.

Audit Readiness Is a Snapshot. GVP Compliance Is a System State

Audit readiness can be achieved in weeks. GVP compliance cannot.

Regulators are no longer assessing whether systems appear compliant. They are assessing whether systems perform under real conditions.

Periodic regulatory findings across multiple authorities have consistently underscored the implications of this gap.

A system that only works during inspection is not compliant. It is exposed.

If you want to evaluate whether your pharmacovigilance system is operating as designed, connect with PVCON's team through the Contact page or explore our PV consulting services to identify gaps before regulators do.