Pharmacovigilance Compliance – What to Expect from Future EU GVP Updates

Recent years have brought continued evolution of the EU pharmacovigilance framework, including the revision of GVP Module XVI (Risk Minimisation Measures) in 2024 and GVP Module III (Pharmacovigilance Inspections) in 2026. These updates reflect an increasing regulatory focus on risk-based oversight, outsourcing arrangements, inspection readiness, and overall pharmacovigilance system governance. While only selected modules have been revised to date, recent regulatory developments may provide valuable insight into the direction of future updates and areas that could benefit from further clarification and harmonisation.

Combining insights from recent regulatory developments with our experience assessing a wide range of pharmacovigilance systems, this article highlights opportunities for further alignment that could strengthen compliance and support best practices across the industry.

In particular, we explore two topics that may attract greater regulatory attention in the future: third-party oversight and deviation management.

Audits and Partner Oversight

Risk Assessment Questionnaires: Supporting Tool or Audit Second Best?

‍The increasing reliance on outsourced pharmacovigilance activities has renewed the discussion on how Marketing Authorisation Holders (MAHs) should oversee their partners and service providers.

Although GVP Module I allows for "other methods of control and assessment" alongside riskbased audits, the regulatory expectation remains clear: oversight activities must provide assurance that subcontracted pharmacovigilance activities comply with applicable requirements. Recent legislative updates (Implementing Regulation (EU) 2025/1466) have further reinforced the expectation that all pharmacovigilance activities, including those performed by third parties, are subject to appropriate audit coverage.

This raises an important question: can risk assessment questionnaires replace audits?

In practice, questionnaires are valuable tools for gathering information, assessing risk, and supporting oversight activities. However, they rely largely on self-reported information and allow organisations time to prepare responses and select supporting documentation of their choosing. As a result, they do not provide the same level of independent verification as an audit.

During an audit, the auditor can challenge responses, review source documentation through real-time access, follow audit trails, and adapt lines of questioning based on observations made during the assessment. This flexibility often uncovers issues that may not be identified through predefined questionnaires alone.

GVP Module IV reflects this distinction by stating that benchmarking exercises, surveys, questionnaires, and similar activities that do not independently obtain and evaluate evidence should not be regarded as audits.

A Risk-Based Partnership

‍Risk assessment questionnaires nevertheless play an important role within an effective oversight programme. When used correctly, they help identify higher-risk partners, support audit planning, and contribute to a risk-based allocation of audit resources.

Rather than replacing audits, questionnaires should complement them. Together, they provide a balanced and efficient approach to third-party oversight, combining continuous monitoring with independent verification.

Deviation Management

While oversight and auditing have received increasing regulatory attention in recent years, deviation management remains a comparatively less defined area within the EU GVP framework. Nevertheless, it plays a critical role in maintaining an effective pharmacovigilance quality system and may benefit from further clarification in future updates.

Overall Limited Regulatory Guidance

‍The management of pharmacovigilance deviations remains an area where additional regulatory guidance would be welcome. Within the EU GVP framework, the only explicit reference to this process is found in Module I.B.11, which recommends that deficiencies and deviations are monitored, that corrective and preventive actions (CAPAs) are implemented, that appropriate solutions are applied, and that the effectiveness of those actions is verified.

Given the limited regulatory direction available, greater clarification and standardisation would support MAHs and other stakeholders in establishing more consistent and effective deviation management systems.

Deviation grading is another area that would benefit from further harmonisation. Although EU GVP Module IV provides guidance into the classification of audit findings, equivalent guidance for the assessment and grading of deviations is less developed. Additional clarification on severity classification criteria and their link to investigation and CAPA requirements would support a more consistent and risk-based approach to deviation management across the industry.

Looking Ahead

Recent updates to the GVP Module III suggest that regulatory authorities are placing greater emphasis on risk-based oversight, outsourcing arrangements, and overall pharmacovigilance system governance.

As the GVPs continue to evolve, questions may arise as to whether current approaches to deviation management, third-party oversight, and pharmacovigilance quality systems are sufficiently robust to meet increasing regulatory expectations.

Will the next wave of GVP updates address these challenges?  

With increasing regulatory scrutiny of quality systems, outsourcing oversight, and risk-based compliance, the signs suggest that these topics may soon receive greater attention from regulators.

If you would like to learn more about these topics, strengthen your third-party oversight programme, develop a risk assessment methodology to support an audit programme, or explore how our audit services can support your organisation, please feel free to contact us. We would be pleased to become your trusted partner in pharmacovigilance auditing and compliance.