In our experience, a pharmacovigilance (PV) vendor selection is decided before the first proposal arrives. If the request to the market is vague, the proposals that come back describe different services, and the cheapest one tends to win. Within one to two years the company questions the decision and may pay for a second selection.

This guide is for Heads of Safety and EU-QPPVs at pharma and biotech companies replacing a PV provider, typically because the current one cannot keep up, a marketing authorisation application is ahead or an acquisition has changed the portfolio. Companies outsourcing PV for the first time face the same decisions with less in place. It covers what stays your responsibility, what to decide before the RFP, how to win management support, how to compare proposals and how to document the choice.

Key takeaways

• When a company outsources PV tasks, the marketing authorisation holder keeps full responsibility for the PV system, its quality system and the pharmacovigilance system master file (GVP Module I).
• The decisions that determine the outcome of a PV vendor selection are made before the request for proposal: scope, what stays in-house, the guardrails for quality, cost, database and regions, and who owns the decision.
• Management support depends on a risk view of each option, including the option of changing nothing.
• PV vendor proposals can only be compared if the request for proposal describes the service precisely enough that every bidder prices the same work.
• A documented selection, a qualification audit and an updated pharmacovigilance system master file are the first evidence of vendor oversight in an audit or inspection.

What stays with your company when you outsource pharmacovigilance?

Responsibility stays with you, in full. A PV vendor is any third party that performs pharmacovigilance activities on behalf of the marketing authorisation holder (MAH): hosting the safety database, processing Individual Case Safety Reports (ICSRs), screening literature, writing periodic safety update reports (PSURs), maintaining the pharmacovigilance system master file (PSMF), or providing local PV contacts and the qualified person responsible for pharmacovigilance (QPPV).

EU law allows the MAH to subcontract PV activities, but the responsibility stays where it was. The MAH remains accountable for the PSMF and for making sure an effective quality system covers the subcontracted work (Implementing Regulation (EU) No 520/2012, Articles 6 and 11). GVP Module I is explicit that the ultimate responsibility for the PV system always remains with the MAH. Every subcontracted activity is described in the PSMF, and the contracts are listed in its annex. The same principle holds for the QPPV role: appointing a QPPV does not transfer the responsibility either.

In practice, outsourcing moves the operational work out of the building. Oversight, quality review and vendor governance stay inside it, and they need people with time. Many PV departments are thinly staffed before the outsourcing starts, and running a selection on top of daily operations is where we most often see teams stretched beyond what they can sustain.

Which pharmacovigilance activities do companies usually outsource?

Growing companies usually outsource the volume-driven work and keep the work that carries medical judgement. In some of our projects, the split tends to look like this:

What should you decide before you approach any PV vendor?

Decide four things first: the scope, the sourcing split, the guardrails and who owns the decision.

The scope is a written description of the current state and the target. It names the products, territories, clinical and post-marketing activities, expected case volumes and the events of the next two to three years, such as a marketing authorisation application, a product acquisition or a new market. Our blueprint for PV system development under growth pressure sets out how to anticipate these pressure points. Pinpoint where the coming volume would break today's set-up. A general sense that the current provider is overloaded does not give you enough to write a request for proposal.

The sourcing split decides what stays in-house, what goes out and what should be solved differently, for example by automating a manual step. It also gives management a risk view: what the company takes on with each option, and what risk it carries if it decides against an investment.

The guardrails are the constraints every proposal will be measured against: the balance between quality and cost, the preferred database and hosting model, the regions to be covered, and clinical versus post-marketing scope.

Ownership comes next, because a PV vendor decision touches IT, quality, procurement and the QPPV. GVP Module I (I.C.1.1) expects the QPPV to be informed early and involved in preparing contractual arrangements that affect the PV system. In one selection we supported, the IT function opened its own talks with a database provider without PV input, and the team spent weeks reconciling competing options. Agree on one owner and one process before anyone calls a vendor.

SOLUTION-FIRST BIAS A service provider asked what you need will find a need for what it sells. Ask whether it would ever advise you to buy less from it.

The most common shortcut is to ask a preferred vendor to scope the work. That says nothing about the vendor's integrity; a provider cannot give neutral advice about its own portfolio. The same applies to advisers who sell software, host databases or receive referral fees. Ask every adviser directly whether they have a commercial relationship with any provider on your list.

How do you make the case to management?

