Graeme Ladds

 Pharmacovigilance: A Company-Wide Challenge

 Clinical Trials and Statistical Tribulations

Pharmacovigilance (drug safety) is a cornerstone activity for any pharma company, or indeed anyone conducting clinical studies on patients within academia. 

The need to operate a system of pharmacovigilance, which is both compliant to the multinational (and varied) regulations and the highest principles of patient protection, means that sometimes companies are placed in the dilemma of having products in development or on the market which do not generate many adverse events (side effects) but when they require experienced individuals to assess such reports to determine whether the reported events are indeed causally related to the company's product, their seriousness, and whether such events are known already to occur with the product (expected or unexpected).  

Once the above assessment has been performed, the company must determine who needs to know about the adverse reaction (e.g. regulatory authorities); whether the current labeling for the product (summary of product characteristics; product monograph; patient leaflet; investigator brochure) suffices or needs revision, and probably most importantly of all—can the adverse reaction be minimized or prevented from occurring in the first place (risk management strategies).  

All of the above require highly skilled and experienced individuals to perform such assessments with possible sophisticated (i.e., expensive) safety databases to record and report such events.  

No company can afford to have such individuals or equipment sitting and waiting for such events to occur, especially if the company has few products and reactions reported to it—so what is the answer? Is it safe to outsource safety?   

For companies with products in development, or for products that already have licenses (sometimes called marketing authorizations or license holders) it is legally required to have a system in place to capture; assess; and if required, report all adverse reactions that are reported to the company to the regulatory authorities. The company (in clinical trials referred to as the sponsor) must alongside the reporter make their own assessment of the seriousness, expectedness (is it in the labeling or investigator brochure), and causality of all reported events as well.  

The method of onward reporting from the company to various individuals (regulatory authorities and ethics committees) may be in paper format or may be legally required to be submitted in a specific electronic format. 

Additionally, and periodically, the sponsor may have to provide submissions to the regulatory authorities—annual safety reports in clinical trials or more frequent post marketing reports: Periodic Safety Update Reports (PSURs)—looking at all of the adverse reaction data between two time points and assess the overall benefit/risk ratio of the product to determine whether it is still favorable to provide such medicines to the intended patient population.  

Therefore, it is important for the company to have available trained safety professionals: safety scientists, pharmacists, and physicians knowledgeable in the area of pharmacovigilance to provide such assessments.  

Additionally, the company needs a checklist (Table 1) of what needs to be performed before it can determine the suitability for any third-party provider assuming the company's role for safety activities.  

Table 1. A company needs a checklist of what needs to be performed before determining the suitability of any third-party provider assuming the company’s role for safety activities. 

The list in Table 1 is not exhaustive but provides some of the key activity requirements of a license holder or sponsor. 

Looking at such a comprehensive set of requirements means that the provider of such services has to have individuals suitably trained in these areas; standard operating procedures (SOPs), to explain how such activities are performed; and evidence that the system is operating as stated and complies with the necessary legislation. 

Ultimately, in any situation where the safety aspects for the company's product (investigational or marketed) have been outsourced to a contracted company (CRO), the responsibility and accountability rests with the sponsor (in clinical trials) and the license holder (for all marketed products).

It may seem unfair that the company (in good faith) has approached the specialists in order to ensure compliance to safety legislation, but in Europe and the United States, the legislation is quite clear, the license holder or sponsor carries ultimate responsibility for patient safety. 

This means any outsourcing of safety should be viewed as an intimate partnership—a marriage. Non-communication is not an option. Outsourced does not mean out of mind. 

The only way both parties will get the most out of such a union is through active dialogue: an understanding of what is required of both parties; regular reviews (teleconferencing and face-to-face) to ensure everything is working as it should be; and most importantly, evidence (meeting notes and action items including possible sign off) of such communication. 

Compliance monitoring is required by legislation to ensure the company is reporting accurately to the various regulatory agencies, in the correct timelines, in the correct format, and with the acceptable and appropriate signatories. All of these require a system to be in place (as well as specific SOPs) that will enable the various regulatory outputs to be monitored for compliance and quality.  

Therefore, the CRO should provide the company with evidence that it has performed everything within the regulatory time frames on a periodic basis so that the company has surety of compliance. 

Any instances of non-compliance need to be investigated by both parties to ensure it cannot occur again. The company needs to be active in this area as well, especially if the reason for late submissions is because one of their marketing partners is providing information that is late and therefore placing the company's compliance in jeopardy. 

