Good Pharmacovigilance Practice: Risk-based inspections

Background
Over the past few years, in the UK there have been significant developments in inspection risk management and the strategies of a number of regulators were reviewed by the MHRA.

It is considered that the scope, frequency and depth of inspections should be dependent on how the regulated organisation takes responsibility for compliance with the regulations. While the company or organisation has always had legal responsibility for compliance, the notice of inspection has for some been a trigger for compliance assessment instead of a continuous compliance programme being in place.

Following a detailed review of risk-based inspection models used by a range of organisations, a draft model was designed to cover all GxP inspections, however, at implementation it is envisaged that there will be a different emphasis within the individual elements as appropriate to the different GxPs.

Risk-based inspection process
The GPvP risk-based inspection process commenced for all UK marketing authorisation holders (MAHs) from 1 April 2009.

A UK marketing authorisation holder is considered to be any organisation that holds an authorisation which enables it to place a product on the UK market. This includes national, mutual recognition, decentralised and centralised licences. The country location of the organisation does not determine whether or not they are a UK MAH. The risk-based inspection process uses information provided to the MHRA on the Compliance Report to determine an organisation’s risk and internal information about previous inspection history, organisation change and the results of intelligence to determine an organisation’s control of its risk. The amount of control is subtracted from the risk to determine a risk assessment score.

The resulting risk assessments will be ranked and inspections prioritised for the companies with the highest risk assessment scores. Inspections will be planned according to how much inspection resource is available in the upcoming year.

The completion of the Compliance Report by MAHs is not mandatory. However, MAHs should be aware that failure to submit a completed report will be assessed as a high-risk answer to all questions.

Control will be assessed as normal and the resulting risk assessment rank assigned accordingly. The results of the risk assessment will be provided to the organisation. If there are any concerns regarding the risk assessment this should be sent to the GPvP risk based inspection mailbox (gpvpriskbasedinspections@mhra.gsi.gov.uk).

 
Compliance report
Marketing authorisation holders will be encouraged to complete a Compliance Report as a biennial activity. An updated version of the Compliance Report for 2011 is now available on this webpage.

MAHs are requested to complete the updated Compliance Report and submit this to the GPvP risk based inspection mailbox (gpvpriskbasedinspections@mhra.gsi.gov.uk) in electronic form by 4 November 2011. Please note that the updated Compliance Report for 2011 is only available in MS-Excel format and there is no MS-Word option this year. The MS-Excel file contains both the questions that are to be completed and also guidance notes which should help to clarify the information that needs to be provided.

The following key points should be noted:

• only one Compliance Report should be completed per pharmacovigilance system
• every question should be answered (a failure to do so will result in a maximum risk score being assigned for that question)
• the Compliance Report should be completed even if you are not currently marketing product in the UK
• when the Compliance Report has been completed this should be saved as an MS-Excel file with a standard file name – ‘Company Group Name’ (DD-MMM-YYYY)
• when the Compliance Report is submitted to the risk based inspection mailbox a standard email subject header should be used – RBI 2011 ‘Company Group Name’

GPvP compliance report (226Kb)

Inspection process
The inspection process will be largely indistinguishable from that operated in recent years. Once the risk assessment has been determined and an inspection scheduled, MAHs will be contacted and requested to complete the Summary of Pharmacovigilance Systems (SPS) as previously.

The reason for continuing with provision of the SPS is that this contains the detailed information about how the organisation operates, which is used for inspection preparation rather than planning. The inspection will then be undertaken as previously and will conclude as usual with a closing meeting where findings are verbally reported to MAH contacts.

Any questions or comments on risk-based inspections should be addressed to the GPvP risk-based inspection mailbox in the first instance.