Put a risk on each option, including the option of changing nothing. Management often treats a PV vendor selection as a purchasing exercise and judges it on price, because the proposals look alike from a distance. A risk view changes the conversation. What happens to reporting timelines if case volumes rise after the marketing authorisation and the current provider cannot scale? What would a second selection in two years cost in fees, internal time and another transition? Which inspection findings become likely if nobody in-house has time to oversee the new provider?

A Head of Safety who has raised these points before may find they carry more weight from an independent source with no budget interest of its own. In our experience, an external assessment often gets a hearing for arguments the internal experts have already made. Keep it to one page: the trigger, the options, the risk each one carries, and the date by which the company has to decide.

How do you write an RFP that produces comparable proposals?

Describe the service so precisely that every bidder has to price the same work. A request for information (RFI) narrows the market to providers with the right capabilities. The request for proposal (RFP) then describes the work in volumes, deliverables, timelines, interfaces and quality expectations, and asks for prices against defined units. Bid defence meetings follow, in which the shortlisted providers present their proposals and answer your questions, and the selection closes the process.

When the RFP is vague, each provider fills the gaps with its own assumptions. In one selection we were brought into, the sponsor had received proposals for PV services, each including a safety database, that sat far apart on price. Read closely, each provider had excluded different parts of the work, and anything excluded would have been charged on time and materials. The fixed prices covered different scopes, the real cost of either offer was impossible to predict, and the proposals could not be compared until the scope was aligned. To senior management, PV proposals look alike, and every provider describes itself as the best fit. A precise RFP is what makes the differences visible.

How should you compare PV vendor proposals beyond price?

Score every proposal against criteria fixed before the proposals arrive, with price as one criterion among several. Choosing on price after an imprecise request is the pattern we see most often behind early re-tendering. Within one to two years the company may question the decision, then pay either to bring the provider up to the expected standard or to run the selection again.

The weighting follows from the guardrails. A company two years from its first marketing authorisation will weigh scalability differently from one with three products on the market and a full development pipeline.

How do you make the selection defensible in an audit or inspection?

Keep a record of each step, from the decision to the first months of operation. Auditors and inspectors assess how the MAH oversees subcontracted work, and that evidence starts with the selection. We use seven steps.

‍

1. Decision record: Documenting why this provider. Scope, guardrails, criteria, scores and the reasons for the choice, approved by the accountable people, including the QPPV.
2. Qualification audit: Verifying the provider before go-live. An audit of the selected provider against the contracted scope. A letter of intent (LOI) governs the audit until the master services agreement (MSA) is signed. GVP recommends regular risk-based audits of subcontracted organisations and expects the audit strategy to cover delegated activities.
3. Contracting: Defining tasks, data exchange and timelines. GVP Module I expects the contract to describe the delegated tasks and data exchange in detail, including timelines, database maintenance and how compliance with the arrangements is checked.
4. Onboarding and implementation: Preparing both organisations for go-live. Processes and SOPs developed or adapted, staff on both sides trained, and safety data exchange, KPIs, escalation routes and meeting cadence in place before the first case reaches the new provider.
5. Data migration: Moving the safety data (if the database changes). A migration plan, data mapping, a validated transfer and reconciliation of legacy cases, documented as part of the transition.
6. PSMF update: Recording the change. GVP Module II requires the description of subcontracted activities, the list of contracts in the annex and a logbook entry to be updated. The QPPV is notified when significant services move to a third party.
7. Oversight: Reviewing performance on a risk basis. Regular KPI review, audits planned on risk, and the lessons of this transition captured for the next one.

Frequently asked questions

How long does a PV vendor selection take?

In our projects, a PV vendor selection takes two to six months, depending on the kind of vendor, the size of the company and the complexity of the scope. Plan backwards from the date the new provider must be live. Allow for the notice period in the current contract, the qualification audit, and data migration if the database changes. Companies that start when the current provider is already failing usually have the least time for the steps that matter most.

How many PV vendors should we invite to the RFP?

Three to four. With many more, the evaluation becomes expensive for your team and for the bidders. A lightweight RFI beforehand helps you choose which three or four to invite.

Do we need a qualification audit before go-live?

GVP does not use the term, but the MAH must ensure that an effective quality system is applied to subcontracted tasks (Implementing Regulation (EU) No 520/2012, Article 11(2)), and GVP Module I (I.C.1.5) recommends risk-based audits of the organisations involved. An audit before go-live is the most direct way to show that you checked the provider before relying on it.