The only way to know whether the provider of safety information is capable of performing the tasks that you want is to audit them. But, how can you audit them when you may not have the internal expertise to do so? There are a number of possibilities. 

There are many individuals who perform regular audits on behalf of companies, trained in pharmacovigilance, who understand what needs to be in place. These individuals can perform the audit on behalf of the company, to ensure that the company has a report regarding the capability of the proposed pharmacovigilance supplier. The report should detail the extent of any deviation (critical, major, or minor) from legislation, from the processes described by the CRO and the company's training records concerning staff training and competency.  

Some providers may also have their own audits performed upon themselves as part of their own quality management activities. These involve the provider (CRO) getting external pharmacovigilance auditors to audit their systems (or a separate QA department with pharmacovigilance expertise in their own company) in order to determine whether the systems, training, and documentation are robust enough.  

The CRO should make the findings available to clients, or proposed clients, to provide confidence that the CRO has the appropriate systems in place. Naturally, there will be some findings from any audit. But they should never be critical failures from CROs claiming to be the experts.    

Lack of any audit by the company is not viewed favorably by the regulatory agency, but using the company's external quality management system as an approach to decide to use their services or an audit from an experienced provider is acceptable. Such audits should not be performed once and forgotten, repeat at least every two years.  

Once an audit has been performed and was successful in terms of the findings and any corrective items addressed as a result of an audit, the path is clear to appoint the CRO. 

As is often said, "the devil is in the detail." This is true concerning the contract between the company/sponsor and the CRO. There are legal elements in every document concerning terminations; judicial aspects; confidentiality; etc., as well as the financial elements, but predominantly the contract has to focus upon what do you expect the CRO to do? 

The contract has to provide the checklist of what the company wants the CRO to do, this may be all of the pharmacovigilance (and medical services) or parts of it. The contract will be used by the regulatory agency when they inspect the company, looking to see what the CRO was responsible for and what the company was supposed to do, making their findings known based upon who was responsible. 

Equally, in any audit of the CRO, it is the proposed contract that should be used for the audit because it details the expectations and services to be provided. 

Within the contract, there may be elements that are nice to have as opposed to must have—because the regulations state so. Therefore, in Europe there is one individual that is responsible for the oversight of the pharmacovigilance system, in legislation this person is referred to as the EU Qualified Person for Pharmacovigilance (EUQPPV). This is a must have for all license holders in the EU. Also, the EUQPPV must be "trained in all aspects of pharmacovigilance." This is not an option and not a position a company should attempt to support by itself. If the company does not have such an individual working for it, asking someone to take on this role is not correct. The EUQPPV must be registered with the Regulatory Agencies too. The EUQPPV also has to have available a suitably qualified deputy. The contract should clearly state who covers which activities, and should specify what products are covered by the agreement and the current status with regard to license submissions.  

In Europe it is mandatory to report adverse reactions electronically, whereas in the United States this is not yet mandated but encouraged. Likewise, reporting adverse reactions in Japan is required to be in electronic format and mandatory. 

Regulators in inspections make no differentiation between generic companies, herbals, over-the-counter, or innovator companies. The level of compliance to the legislation and the processes to report and assess potential safety issues with the products is the same. The contract is an essential element of this and would cover all of this for the various company product portfolios.  

 Large companies with extensive product portfolios tend to have their own safety systems in place but still require from time to time, additional resources for specific projects: data entry and case processing, PSUR writing, risk management activities, temporary cover for maternity leave, secondments to other affiliates, etc. 

Since this is more person oriented rather than process, the key element here is can the person perform the required task(s)? Are they trained already to perform these activities?  

This is where the CRO should be able to provide a copy of the person's training record to demonstrate their experience in the area they are being asked to perform. Copies of such training should remain with the company, together with any additional training on company processes in order to perform the activities the way the company does. 

Additionally, companies may outsource some of their safety to a CRO because they have old products that do not generate much safety work but still require management. Some of the safety for a company's products is fully outsourced to a CRO allowing the existing pharma staff to focus their energies on new product launches that due to a lack of time have been marketed or the full safety profile has not been established because of low patient exposure.  

Equally, before outsourcing to the CRO, another aspect to competency has to be considered: capacity. Can the CRO cope with the new workload being provided to them? No one likes to say no to new business but there has to be an appreciation of competency and capacity. If capacity is exceeded, competency declines. 

Therefore, for any outsourced activities the company has to be clear on whether this will now exceed the capabilities of the CRO. 

Articles

Knowing when to outsource and when to conduct pharmacovigilance in-house is a crucial decision.

Graeme Ladds

Articles

Is It Safe to Outsource Safety?