How do you build a GVP-compliant pharmacovigilance system that holds up under a regulatory inspection?
We build and operate pharmacovigilance systems in line with the EMA's GVP modules, from the Pharmacovigilance System Master File (PSMF) through ICSR/SAE management and Eudravigilance reporting to signal management under Module IX and the PSUR under ICH E2C(R2). The real sticking point is rarely the individual document, it is consistency: PSMF, RMP, signal log and PSUR must all describe the same safety picture. Contradictions between them are the most common inspection finding, not missing documents.
- Pharma
- Biotech
Overview
What does GVP require of the marketing authorisation holder?
Coverage of all GVP modules · Directive 2001/83/EC, Regulation (EC) 726/2004, GVP Modules I-XVI, ICH E2C(R2)/E2D
Last updated: 2026-06-12
The EMA's Good Pharmacovigilance Practices (GVP) give concrete shape to the pharmacovigilance obligations set out in Directive 2001/83/EC and Regulation (EC) No 726/2004. Four strands must stay aligned over time:
- A documented PV system with a quality system under GVP Module I, whose structure and responsibilities are reflected at all times and kept current in the Pharmacovigilance System Master File (PSMF) under Module II.
- A nominated Qualified Person for Pharmacovigilance (QPPV) with personal responsibility for the system, required by Art. 104 of Directive 2001/83/EC and Implementing Regulation (EU) No 520/2012.
- Timely ICSR collection, MedDRA coding and reporting to Eudravigilance under GVP Module VI, together with signal management under Module IX as an ongoing, documented process.
- A Risk Management Plan (RMP) under Module V and periodically submitted PSURs under Module VII and ICH E2C(R2), as a coherent benefit-risk assessment rather than isolated mandatory documents.
Services
How we support you
PV System & PSMF
Setting up the PV system with a quality system under GVP Module I and preparing the Pharmacovigilance System Master File under Module II, including annexes and a change log to provide evidence during inspection.
QPPV & Deputy
Staffing the Qualified Person for Pharmacovigilance under Art. 104 of Directive 2001/83/EC, EU-resident, with a documented back-up and registration in the EMA Article 57 database.
Learn more →ICSR & SAE Management
A process for case intake, medical assessment, MedDRA coding and timely Eudravigilance reporting under GVP Module VI and ICH E2D, with traceable deadline tracking.
Signal Management
A structured signal detection and management process under GVP Module IX with a signal log, validation and a documented assessment for each period.
Learn more →RMP & PSUR/PBRER
A Risk Management Plan under GVP Module V and a PSUR/PBRER under Module VII and ICH E2C(R2) with an integrated benefit-risk assessment drawing on ICSR, study and literature data.
Learn more →Audit & Inspection Readiness
A mock inspection against the GVP modules, a consistency check across PSMF, RMP, signal log and PSUR, plus a CAPA plan to close the gaps identified.
How we work together
What it comes down to
Pharmacovigilance rarely fails on a single missing document, but on consistency across the lifecycle. Four strands must describe the same safety picture, and in the right order: the PSMF under GVP Module II maps the architecture of the system. The RMP under Module V defines the known and potential risks together with their minimisation measures. Signal management under Module IX continuously checks whether new risks are emerging. And the PSUR under Module VII and ICH E2C(R2) brings all of this together into a benefit-risk assessment. Maintaining any one of these strands in isolation creates contradictions, and that is exactly what the authority reads as a lack of system control.
On top of this comes the time factor, which works differently here than in an authorisation: the PV system has no end state but rather a continuous operation with hard deadlines. ICSRs must be reported to Eudravigilance on time from Day 0, signals must be documented continuously and PSURs submitted on the EURD data lock points. That is why we start early with the sequence: first the gap analysis against the GVP modules, then a maintained PSMF and a reachable QPPV as the foundation, before the ICSR process, signal log and PSUR cycle are built on top. This creates the end-to-end trail that counts during inspection.
Our approach
Our approach
Step
Result
Gap analysis against GVP
A prioritised gap list: where the PV system stands against GVP Modules I-XVI and what is inspection-critical.
PSMF & QPPV
A current PSMF under Module II, a nominated QPPV under Art. 104 with a back-up and correct registration in the EMA databases.
ICSR process & Eudravigilance
An established case workflow with MedDRA coding and demonstrable compliance with Eudravigilance reporting deadlines under Module VI.
Signal & RMP
An ongoing signal management process under Module IX with a signal log and a current RMP under Module V.
PSUR cycle
A PSUR/PBRER under Module VII and ICH E2C(R2), submitted on time for the EURD data lock point.
Inspection readiness
A consistent documentation set across PSMF, RMP, signal and PSUR; open CAPAs worked off and tracked to closure.
Common pitfalls
Where projects commonly fail
The PSMF is no longer maintained once it has been built.
GVP Module II requires the PSMF to reflect the actual state of the PV system at all times; outdated annexes, for example on outsourced activities or QPPV changes, are a classic inspection finding because the document diverges from the process as it is actually run.
The QPPV is nominated on paper only.
Under Art. 104 of Directive 2001/83/EC, the Qualified Person for Pharmacovigilance carries personal responsibility and must be EU-resident and genuinely reachable; a QPPV without system access, without a back-up or without correct registration in the EMA databases will not hold up under inspection.
Eudravigilance reporting deadlines are managed without robust tracking.
GVP Module VI requires timely reporting of ICSRs (serious cases generally within 15 days, non-serious within 90 days); without clear deadline calculation from Day 0 and traceable tracking, late reports arise that can no longer be explained after the fact.
Signal management is treated as an annual exercise rather than an ongoing process.
Under GVP Module IX, signal detection must be carried out continuously and documented; an empty or back-dated signal log between two PSUR cycles shows the authority that the process is not actually being run.
PSMF, RMP, signal log and PSUR contradict each other.
If the documents describe different safety concerns, risk minimisation measures or responsibilities, the authority reads this as a lack of system control; the contradiction between documents weighs more heavily than a single gap.
FAQ
Frequently asked questions
Sources
- Directive 2001/83/EC (Community code relating to medicinal products for human use) - primary text, in particular Art. 101, 104, 107 et seq.
- Regulation (EC) No 726/2004 - centralised authorisation and pharmacovigilance via the EMA
- Implementing Regulation (EU) No 520/2012 - performance of pharmacovigilance activities
- EMA Good Pharmacovigilance Practices (GVP) - Modules I, II, V, VI, VII, IX
- ICH E2C(R2) (PBRER) and ICH E2D (Post-Approval Safety Data Management)
- Writer source file: output/expertise-pages/clinical-medical-affairs/pharmacovigilance/pharmacovigilance.md
- https://theentourage.de/expertise/pharmacovigilance/ (existing page content, revised)
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Regulations & standards considered
- Directive 2001/83/EC (Community code relating to medicinal products for human use)
- Regulation (EC) No 726/2004 (centralised authorisation & EMA)
- Implementing Regulation (EU) No 520/2012 (performance of pharmacovigilance activities)
- GVP Module I (Pharmacovigilance systems and their quality systems)
- GVP Module II (Pharmacovigilance System Master File, PSMF)
- GVP Module V (Risk Management Systems, RMP)
- GVP Module VI (Collection, management and submission of ICSRs)
- GVP Module VII (Periodic Safety Update Report, PSUR)
- GVP Module IX (Signal Management)
- ICH E2C(R2) (PBRER/PSUR)
- ICH E2D (Post-Approval Safety Data Management)
- MedDRA (Medical Dictionary for Regulatory Activities)
Related topics
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences