How to Master the Pharmacovigilance System Master File for Inspection Readiness

Pharmacovigilance (PV) inspection outcomes are often shaped before the opening meeting begins. Inspectors typically form an early view of PV systems from the first document they review: the Pharmacovigilance System Master File (PSMF). Providing inspectors with a high-quality PSMF signals strong governance and oversight. Providing a weak or outdated document often guides where inspectors probe.

What Is the Pharmacovigilance System Master File?

In the EU, the UK, and many other regions, the PSMF is a legally required document describing the Marketing Authorisation Holder’s (MAH) PV system. In the EU and UK, it is described in the Good Pharmacovigilance Practice (GVP) Module II (EU) and the MHRA modifications and exceptions to GVP II (UK). Other territories will have their own analog Systems of GVP, with the requirements being very similar to the EU. The GVP II sets expectations for what must be included but does not prescribe a structured template. This allowance for interpretation means PSMFs can appear different but should all provide roughly the same information, giving inspectors a clear and comprehensive overview. Adjacent to the PSMF is the logbook, included in Annex I. This provides an overview of changes to both the PSMF and the PV system.

How are Inspection Notifications Different in the EEA Versus the UK?

In the European Economic Area (EEA), PV inspections are performed by the 30 national inspectorates. It is common in the EEA for the PSMF to be requested at the same time as the inspection is announced.

In the UK, the MHRA is the sole authority performing GVP inspections. The MHRA inspectors often request the PSMF before the inspection is formally announced. While timing varies, the key takeaway is that a PSMF request is an early signal that an inspection request will follow.

What Is the 7‑day Request?

When an inspectorate requests the PSMF, MAHs are granted 7 days to provide an up-to-date copy. Upon receipt of the request, teams set a “data lock point” and must submit a PSMF reflecting the PV system as it exists on that date.

This is where problems can begin. The 7‑day request is independent of routine PSMF update cycles. Even if a routine update was completed recently, the submitted PSMF still needs to be accurate to the data lock point. Pharmacovigilance teams can end up patching gaps under pressure, and if no clear process exists the risk of creating inconsistencies and omitting new information increases.

The Inspection Experience of a Global PV Consultancy

A review of 13 routine inspections over five years (11 full system inspections and two Reference Safety Information/Risk Minimisation Measurements inspections) identified 100 findings in total: 4 critical, 45 major, and 51 minor. Ten findings (10%) were directly PSMF specific (where the PSMF itself caused the finding) and most of those were major (7 major; 3 minor).

The PSMF also featured in roughly one-third of all findings when counting any finding that mentioned or impacted it (in the narrative, root cause, Corrective and Preventive Action (CAPA), or deliverables). In this set, the PSMF was referenced in 25% of critical findings and 40% of major findings, reinforcing a practical point: PSMF issues are frequently treated as system-level weaknesses and tend to be graded as major.

Two Recurring Major Findings and Their CAPAs

Example 1: The PSMF becomes internally inconsistent or non-compliant

One major finding (with multiple parts) illustrates common update failures: the PSMF review cycle was not followed, contracting arrangements of the MAH were unclear (subcontracted partners could not be distinguished), the core referenced outdated procedures and the list of sources of safety data lacked contact details.

Effective CAPAs focused on the PSMF update process itself. Checklists and forms were implemented to ensure compliance with the GVP requirements. The MAH also created standard PSMF contributor request templates to ensure the right information is consistently captured. Quality Control (QC) checks were enhanced to require cross-checks between the PSMF core narrative and annexes prior to approval.

Example 2: PV System Change control is not captured

A second major finding showed different weaknesses: the PSMF logbook did not capture organizational updates between versions, the process for a (non‑medically qualified) Qualified Person for Pharmacovigilance’s (QPPV) access to a medical professional was unclear, safety information flow/timelines were not transparent, and the audit schedule in the annex was inadequate.

The MAH opened CAPAs, focusing on strengthening their overall change control process and how information is presented in the PSMF. System changes between PSMF updates were tracked independently so they can be easily captured in the next version of the PSMF logbook. QPPV documentation was clarified and made consistent between procedural documentation and the PSMF. An Individual Case Safety Report (ICSR) flowchart was created to make information pathways easier to follow, and the audit schedule was reworked to maintain compliance with GVP Module IV.

What Are the PSMF Annex Risk Areas and Root Causes?

Many avoidable inspection findings originated in the PSMF annexes: Annex B (missing/unclear agreements), Annex C (missing safety data source contact details), Annex G (inadequate audit plan), and Annex I (system changes not captured). Core issues also appeared, such as outdated SOP references and insufficient process detail, the majority were in the annexes.

The inspectors tended to categorize the major findings into 3 categories:

1. The PSMF does not adequately describe the PV system.
2. The PSMF provided was not up to date or contained outdated or incorrect information.
3. The PSMF is missing required sections or content (non-compliance with GVP Module II).

When any of these occur, the impact is not just on documentation quality; it undermines the QPPV’s ability to demonstrate oversight and control and has the potential to negatively impact patient safety.

Practical Prevention: What to Put in Place Now

Most PSMF-specific findings are avoidable if PV teams approach PSMF updates with a strict, tested process in place that works under time pressure.

Before a 7-day request is received (inspection readiness)

• Keep the document readable and easy to navigate.
• Ensure the PSMF describes the global PV system for the relevant authorisations.
• Maintain a contributor tracker (with backups) and build QC into the contribution stage.
• Limit the manual manipulation of large data sets – try to use systems to generate outputs where possible.
• Test the 7‑day process in self-inspections/audits so gaps are found early.

When a 7-day request arrives (rapid update)

• Maintain a documented 7‑day request process aligned to your routine update process.
• Have this process begin immediately with no delays. Write in actions to take place on day 0.
• Use standard templates for contributor requests, QC, and the annex table.
• Track system changes continuously so updates to the core and Annex I are quick and accurate.

The PSMF is both a compliance requirement and the PV teams' first opportunity to demonstrate continuous improvement of their system. Inspection experience shows that PSMF issues are frequently associated with major findings, especially when they indicate a poorly described PV system, which impacts QPPV and MAH oversight. Inspection readiness comes from disciplined update processes, structured contributor management, continuous tracking of system changes, and Quality Control focused on the PSMF matching operating reality at the data lock point.

David Lough is a senior pharmacovigilance consultant at ProPharma.