Risk-Based Vendor Oversight: Governance in Global Pharmacovigilance

Abstract

Pharmacovigilance (PV) has been transformed into a function that is spread across the globe and in which marketing authorization holders (MAHs) outsource many safety related activities to vendors, CROs and specialist service providers. While it provides scalability and expertise, it introduces a governance paradox: accountability for compliance and patient safety can't be delegated, despite execution being spread across various parties with maturities and geographical locations that differ. This review will explore how risk-based vendor oversight can be viewed as a governance framework for global PV, incorporating regulatory expectations, quality risk management principles and the newly developing practice of continuous, intelligence-led assurance. We suggest that this could be achieved through a three-part theoretical model in which accountability for MAH remains while a multi-factor risk-stratification engine determines the level of oversight required based on vendor and activity risk, and a continuous feedback loop recalibrates the level of oversight based on signals of performance. The literature contains directionally mixed evidence that risk tiered oversight focuses oversight on high-risk vendors and that continuous monitoring results in compliance outcomes while periodic auditing results in a longer delay between the onset and detection of underperformance. We also identify a key current missing piece, the lack of standardized and prospective metrics of outcomes to assess PV vendor management, which limits evidence to observational and program-evaluation settings. This review will serve as a practical tool for PV professionals, quality managers and researchers to improve governance in today's sophisticated, globalized drug safety landscape.