Can the PV vendor also provide our EU-QPPV?

Yes. GVP Module I explicitly allows the QPPV role to be subcontracted, and the QPPV must live and work in the EU or EEA (Directive 2001/83/EC, Article 104). Responsibility stays with the MAH. If the QPPV comes from the provider whose work they oversee, two points need attention. The first is independence: the MAH must give the QPPV sufficient authority to influence the performance of the quality system (Implementing Regulation (EU) No 520/2012, Article 10), and that quality system covers the provider's work. The second is the conflict of interest that arises when the QPPV is employed by the organisation they are meant to oversee. Your MAH policy should address both, for example by setting out how conflicts are declared and escalated and how your own team reviews the provider independently of the QPPV.

Should the database and the services come from the same provider?

Decide this before the RFP. It is a strategic choice that shapes the whole selection: which providers you invite, how the RFP is structured and how the proposals are compared. It belongs with the guardrails, and it depends on how you weigh simplicity against dependence. One provider means one contract and fewer interfaces. It also means that replacing the service provider later may force a database migration. Whichever you choose, agree in the contract how your data is returned and how a transition to another provider works.

Making the decision

Most of the effort in a good PV vendor selection belongs before the first vendor call: a written scope, an agreed sourcing split, clear guardrails, management support and one owner. With those in place, the RFP produces proposals you can compare, and the records you build along the way become the oversight evidence an inspector will ask for. The question for your team is whether that groundwork exists today.

If you are preparing to replace a pharmacovigilance provider or to outsource for the first time, we run PV vendor selections from scoping to qualification audit. We do not sell PV Services, software or hosting, and we take no referral fees from providers. Book an introductory call or read more about the help we can provide.

ABOUT THE AUTHOR

Stefan Brüning is Co-Founder and Advisory Practice Lead at VIGINEXT, based in Germany. For over 14 years, he worked across CRO, pharma and biotech. He helps small and mid-size pharma and biotech companies build and restructure their PV systems, with a focus on outsourcing: developing outsourcing strategies, managing RFI and RFP processes, selecting and qualifying vendors, implementing new providers and safety databases, and preparing teams for audits and inspections.

Stefan holds a diploma in biology (Dipl.-Biol.) and an MBA, and is certified as PMP®, PMI-CPMAI™ and IMCM®. He is a member of the International Society of Pharmacovigilance (ISoP) and the Research Quality Association (RQA). Connect with Stefan on LinkedIn.

Sources

1. Commission Implementing Regulation (EU) No 520/2012 of 19 June 2012 on the performance of pharmacovigilance activities provided for in Regulation (EC) No 726/2004 and Directive 2001/83/EC, Articles 3(3), 6(1), 10(2) and 11(2). https://eur-lex.europa.eu/eli/reg_impl/2012/520/oj/eng
2. Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001 on the Community code relating to medicinal products for human use, Article 104(3). https://eur-lex.europa.eu/eli/dir/2001/83/oj/eng
3. European Medicines Agency. Guideline on good pharmacovigilance practices (GVP), Module I: Pharmacovigilance systems and their quality systems (EMA/541760/2011, in effect since 2 July 2012), sections I.C.1.1 and I.C.1.5. https://www.ema.europa.eu/en/documents/scientific-guideline/guideline-good-pharmacovigilance-practices-module-i-pharmacovigilance-systems-and-their-quality-systems_en.pdf
4. European Medicines Agency. GVP Module II: Pharmacovigilance system master file (Rev 2, in effect since 31 March 2017), sections II.A, II.B.2.3, II.B.4.2, II.B.4.8 and II.B.5. https://www.ema.europa.eu/en/documents/scientific-guideline/guideline-good-pharmacovigilance-practices-module-ii-pharmacovigilance-system-master-file-rev-2_en.pdf
5. European Medicines Agency. GVP Module IV: Pharmacovigilance audits (EMA/228028/2012 Rev 1, in effect since 12 August 2015), section IV.B.2.1. https://www.ema.europa.eu/en/documents/scientific-guideline/guideline-good-pharmacovigilance-practices-gvp-module-iv-pharmacovigilance-audits-rev-1_en.pdf

This article reflects VIGINEXT's expert opinion and does not constitute legal or regulatory advice.

‍

‍