The short version
What teams need to understand
- Pharmacovigilance vendors must be periodically requalified to confirm continued suitability.
- Requalification must include review of performance metrics, audit outcomes, and CAPA effectiveness.
- The frequency of requalification must be risk-based and aligned with vendor criticality.
- Changes in vendor processes, systems, or performance must trigger reassessment.
- Requalification decisions must determine whether the vendor remains acceptable, requires increased oversight, or should be replaced.
- Inspection-ready evidence must demonstrate that vendor suitability is actively maintained over time.
Regulatory expectation
What regulators expect
Each expectation should be supported by controlled documentation, traceable records, clear ownership, and evidence that the process works in practice.
- Vendors must be periodically reassessed for continued suitability.
- Requalification must consider performance, audits, and CAPA.
- Risk classification must be updated where necessary.
- Vendors must not continue operating without ongoing evaluation.
- The MAH must demonstrate continuous control of outsourced activities.
Why it matters
What this means in practice
Inspectors assess whether pharmacovigilance vendors are periodically re-evaluated and managed throughout their lifecycle. They typically review requalification activities, performance trends, audit findings, CAPA effectiveness, and evidence that vendors remain suitable over time.
Questions this page answers
Inspection evidence
Evidence teams should be able to show
Vendor Requalification Records
- Documented requalification assessments
- Updated risk classification
- Requalification decision records
- Approval or continuation sign-off
Performance Review Outputs
- Trend analysis of KPI performance
- Review of timeliness and quality metrics
- Evidence of performance stability or decline
- Summary of performance over review period
Audit and CAPA Evaluation
- Audit findings from previous periods
- CAPA plans and implementation status
- Verification of CAPA effectiveness
- Closure evidence for identified issues
Change Management and Reassessment Triggers
- Changes in vendor processes or systems
- Significant personnel changes
- New services or expanded scope
- Regulatory inspection findings impacting vendor
Approved Vendor List Updates
- Updated vendor status and risk level
- Documentation of continued approval
- Removal or suspension of vendors
- Revision history of vendor list
Regulatory Basis (Primary Sources)
- GVP Module I - requirement for continuous oversight of pharmacovigilance systems
- GVP Module VI - need for ongoing control of safety data processes
- ICH E2D - maintaining compliant safety systems over time
- MHRA GPvP guidance - expectations for ongoing vendor oversight
- FDA pharmacovigilance guidance - continued responsibility for outsourced activities
Typical Inspection Questions (What Inspectors Ask)
- How do you ensure your vendors remain suitable over time?
- When was this vendor last requalified?
- What performance data was used to reassess this vendor?
- What happens if a vendor no longer meets requirements?
- Show me evidence of vendor requalification decisions.
Common failure patterns
What good looks like
- Defined and documented requalification process.
- Regular review of vendor performance and audit outcomes.
- Clear decision-making on vendor continuation or escalation.
- Evidence of CAPA effectiveness before continuing vendor use.
- Updated vendor records reflecting current status and risk level.
How teams operationalise it
- Define a requalification cycle based on vendor risk level.
- Review KPI performance, audit findings, and CAPA outcomes regularly.
- Trigger reassessment when significant changes occur.
- Document requalification decisions and approvals.
- Update vendor lists and risk classifications accordingly.
- Escalate or terminate vendor relationships where necessary.
From expectation to working control
Find the documentation that supports this work
Review the related toolkit to understand its purpose, included files, and how it supports this regulatory expectation.
Frequently asked questions
What is vendor requalification in pharmacovigilance?
Vendor requalification is the process of reassessing a vendor’s suitability over time based on performance, compliance, audit results, and risk profile.
How often should vendors be requalified?
Requalification frequency is typically risk-based, with high-risk vendors reviewed more frequently, often annually.
What triggers vendor requalification?
Triggers include performance issues, audit findings, CAPA outcomes, changes in vendor processes, or regulatory events.
Do inspectors review vendor requalification?
Yes. Inspectors assess whether vendors are reassessed and whether continued use is justified based on evidence.
What happens if a vendor fails requalification?
The vendor may require increased oversight, remediation, or termination depending on the severity of the issues.
Why is vendor lifecycle management important?
Lifecycle management ensures that vendors remain compliant and capable over time, reducing regulatory risk and maintaining PV system integrity.
How do you decide whether a pharmacovigilance vendor should be requalified, escalated, or removed?
The decision is based on a documented review of vendor performance, audit outcomes, CAPA effectiveness, risk classification, and any significant operational or regulatory changes. Vendors may be continued, placed under increased oversight, remediated, or removed depending on the level of risk and unresolved compliance concerns.
Source boundary
Regulatory sources
These primary sources inform this structured interpretation. Always confirm current requirements against the original source and the requirements applicable to your organisation, product, and jurisdiction.
European Medicines Agency (EMA)
Guideline on good pharmacovigilance practices (GVP) - Module I
View sourceGuideline on good pharmacovigilance practices (GVP) - Module VI
View source
FDA
Postmarketing Safety Reporting
View source
ICH
Post-Approval Safety Data Management (E2D)
View source
MHRA
Good Pharmacovigilance Practice (GPvP)
View source