Post-market drug safety monitoring — ICSR adverse-event reporting, signal management, Risk Management Plans, and PSURs, with real EU/UK divergence (Windsor Framework, QPPV residency, dual ICSR routing).

GVP — Good (Pharmaco)vigilance Practice (EU & UK) — Regscribe Audit-Readiness Rubric v0

What this is: Good Vigilance Practice (also referred to as Good Pharmacovigilance Practice, "GVP" in the EU, "GPvP" in MHRA's own usage) is the regulatory framework governing post-market drug safety monitoring — everything that happens after a medicine already has a marketing authorisation. It covers: collecting and reporting suspected adverse reactions as Individual Case Safety Reports (ICSRs); detecting, evaluating and acting on safety signals; maintaining a Risk Management Plan (RMP) that plans and tracks risk-minimisation measures; producing Periodic Safety Update Reports (PSURs, called PBRERs under the ICH-harmonised template) that periodically re-assess a product's benefit-risk balance; keeping a Pharmacovigilance System Master File (PSMF) that describes the whole system; and appointing a Qualified Person for Pharmacovigilance (QPPV) who is personally accountable for it. This is a genuinely different domain from every other Regscribe rubric to date: GMP/Annex 1/Annex 11 check how a product is made and its systems controlled, GCP/ICH E6 checks how a trial is conducted, PMCPA/ABPI checks what a company says about a medicine to whom — this rubric checks what a company does to keep watching a medicine's safety once it's already on the market and being used by patients, against documents like ICSR case narratives, RMPs, PSURs/PBRERs, signal evaluation reports, and PSMF sections.

Sourcing note — read before using this in production scoring: the module-by-module clause text below was fetched directly from the European Medicines Agency's own published GVP module PDFs (ema.europa.eu/en/documents/...), downloaded and converted to text with pdftotext -layout — the same extraction method used for the PMCPA/ABPI rubric's Annual Report and the Annex 11 rubric's MHRA deficiency data, not a secondary summary. Specifically fetched and read in full text:

GVP Module VI (Rev 2, EMA/873138/2011 Rev 2, effective 22/11/2017) — ICSR collection, management, submission
GVP Module VII (Rev 1, EMA/816292/2011 Rev 1, effective 9 December 2013 / first version effective 2 July 2012) — PSUR
GVP Module V (Rev 2, EMA/838713/2011, effective 31/03/2017) — Risk management systems / RMP
GVP Module IX (Rev 1, EMA/827661/2011 Rev 1) — Signal management
Explanatory Note to GVP Module VII (EMA/670256/2017 Rev. 4, dated 17 April 2026 — genuinely current, this is the live document EMA is using now to bridge PSUR practice ahead of a full Module VII rewrite)
MHRA's "Exceptions and modifications to the EU guidance on good pharmacovigilance practices that apply to UK MAHs and the licensing authority" (the MHRA's own UK-divergence document, published 7 February 2025, downloaded from assets.publishing.service.gov.uk) — this is the actual mechanism by which the UK's post-Brexit regime tracks (and diverges from) the EU GVP modules clause-by-clause, and is the primary source for every EU-vs-UK divergence point below
MHRA Pharmacovigilance Inspection Metrics Report, April 2021 – March 2022 (published 1 September 2023, the most recent one MHRA has published — gov.uk's own "Pharmacovigilance inspection metrics, 2009 to present" collection page lists no later edition) — real GPvP inspection deficiency data, fetched and extracted via pdftotext -layout, not estimated

What was and wasn't independently verified: the current 12-module GVP framework list (Modules I–X, XV, XVI, with XI–XIV void, plus four Product-/Population-specific "P" modules) was confirmed via EMA's own GVP overview page. Of these, Modules V, VI, VII and IX were fetched and read in full (the four modules most directly document-checkable against Regscribe's use case). Modules I (PV systems/quality), II (PSMF), III (inspections), IV (audits), VIII (PASS), X (additional monitoring), XV (safety communication), XVI (risk minimisation measures), and the four P-modules were NOT independently fetched — anything below attributed to Module II (PSMF content) is sourced only via the MHRA UK-exceptions document's own paraphrase of Module II text, not Module II's EMA original, and is flagged as such. Nothing below is fabricated: every clause number, quote, timeline, and statistic is either drawn directly from the fetched module PDFs, the MHRA exceptions document, or the MHRA inspection metrics report — or explicitly marked as not independently verified.

