In 2024, EMA inspectors recorded 87 pharmacovigilance deficiencies, including 29 major findings, and ranked PSMF among the three most common problem areas. However, a pharmacovigilance system master file should do more than describe a company’s safety system on paper. It must accurately reflect current QPPV oversight, outsourced activities, databases, procedures, quality controls, and annexes. Therefore, drug safety teams need to maintain clear change records and inspection-ready evidence that proves the documented system matches daily operations.
Table of Contents
What Is a Pharmacovigilance System Master File?
A pharmacovigilance system master file is a current and controlled record of how a company manages product safety. It explains the PSMF structure, key responsibilities, safety databases, procedures, outsourced activities, quality controls, and supporting PSMF contents. Unlike a static marketing authorisation document, the PSMF must reflect the system that operates in practice. Therefore, companies need to update it whenever responsibilities, processes, systems, or annexes change.
The infographic below maps the core PSMF contents, from QPPV oversight and organisational responsibilities to safety systems, quality controls, and annex management.
Why Inspectors Use the PSMF as a System Map?
Inspectors use the PSMF as a practical map of the entire safety system. It helps them identify who holds authority, how teams exchange information, which activities involve third parties, and where computerised systems support critical processes. Moreover, inspectors use this overview to select high-risk areas for deeper sampling. Therefore, the PSMF must show clear QPPV oversight, defined responsibilities, controlled interfaces, and a pharmacovigilance quality system that works consistently in daily operations.
Four PSMF Controls Inspectors Test First
Inspectors do not review every part of the PSMF with equal depth. Instead, they focus first on the controls that show whether the documented system matches daily operations.
The following areas reveal how effectively the company manages authority, outsourced activities, safety data, quality oversight, and corrective action:
- QPPV Authority, Access, and Oversight (PDF)
- Organisational Structure, Outsourcing, and Written Agreements (PDF)
- Safety Data Sources, Computerised Systems, and Core Processes (PDF)
- Performance Monitoring, Audit Findings, and CAPA Closure (PDF)
QPPV Authority, Access, and Oversight (PDF)
The QPPV must have enough authority and access to oversee the safety system. Inspectors also check whether the QPPV receives key audit, risk, and change information.
Organisational Structure, Outsourcing, and Written Agreements (PDF)
The PSMF should clearly define internal roles, vendors, and delegated activities. Written agreements must also set responsibilities, timelines, audit rights, and data-exchange rules.
Download Commission Implementing Regulation EU 2025 1466 Here
Safety Data Sources, Computerised Systems, and Core Processes (PDF)
The PSMF must identify safety data sources and the systems used to manage them. Inspectors review validation, data integrity, backups, change control, and core safety processes.
Performance Monitoring, Audit Findings, and CAPA Closure (PDF)
Metrics, audits, and CAPA records show whether the quality system works effectively. Inspectors check root causes, action owners, deadlines, effectiveness reviews, and closure evidence.
How to Maintain PSMF Contents, Annexes, and Change Control
Effective PSMF maintenance requires clear ownership, timely updates, and strong change control. Companies should assign named owners to each section and annex, update the file when key events occur, and reconcile every change with source records. Moreover, version control and a five-year logbook must show what changed, when it changed, and who approved it. Therefore, teams should document major or critical deviations until closure and keep the PSMF aligned with the live pharmacovigilance system.
How Inspectors Reconcile PSMF Claims with Operational Evidence
Inspectors do not accept PSMF statements at face value. Instead, they trace each claim to source records, system data, contracts, audit files, and change histories. Therefore, even a complete PSMF can create compliance risk when its content does not match daily operations or supporting evidence.
The table below shows how inspectors may test common PSMF claims and what each inconsistency can indicate.
| PSMF claim | Evidence inspectors may review | Risk-signalling inconsistency | Likely inspection concern |
|---|---|---|---|
|
The QPPV has effective system oversight |
Organisation charts, job descriptions, meeting records, escalation logs, audit and CAPA access |
Records do not show QPPV authority or involvement in major decisions |
Ineffective QPPV oversight |
|
Outsourced activities remain controlled |
Contracts, safety data agreements, vendor metrics, audit reports, subcontracting records |
Agreements omit responsibilities, timelines, audit rights, or data-exchange rules |
Weak third-party governance |
|
Computerised systems support controlled safety processes |
System inventories, validation records, access controls, backup tests, and change histories |
The PSMF description differs from the live system or validation evidence remains incomplete |
Data integrity and process-control risk |
|
PSMF annexes remain accurate and current |
Product lists, procedure indexes, contract lists, revision records, and reconciliation results |
Annexes contain outdated information or conflict with source records |
Unreliable PSMF maintenance and change control |
|
Audit findings and CAPA remain under control |
Audit plans, reports, root-cause analyses, CAPA records, effectiveness checks, and closure evidence |
Actions remain overdue or teams close CAPA without objective evidence |
Ineffective quality-system improvement |
The infographic below shows how inspectors connect each PSMF claim with operational records, identify inconsistencies, and assess the resulting compliance risk.
Final Words
Across 17 routine inspections, MHRA recorded 23 quality management findings, including 12 related to audits, deviations, and CAPA management. These results show that inspectors look beyond document completeness and test how companies control weaknesses in practice. Therefore, an inspection-ready pharmacovigilance system master file must remain current, traceable, and fully aligned with operational evidence.
Quality Management System
We work with pharmaceutical teams to design, implement, and run effective Quality Management Systems, covering change control, CAPA, deviations, and audits to support consistent GMP compliance.
FAQ
A PSMF should be updated whenever a significant change affects the safety system, QPPV responsibilities, vendors, databases, procedures, or medicinal products. Companies should also keep annexes current and record relevant changes in the logbook.
Inspectors usually examine QPPV authority, outsourced activities, safety databases, core processes, audit findings, and CAPA records. They then compare these claims with contracts, system data, training files, and operational evidence.
The mismatch shows that the marketing authorisation holder does not fully control its safety system. Inspectors may expand sampling, raise significant findings, and require corrective actions to restore accuracy and traceability.
References
Marco Klinger is Head of Quality Services at Zamann Pharma Support, where he leads consulting teams through complex regulatory and quality-driven projects. He brings more than 15 years of hands-on compliance experience across regulated industries. His work includes close collaboration with companies such as Reckitt, Sanofi, Biotech, Biotest, and others. Marco has deep expertise in medical device development, aseptic manufacturing, and the design, implementation, and management of complete quality management systems within GMP-regulated environments.