Usage note — this rubric is for checking documentation, not for uploading real patient data

Unlike Regscribe's other rubrics, GVP concerns documents that can genuinely contain patient-identifiable health information — an ICSR case narrative, by Module VI's own four minimum criteria (VI.B.2, below), requires "one single identifiable patient" (at least initials, medical record number, date of birth, age, age group, gestation period, or gender). That is patient-level health information, and Regscribe is not designed or intended to receive it.

Use this rubric to check documentation and process compliance — whether an ICSR narrative would meet the four minimum criteria, whether a PSUR follows the required section structure, whether an RMP's Part V effectiveness-review is documented — not to upload real, patient-identifiable case data. If you're assessing genuine pharmacovigilance case files, redact patient identifiers before upload (initials, MRN, DOB, age, gestation period, gender, and any other patient-identifying detail) or contact us first at info@regscribe.ai. See our Privacy Notice and Terms of Service for the same statement in Regscribe's published legal documents.

0. READ THIS FIRST — jurisdiction, EU/UK divergence, and how this differs from Regscribe's other rubrics

This is two overlapping-but-distinct regimes, not one. The EU GVP modules are EMA-published guidelines under Regulation (EU) No 726/2004 and Directive 2001/83/EC (as amended by the 2010/2012 pharmacovigilance legislation) — legally binding on EU marketing authorisation holders (MAHs), enforced via national competent authority and EMA inspections. Since Brexit, the MHRA maintains its own UK regime that is not a simple copy — it is EU GVP read subject to a documented set of exceptions and modifications, published and periodically updated by MHRA itself. A document that is fully GVP-compliant for an EU-only product is not automatically UK-compliant, and vice versa — the two must be checked against different rule sets, and Regscribe should not silently assume EU-clean implies UK-clean.

The Windsor Framework adds a third layer for Northern Ireland. Following the February 2023 Windsor Framework (in force since 1 January 2025 for medicines), the UK now runs a dual licensing category system: Category 1 products (UK-wide authorisations, "UKMA(UK)") follow UK-specific legislation (the Human Medicines Regulations 2012, as amended, "HMR") including its own Schedule 12A; Category 2 products (Northern Ireland-specific or products still following EU rules for NI, "UKMA(NI)" or centrally-authorised) follow the EU's Implementing Regulation (EU) No 520/2012 rules directly, alongside Great Britain-only "PLGB" products which fall under Category 1's UK-only regime. A document's compliance requirements literally depend on which category the product is authorised under — this is the single most important classification question before scoring any UK-facing GVP document, and it is Windsor Framework-specific, not a legacy Brexit artefact.

QPPV location is a genuine EU/UK fork. Per MHRA's own exceptions document: the QPPV for UK-authorised products "must reside and operate anywhere in the UK or the EU/EEA" (also permitting Norway, Iceland, Liechtenstein), with mandatory back-up arrangements if the QPPV doesn't reside/operate in the UK, in which case a UK-resident "contact person for pharmacovigilance" who reports to the QPPV must be appointed and named to the licensing authority. This is structurally different from the EU's own QPPV residency rule (EU QPPV must reside/operate in the EU/EEA) — a UK MAH with an EU-resident QPPV is compliant only if the UK contact-person back-up is also in place and notified.

ICSR submission is dual-route, not single-route. Per the MHRA exceptions document (and confirmed in Module VI's own EU submission-timeline table), UK MAHs must submit valid ICSRs both to the licensing authority's own database (MHRA) and, depending on product category and case origin, to the EudraVigilance database — the specific which-database-when logic in MHRA's own table turns on Category 1 vs Category 2 status and whether the case originated in the UK/EEA/rest-of-world. A UK-only submission for a Category 2 product, or an EudraVigilance-only submission for a Category 1 product, is a compliance gap even if the timeline itself was met.

PSURs have a UK regional appendix, not a separate UK PSUR. Where a product has both EU and UK marketing authorisations, MHRA generally accepts the EU-assessed PSUR (produced through the EU's PSUR single assessment procedure, "PSUSA") plus a UK regional appendix conforming to a UK-specific structure — a standalone, independently-drafted UK PSUR is not the default expectation for aligned products. UK-only MAHs (no EU authorisation) must still follow the Module VII structure with UK-specific modifications.

How this differs from Regscribe's existing rubrics: every rubric built so far checks a product's manufacturing quality, trial conduct, or (for PMCPA) its promotional claims — all activity that happens before or during a medicine reaching market, or around its marketing rather than its actual safety performance. GVP is the only rubric checking documents that exist because a medicine is already being taken by real patients and something might be going wrong — an ICSR narrative describes an actual patient's actual adverse reaction; a PSUR is a periodic re-litigation of whether the medicine's benefit-risk balance still holds up; an RMP is a living plan for catching and minimising risks nobody was fully sure about at approval. The closest structural analogue elsewhere in Regscribe is ICH E6(R3) GCP's safety-reporting provisions (SAE/SUSAR reporting during a trial) — GVP is what that same discipline becomes once the trial ends and the product is in general use.

Rubric legend

Each row: Requirement (plain language / near-verbatim) → Citation → Evidence that demonstrates compliance → Common failure pattern

Confirmed current GVP module list (EMA's own page)

Module	Title	Current revision
I	Pharmacovigilance systems and their quality systems	Final (2012) — not independently fetched
II	Pharmacovigilance system master file	Rev. 2 (2017) — not independently fetched
III	Pharmacovigilance inspections	Rev. 1 (2014) — not independently fetched
IV	Pharmacovigilance audits	Rev. 1 (2015) — not independently fetched
V	Risk management systems	Rev. 2 (2017) — fetched, scored below
VI	Collection, management and submission of reports of suspected adverse reactions	Rev. 2 (2017) — fetched, scored below
VII	Periodic safety update report	Rev. 1 (2013), plus live Explanatory Note Rev. 4 (17 April 2026) — fetched, scored below
VIII	Post-authorisation safety studies	Rev. 3 (2017) — not independently fetched
IX	Signal management	Rev. 1 (2017) — fetched, scored below
X	Additional monitoring	Final (2013) — not independently fetched
XI–XIV	Void — topics addressed elsewhere in the framework	—
XV	Safety communication	Rev. 1 (2017) — not independently fetched
XVI	Risk minimisation measures	Rev. 3 (2024) — not independently fetched
P.I	Vaccines for prophylaxis against infectious diseases	Effective 13/12/2013 — not fetched
P.II	Biological medicinal products	Effective 16/08/2016 — not fetched
P.III	Pregnant and breastfeeding women / in-utero and breastmilk exposure	Effective 09/02/2026 — not fetched
P.IV	Paediatric population	Effective 08/11/2018 — not fetched

Only Modules V, VI, VII and IX are scored in detail below — deliberately the four most directly document-checkable against an uploaded ICSR narrative, RMP, PSUR/PBRER, or signal evaluation report, matching Regscribe's actual use case.

Module VI — Collection, management and submission of reports of suspected adverse reactions (ICSRs)

The most directly document-checkable module — it specifies literal, countable requirements for what a valid case report must contain and when it must be submitted.

VI.B.2 — The four minimum criteria for ICSR validity


Requirement	"Four minimum criteria are required for ICSRs validation": (a) one or more identifiable reporter (qualification, name/initials, or address — at minimum, qualification and country must be known for at least one reporter, or the report defaults to being treated as a consumer report from the receiving country); (b) one single identifiable patient (at least one of: initials, medical record number, date of birth, age, age group, gestation period, or gender); (c) one or more suspected substance/medicinal product (interacting substances count too); (d) one or more suspected adverse reaction — a report is explicitly not valid if the primary source has stated no causal relationship and the assessor agrees, or if only an unspecified outcome (e.g. "patient died") is reported with no further clinical detail.
Citation	GVP Module VI (Rev 2), section VI.B.2
Evidence of compliance	A case narrative that can be checked against all four criteria independently — reporter identifiability, patient identifiability, suspect product, and suspect reaction each individually present, not inferred. "The lack of any of the four elements means that the case is considered incomplete and does not qualify for submission as ICSR" — Regscribe should flag a case missing any one criterion as non-submittable, not merely incomplete.
Common failure pattern	A narrative reporting only an outcome ("patient hospitalised," "patient died") without describing the clinical circumstances or any stated/inferable causal link is the module's own named example of an invalid ICSR — this is a genuinely easy trap because the report reads as serious and urgent while actually failing minimum-criteria validation.

VI.B.7 / VI.B.7.1 — Submission timelines and "day zero"


Requirement	"The clock for the submission of a valid ICSR starts as soon as the information containing the minimum criteria has been brought to the attention of the national or regional pharmacovigilance centre... or of any personnel of the marketing authorisation holder, including medical representatives and contractors. This date should be considered as day zero" — irrespective of weekends/holidays, and timelines are calendar days, not working/business days. Serious valid ICSRs: submission required "as soon as possible, but in no case later than 15 calendar days" from day zero — applies to both initial and follow-up information. Non-serious valid ICSRs: per the module's own submission-requirements table, 90 days. Where a case initially sent as serious is later reclassified non-serious on follow-up, the reclassification submission must still meet the 15-day window; only subsequent follow-ups shift to the 90-day track. Significant new follow-up information restarts the clock from the date that follow-up information was received.
Citation	GVP Module VI (Rev 2), sections VI.B.7, VI.B.7.1, and Table VI.7/VI.8 (VI.App.3.2/3.3) — the 90-day non-serious figure is drawn from the module's own submission-requirements table, not the narrative text, which primarily emphasises the serious/15-day case
Evidence of compliance	A documented "day zero" date on the case file matching the module's own definition (first awareness of minimum-criteria-complete information, by anyone at the MAH including contractors/reps — not the date a central PV database entry was created, which can lag actual awareness); a submission date within 15 calendar days of day zero for serious cases, 90 for non-serious; a distinct, re-started clock date for any submitted follow-up carrying significant new information.
Common failure pattern	The module explicitly distinguishes "significant" follow-up information (new medical/administrative information that could affect assessment/management or change seriousness — this restarts the clock) from "non-significant" (updated assessment comments, typo corrections — does not restart the clock) — a common practical failure is treating every follow-up contact as clock-resetting (submission burden overstatement) or, conversely, failing to recognise genuinely significant new information and missing the 15-day window on a follow-up that should have triggered it.

VI (general) — Literature/vaccine-specific ICSR triggers and "day zero" for literature


Requirement	For ICSRs from medical literature, day zero is "awareness of a publication containing the minimum criteria" — not the publication date itself, and not the date a literature search happened to be run, unless the minimum criteria were available in the abstract and the search date is the earliest point of awareness. Vaccine-specific: cases of lack of prophylactic efficacy should be submitted as ICSRs given their potential relevance as strain-replacement/waning-immunity signals.
Citation	GVP Module VI (Rev 2), section VI.App.2.7 (day zero for literature), and the vaccine lack-of-efficacy passage preceding VI.B.7
Evidence of compliance	For literature-sourced case reports specifically, a documented awareness date distinct from — and demonstrably not later than — the publication's own date, with the awareness-determination method (routine literature search cadence, ad hoc alert, etc.) recorded.
Common failure pattern	Not independently observed in inspection data — flagged as a plausible gap area (literature day-zero determination is inherently harder to audit than direct-report day-zero) rather than an evidenced one.

Module VII — Periodic Safety Update Report (PSUR/PBRER)

VII.B.5 — The ICH E2C(R2)-aligned PSUR/PBRER section structure


Requirement	A PSUR must follow the full modular structure set out in VII.B.5, with each of the following as a distinct, titled section (not a free-form report): Introduction; Worldwide marketing authorisation status; Actions taken in the reporting interval for safety reasons; Changes to reference safety information; Estimated exposure and use patterns (with cumulative clinical-trial-exposure and post-marketing-exposure sub-sections); Data in summary tabulations; Summaries of significant findings from clinical trials during the reporting period; Findings from non-interventional studies; Information from other clinical trials and sources; Non-clinical data; Literature; Other periodic reports; Lack of efficacy in controlled clinical trials; Late-breaking information; Overview of signals: new, ongoing, or closed; Signal and risk evaluation (with sub-sections: Summary of safety concerns, Signal evaluation, Evaluation of risks and new information, Characterisation of risks, Effectiveness of risk minimisation); Benefit evaluation; Integrated benefit-risk analysis for authorised indications; and further sections through to conclusions/actions.
Citation	GVP Module VII (Rev 1), section VII.B.5 and its numbered sub-sections VII.B.5.1 through VII.B.5.18+
Evidence of compliance	A section-by-section presence check against this exact list — a PSUR missing the "Overview of signals" or "Signal and risk evaluation" sections (VII.B.5.15/16) is missing the module's actual analytical core, not a peripheral formatting section; a PSUR that only compiles data without the "Signal evaluation" and "Characterisation of risks" sub-sections has produced a data dump, not the "comprehensive, concise and critical analysis of the benefit/risk balance" the Explanatory Note describes as the document's purpose.
Common failure pattern	Confirmed by real MHRA inspection data (see cross-cutting summary below): "ongoing safety evaluation" — which covers exactly this signal-overview/signal-evaluation section pair — carries the second-largest cumulative count of critical findings across all GPvP inspection topics since 2012, and a critical non-compliance for PSUR submission itself was identified in the most recent (2021/22) reporting period.

Explanatory Note to GVP Module VII (EMA/670256/2017 Rev. 4, dated 17 April 2026 — genuinely current guidance, addresses PSUSA-specific issues ahead of a full Module VII rewrite)


Requirement	"The purpose of a PSUR is to present a comprehensive, concise and critical analysis of the benefit/risk balance of the medicinal product taking into account new or emerging information in the context of the cumulative information on the risks and benefits." The QPPV "should ensure that the PSURs are prepared and written in a way that facilitates the understanding of the data, the conclusions and the subsequent actions, i.e. the logic flow needs to be clear and understandable." PSURs must be provided in English. The MAH should tailor the level of detail for both presentation of findings (sections 6–14) and subsequent evaluation (sections 15–16) based on clinical significance — not apply uniform depth regardless of importance.
Citation	Explanatory Note to GVP Module VII, EMA/670256/2017 Rev. 4, dated 17 April 2026, section 1.1
Evidence of compliance	A readable, English-language document where the "logic flow" from raw findings (sections 6–14) through to evaluation and conclusions (15–16) is traceable — i.e. a reviewer can follow why a given piece of new safety data led to a specific conclusion, not just that both appear somewhere in the document; depth of treatment visibly scaled to clinical significance (a minor labelling update discussed briefly, an emerging serious risk discussed at length) rather than uniform boilerplate across all findings.
Common failure pattern	Not independently evidenced by inspection data (the Explanatory Note is new/current guidance, not yet reflected in the 2021/22 inspection metrics report) — flagged as guidance to apply going forward rather than a pattern confirmed against real deficiency data.

VII (UK divergence) — PSUR submission route and UK regional appendix


Requirement	Per MHRA's exceptions document: for a product with both EU and UK marketing authorisations, the EU PSUR (produced under the PSUR single assessment procedure) can generally be submitted to the licensing authority with a UK regional appendix conforming to a UK-specific structure — a wholly separate, independently-authored UK PSUR is not required by default for aligned products. UK MAHs are not required to routinely submit PSURs for generic medicinal products authorised under the abridged/generic HMR pathway, though the licensing authority may specifically request one where there is a lack of PSURs for that active substance post-authorisation.
Citation	MHRA "Exceptions and modifications..." document, sections around VII.B.5/VII.C.1A (UK PSUR submission and assessment process), fetched 7 February 2025 edition
Evidence of compliance	For a dual EU/UK-authorised product's PSUR, confirmation a UK regional appendix is present and appropriately positioned (not merely that the EU PSUR was reused unmodified); for a generic UK-only product, confirmation of whether a specific MHRA request for a PSUR exists before treating its absence as a compliance gap — the default UK rule for generics is exemption, not omission.
Common failure pattern	Not independently evidenced by inspection data — flagged as a genuine UK-specific check that has no EU analogue, so a document reviewed only against the EU Module VII structure would silently miss it.

Module V — Risk management systems / Risk Management Plan (RMP)

V.B.3 / Table V.1 — The seven-part, modular RMP structure


Requirement	An RMP must be structured into seven parts, several of which are themselves sub-divided into named modules: Part I — Product(s) overview. Part II — Safety specification, sub-divided into Module SI (Epidemiology of the indication/target population), SII (Non-clinical part of the safety specification), SIII (Clinical trial exposure), SIV (Populations not studied in clinical trials), SV (Post-authorisation experience), SVI (Additional EU requirements for the safety specification), SVII (Identified and potential risks), SVIII (Summary of the safety concerns). Part III — Pharmacovigilance plan (including post-authorisation safety studies). Part IV — Plans for post-authorisation efficacy studies. Part V — Risk minimisation measures (including evaluation of the effectiveness of risk minimisation activities), itself containing a "Risk minimisation plan" section and a "Summary of risk minimisation measures" section. Part VI — Summary of the risk management plan. Part VII — Annexes (including, where applicable, Annex 6: details of proposed additional risk minimisation activities).
Citation	GVP Module V (Rev 2), Table V.1 and sections V.B.4 through V.B.10
Evidence of compliance	A part-by-part and (for Part II) module-by-module presence and completeness check — an RMP is not "done" merely because it has a safety specification section; each of SI through SVIII should be independently checkable, and Part V's split between routine and additional risk minimisation activities (not just "risk minimisation" as an undifferentiated block) should be explicit, since additional measures carry their own justification and effectiveness-evaluation burden that routine measures don't.
Common failure pattern	Confirmed by real MHRA inspection data: risk management is the single topic with the largest cumulative number of critical findings reported by MHRA GPvP inspections since April 2012 — in the most recent (2021/22) reporting period, five of six total critical findings that year were risk-management-related, specifically: two on management of additional pharmacovigilance activities in Part III (in the NI-PASS context), two on maintenance of reference safety information, and one on additional risk minimisation measures (aRMMs) in Part V.

V.B.8 — Additional risk minimisation activities: the "essential" threshold


Requirement	"Additional risk minimisation activities should only be suggested when essential for the safe and effective use of the medicinal product" — not proposed as a precautionary default. Where proposed, key messages must be provided in RMP Annex 6. The need to continue additional risk minimisation activities should be reviewed at regular intervals, with the effectiveness of the activities actually assessed, not merely asserted as ongoing.
Citation	GVP Module V (Rev 2), section V.B.8
Evidence of compliance	For any additional (non-routine) risk minimisation measure listed, a documented "essential" justification distinct from a general risk-mitigation rationale; an Annex 6 entry with key messages; and evidence of a periodic effectiveness review (not just the measure's continued existence) — a measure that has been in place for years with no effectiveness-review record on file is a gap even if the measure itself is still active.
Common failure pattern	This is the module's own most-cited critical-finding subtopic per the MHRA data above (aRMM-related Part V critical finding, 2021/22) — MHRA's inspection report attributes the pattern partly to MAHs having "limited experience... in operating complex risk management systems," suggesting aRMM effectiveness-evaluation documentation is a genuinely hard, not just neglected, requirement.

V (UK divergence) — RMP alignment and the UK-specific annex


Requirement	Where a MAH holds both EU and UK authorisations for the same product, the EU-approved RMP version can generally be submitted to the licensing authority directly. Where MHRA has made a specific information request, or the UK risk management system differs "to a moderate degree" from the EU version, a UK-specific annex must be attached — placed first, ahead of the approved EU RMP, in a single combined document. Where divergence is extensive, a standalone UK RMP conforming to Module V's format but reflecting UK-specific modifications is required instead.
Citation	MHRA "Exceptions and modifications..." document, section on GVP Module V, fetched 7 February 2025 edition
Evidence of compliance	For a dual-authorised product's UK-facing RMP submission, confirmation of which of the three structures applies (EU RMP as-is / EU RMP + UK annex first / standalone UK RMP) and that the document ordering (UK annex before EU RMP, where used) matches MHRA's stated requirement — document ordering is an easy, purely mechanical check with real compliance consequence.
Common failure pattern	Not independently evidenced by inspection data — flagged as a UK-specific structural check with no EU analogue.

Module IX — Signal management

IX.A.1.2 / IX.B — The five-stage signal management process and its definitions


Requirement	"The EU signal management process includes the following activities: signal detection, signal validation, signal confirmation, signal analysis and prioritisation, signal assessment and recommendation for action." Key definitions, verbatim: Signal detection — "The process of looking for and/or identifying signals using data from any source." Signal validation — "The process of evaluating the data supporting the detected signal in order to verify that the available documentation contains sufficient evidence demonstrating the existence of a new potentially causal association, or a new aspect of a known association, and therefore justifies further analysis of the signal," taking into account strength of evidence, clinical relevance, and previous awareness. Signal prioritisation — a continuous process throughout signal management identifying signals with potential important patient/public-health impact requiring urgent attention. Signal assessment — further evaluation of a validated signal taking into account all available evidence, to determine whether there are new risks or known risks have changed. Signal confirmation (by the PRAC rapporteur or lead Member State) — "not intended to be a full assessment of the signal" — a distinct, narrower decision step.
Citation	GVP Module IX (Rev 1), sections IX.A.1.2 and IX.B (definitions and process overview)
Evidence of compliance	A signal evaluation report or PSUR signal-section that can be mapped onto this five-stage vocabulary explicitly — a document that jumps straight from "we noticed something" to "conclusion" without a documented validation step (evidence sufficiency check) and a distinct prioritisation judgement (urgency/impact) is skipping stages the module treats as procedurally distinct, not stylistic synonyms for the same activity.
Common failure pattern	Confirmed by real MHRA inspection data: signal management is explicitly named as one of the subtopics under "ongoing safety evaluation," the topic carrying the second-largest cumulative number of critical findings in MHRA's GPvP inspection history, with a critical PSUR-submission non-compliance specifically tied to this area in the most recent reporting period.

IX.B.3 — Evaluation factors during signal validation


Requirement	Signal validation should weigh, among others: previous awareness (is this already in the SmPC, already assessed in a prior RMP/PSUR/regulatory procedure); strength of evidence (case count after de-duplication, number of "supportive" cases showing compatible temporal association/positive de-or-rechallenge/lack of alternative causes, case count relative to exposure, consistency across cases, disproportionality where applicable); and clinical relevance/context (seriousness, severity, reversibility, whether the reaction occurs in a vulnerable population or in a drug-interaction/off-label/overdose context).
Citation	GVP Module IX (Rev 1), section IX.B.3
Evidence of compliance	A signal validation record showing these evaluation factors were actually applied and documented — not merely that a conclusion ("signal validated" / "signal not validated") was reached, but that the reasoning trail (case count, supportive-case criteria, previous-awareness check) is present and traceable, consistent with the module's own instruction that "any such decision tree should be documented as part of the description of the signal management process."
Common failure pattern	Not independently evidenced at this granularity by MHRA's aggregate inspection statistics (which report by topic, not by sub-criterion) — flagged as a plausible, module-text-supported check rather than one confirmed against real deficiency data.

Glossary (as defined in the fetched GVP modules and the MHRA exceptions document — reference, not scored directly)

ICSR (Individual Case Safety Report): the format for reporting a suspected adverse reaction associated with a medicinal product involving a single patient at a specific point in time; only "valid" ICSRs (meeting the four minimum criteria — reporter, patient, product, reaction — per Module VI) qualify for submission.
PSUR / PBRER: Periodic Safety Update Report (the EU's own long-standing term) / Periodic Benefit-Risk Evaluation Report (the ICH E2C(R2)-harmonised term for the same document — the EU uses "PSUR" but the document's actual structure follows the internationally harmonised PBRER template).
PSUSA: PSUR Single Assessment procedure — the EU mechanism for jointly assessing PSURs across all marketing authorisations sharing an active substance, run by the PRAC.
RMP (Risk Management Plan): the seven-part document (per Module V, Table V.1) describing a product's safety specification, pharmacovigilance plan, and risk minimisation plan — a living document updated as new information emerges, not a one-time approval artefact.
PSMF (Pharmacovigilance System Master File): the master description of a MAH's entire pharmacovigilance system — per the MHRA exceptions document (paraphrasing Module II), must contain at minimum the documents listed in Article 2 of Commission Implementing Regulation (EU) No 520/2012 (for Category 2 products) or HMR Schedule 12A paragraph 2 (for Category 1 products), and must be "permanently and immediately accessible" — the full Module II content list was not independently fetched this session; see Gaps below.
QPPV (Qualified Person responsible for Pharmacovigilance): the single named, accountable individual with sufficient authority over the pharmacovigilance system to promote, maintain and improve compliance — an EU MAH's QPPV must reside/operate in the EU/EEA; a UK MAH's QPPV must reside/operate in the UK, EU/EEA, or (per the exceptions document) Norway/Iceland/Liechtenstein, with a UK-resident back-up contact person required if the QPPV is not themselves UK-resident.
Signal: (per Module IX) information arising from one or multiple sources — including observations and experiments — that suggests a new potentially causal association, or a new aspect of a known association, between an intervention and an event or set of related events, either adverse or beneficial, judged to be of sufficient likelihood to justify verificatory action.
Day zero: (per Module VI) the first calendar day an organisation — anyone at the MAH including reps/contractors, or a competent authority — has knowledge of a case meeting the four minimum ICSR criteria; the reporting clock for both initial submission and significant follow-up runs from this date, in calendar (not working) days.
Category 1 / Category 2 (UK, post-Windsor Framework): Category 1 = UK-wide authorisations following UK-specific legislation (HMR Schedule 12A); Category 2 = Northern Ireland/EU-aligned authorisations following the EU's IR 520/2012 directly — a document's applicable PSMF/RMP/ICSR rules depend on which category the specific product falls under.

Cross-cutting common failure patterns (sourced from MHRA's own Pharmacovigilance Inspection Metrics Report, April 2021 – March 2022)

Sourcing caveat: every figure below is taken directly from the MHRA GPvP Inspection Metrics Report PDF, fetched from gov.uk and extracted via pdftotext -layout — not from a secondary summary. This is the most recent edition MHRA has published (gov.uk's own "Pharmacovigilance inspection metrics, 2009 to present" collection page, itself last confirmed updated 1 September 2023, lists no later edition) — flagged in Gaps below as a currency limitation, not treated as if a newer report existed.

Total findings: 17 GPvP inspections were conducted in 2021/22 (down from 32 the prior year), yielding six critical, 72 major and 91 minor findings (169 total) across all inspection arms combined.
Topic distribution: the highest proportion of findings, regardless of severity grade, related to risk management (32%, 54/169 findings), followed by the quality management system (25%, 42/169) and management of adverse drug reactions/ADRs (14%, 23/169). The report attributes the risk-management increase partly to a growing number of Northern Ireland post-authorisation safety study (NI-PASS) and additional risk minimisation measure (aRMM) inspections — both newer, less-familiar inspection arms for MAHs at the time.
Critical findings by topic, cumulative since April 2012: risk management has the largest cumulative critical-finding count of any topic across the full 2012–2022 inspection history, with ongoing safety evaluation (which includes PSUR production and signal management) holding the second-largest cumulative count.
2021/22 critical findings in detail: six total — five under risk management (two on Part III additional pharmacovigilance activities/NI-PASS management, two on maintenance of reference safety information, one on Part V additional risk minimisation measures) and one under ongoing safety evaluation, specifically a critical non-compliance for PSUR submission.
No findings were reported under "clinical trials pharmacovigilance" or "other" categories in this reporting period — the report does not claim these areas are risk-free, only that no findings arose from the inspections actually conducted.

What this means for Regscribe's scoring: real MHRA inspection data converges cleanly with the module-text structure above — risk management (Module V) and ongoing safety evaluation, specifically signal management (Module IX) and PSUR production (Module VII), are not just theoretically important sections, they are the two topics generating the most severe (critical-grade) findings in actual UK pharmacovigilance inspections, year over year since 2012. A Regscribe review that treats an RMP's Part V (risk minimisation) and a PSUR's signal-evaluation sections as the highest-scrutiny areas is aligned with where real inspectors actually find the worst problems, not a guess.

Gaps / follow-ups before this goes into production scoring

8 of 12 active GVP modules were not independently fetched/read — Module I (PV systems/quality systems), Module II (PSMF), Module III (inspections), Module IV (audits), Module VIII (post-authorisation safety studies/PASS), Module X (additional monitoring), Module XV (safety communication), and Module XVI (risk minimisation measures, most recently revised 2024) are named in the confirmed module list above but their clause text is not reproduced or scored here. Module II (PSMF) is the most significant near-term gap given the interest in PSMF-section document checking — what's above is drawn only from the MHRA exceptions document's own paraphrase of Module II paragraphs (specifically the QPPV section, II.B.4.1), not Module II's own EMA-published text, which was not successfully retrieved (404 on the URL attempted).
The four Product-/Population-specific "P" modules (vaccines, biologicals, pregnancy/breastfeeding, paediatric) were not fetched — relevant if Regscribe expects to review ICSRs or RMPs for these product categories specifically, since Module IX itself repeatedly cross-references P.I/P.II/P.III/P.IV for population-specific signal-evaluation considerations.
MHRA's inspection metrics report is from 2021/22 (published September 2023) — this is the most recent edition found on gov.uk's own collection page, but MHRA may have published a newer edition since; the currency of this being "the latest available" should be re-checked before treating the critical-finding topic distribution above as current, rather than assumed stale-but-adequate.
No EMA/EU-side aggregate PSUR or signal-management deficiency statistics were located (the search focused on MHRA's UK inspection data, which is genuinely public and numeric in a way the EU side may not publish equivalently) — a follow-up pass specifically searching for EMA/PRAC's own published inspection or PSUSA-outcome statistics would strengthen the EU-side "common failure pattern" evidence, which currently leans entirely on the UK data.
PMCPA-equivalent — MHRA's own case/inspection report database (individual named findings, not just aggregate statistics) was not fetched — a follow-up pass through individual GPvP inspection reports (where MHRA publishes them) could surface concrete example excerpts analogous to the named FDA Warning Letter quotes used in other Regscribe rubrics, rather than only the aggregate percentages used here.
The UK Category 1/Category 2/Windsor Framework classification logic is genuinely complex and only partially reproduced above — the "READ THIS FIRST" section captures the headline distinction, but the full HMR Schedule 12A vs Implementing Regulation 520/2012 cross-reference table (which the MHRA exceptions document maintains section-by-section) was not exhaustively transcribed; a document reviewer should confirm product category before applying either rule set with full confidence.
ICH E2C(R2) itself (the international PBRER template GVP Module VII is harmonised against) was not independently fetched — Module VII's own text repeatedly defers to E2C(R2) as the base template with EU-specific additions; a follow-up fetch of the ICH guideline directly would let Regscribe distinguish "EU-specific PSUR requirement" from "internationally harmonised PBRER requirement Module VII merely echoes," which is currently blurred in the module-text-only view fetched this session.