GVP compliance means having the systems, people, processes and controls needed to identify, assess, document, report and monitor medicine related safety information in line with applicable pharmacovigilance requirements. In Nigeria, a pharmaceutical company holding a NAFDAC Certificate of Registration must operate a pharmacovigilance system for the fulfilment of its pharmacovigilance activities and regulatory responsibilities, and must have permanently and continuously at its disposal an appropriately Qualified Person for Pharmacovigilance who resides in Nigeria. This guide breaks down what those requirements mean in practice.
What does GVP mean?
GVP stands for Good Pharmacovigilance Practice. It is the framework used to ensure that safety information about medicinal products is systematically collected, assessed, documented, monitored and acted upon across the whole life of a product on the market.
The concept is international. Its Nigerian expression is set out in NAFDAC's Good Pharmacovigilance Practice Regulations, made under the NAFDAC Act, Cap N1, Laws of the Federation of Nigeria 2004, and elaborated in the NAFDAC Good Pharmacovigilance Practice Guidelines, which run to more than 160 pages and cover the pharmacovigilance system, the Pharmacovigilance System Master File, risk management, safety communication, adverse reaction reporting, periodic safety update reporting, post authorisation safety studies and pharmacovigilance audit. MedNova's glossary entry on Good Pharmacovigilance Practice gives the short definition.
GVP is not just adverse event reporting
This is the single most consequential misunderstanding in Nigerian pharmacovigilance, and it is worth stating plainly at the outset.
A great many companies operate on the following model: someone reports a side effect, a member of staff fills in a form, the form is submitted, and the matter is considered closed. That is one activity inside a much larger obligation.
NAFDAC's regulatory framework defines the pharmacovigilance system as covering organisational structure, responsibilities, procedures, processes and resources, together with appropriate resource management, compliance management and record management.
What does GVP compliance mean in Nigeria?
In Nigeria, GVP compliance means that a pharmaceutical company has an effective pharmacovigilance system capable of meeting its regulatory responsibilities under NAFDAC's applicable requirements, and can demonstrate that capability on demand.
The framework rests on three foundations: the system itself, the person accountable for it, and the personnel who run it.
A pharmacovigilance system
NAFDAC's Good Pharmacovigilance Practice Guidelines define a pharmacovigilance system as a quality system used by the Certificate of Registration Holder to fulfil its regulatory responsibilities, designed to monitor the safety of authorised products and detect any change to their benefit to risk balance. The holder must operate that system, ensure it is adequately resourced, continually improve its effectiveness, and define, communicate and implement roles, responsibilities and authorities within it. The named components are organisational structure, responsibilities, procedures, processes, resources, resource management, compliance management, and record management. Note what is absent: a single named individual. The system is institutional — it has to survive staff turnover, absence and portfolio change.
A Qualified Person for Pharmacovigilance
The Certificate of Registration Holder must have permanently and continuously at its disposal an appropriately qualified QPPV, who must reside in Nigeria. Naming a regional QPPV based in Johannesburg, Nairobi, Dubai or London does not satisfy the requirement. “Permanently and continuously” means the role cannot lapse during leave, travel or a vacancy, which is why back-up arrangements must be documented and the deputy must hold all the information needed to act. Each pharmacovigilance system can have only one QPPV, although one QPPV may serve more than one holder provided all obligations can still be met. Duties must be set out in a job description with the reporting line on an organisational chart, and the company must give the QPPV sufficient authority over the quality system and the Pharmacovigilance System Master File. The QPPV acts as the single pharmacovigilance contact point for NAFDAC on a 24-hour basis, including for inspections. Companies that cannot resource this internally can appoint an outsourced QPPV — MedNova provides local QPPV representation in Nigeria as a standing retainer, set out in our QPPV Support Essentials guidance.
Adequately qualified pharmacovigilance personnel
The QPPV is not expected to do everything alone. NAFDAC requires the holder to have a sufficient number of competent and appropriately qualified personnel to perform pharmacovigilance activities. “Sufficient” is measured against the company's actual responsibilities: portfolio size, safety data volume, product risk profile, and whether the company holds new molecules or long-established generics. Functions that need covering include case intake, processing and coding, medical review, regulatory reporting, follow up, signal management, literature monitoring, aggregate reporting, quality monitoring, and record management — one person can hold several, but no function should go unheld. Training is a separate, explicit obligation: the holder must ensure initial and continuing training, verify its effectiveness, and keep records, extending beyond the PV department to clinical trials, product complaints, medical information, sales and marketing, regulatory affairs, legal and audit staff.
What does a GVP compliant pharmacovigilance system actually contain?
This is where the abstract requirement becomes a build specification.
Written procedures and standard operating procedures
NAFDAC's framework requires that all elements, requirements and provisions adopted for the quality system are documented in a systematic and orderly manner, in the form of written policies and procedures such as quality plans, quality manuals, quality records and standard operating procedures. Areas that normally require documented procedures include adverse event intake from every channel, case validation and processing, follow up, regulatory reporting and submission, signal detection and management, literature monitoring, safety communication, deviation handling and CAPA, record retention and archiving, internal escalation, business continuity for critical processes, and training and competency assessment. Some of these are named obligations in the regulatory framework; others are operational controls a company adopts because they are the practical way to meet a named obligation. Signal detection procedures, training records, record management and audit are explicitly required — the precise architecture of your SOP library is yours to design, provided it delivers what the framework demands.
Adverse event and ICSR management
The holder must take appropriate measures to collect and collate all reports of suspected adverse reactions, from both unsolicited and solicited sources, and must not refuse to consider reports received from patients and healthcare professionals — a company cannot filter out consumer reports on the basis that they lack clinical rigour. NAFDAC's guidelines treat the full chain as a critical pharmacovigilance process: collection, processing, management and quality control, follow up for missing information, coding, classification and duplicate detection, evaluation and timely transmission of Individual Case Safety Reports from any source. For the downstream picture, see our glossary entry on the adverse drug reaction. The operational sequence a compliant company runs is: receive, record the receipt date, validate, process and code, assess seriousness and expectedness, follow up where information is missing, submit within the applicable timeline, archive with submission evidence, and feed the case into ongoing safety monitoring.
Safety data collection from multiple sources
A compliant system cannot depend on a single source of safety information. Sources that need to be captured include spontaneous reports from healthcare professionals, reports direct from patients and consumers, medical and scientific literature, company internal sources including medical information enquiries and product quality complaints, distributors and licensing partners, post-approval studies and patient support programmes, digital and social channels the company owns or controls, and regulatory authority communications including safety actions taken elsewhere. The most common structural failure is the interface between departments: a complaint arriving at the quality team describing a clinical reaction is a safety case as well as a quality event. Without a reconciliation process between those systems, cases are lost, and the loss is invisible until an inspection finds it.
Follow up and case completeness
Reports are validated before they progress, and the internationally applied minimum criteria are four: an identifiable patient, an identifiable reporter, a suspect product, and a suspected adverse reaction or event. Beyond validity, completeness determines how useful a case is. Follow up typically seeks missing patient information, missing product information (particularly brand and batch or lot number), clinical detail on presentation and course, treatment and event dates, outcome, concomitant medicines, laboratory findings, and supporting documentation. Every follow-up attempt should be documented whether or not it succeeds — an undocumented attempt is, for compliance purposes, an attempt that did not happen.
Signal detection and safety monitoring
Pharmacovigilance does not stop when individual cases are processed. The holder must have mechanisms for detecting and investigating safety issues that may arise at any stage in a product's life cycle, supported by written procedures describing how signal detection is performed. Roles and responsibilities must be clearly documented, as must the source of information, the analysis and method used, and the actions taken on the outcome. Safety monitoring must include review of cumulative cases so potential safety issues can be assessed comprehensively rather than case by case. This is the requirement most frequently absent in practice — companies process cases diligently and never look at them in aggregate, meaning the company learns about its own safety signal from the regulator rather than the other way round.
Risk management
The holder must establish a pharmacovigilance plan for collecting data relevant to the safety profile of the product and for identifying risks from continuous evaluation of safety signals arising both within and outside Nigeria, and must monitor the outcome of risk minimisation measures, taking further measures where necessary. NAFDAC's guidelines set out the Risk Management Plan in seven parts, with a safety specification of eight elements including the epidemiology of the indication in Nigeria specifically. See MedNova's glossary entry on the Risk Management Plan for the structure.
Documentation and record management
If the company did something but cannot demonstrate it, that is a compliance problem. NAFDAC's framework requires the holder to maintain and control comprehensive, up-to-date, appropriately authorised, retrievable and traceable written instructions, records and reports of all pharmacovigilance activities, with the documentation system traceable, retrievable, secure and access-restricted, and the right to privacy in adverse reaction records fully guaranteed. Records that need to exist and be retrievable include individual case records with source documents, submission evidence, follow-up correspondence, version-controlled SOPs, training records, quality system documentation and CAPA, aggregate safety reports, signal detection outputs, audit schedules and reports, regulatory correspondence, pharmacovigilance agreements, and complete audit trails for the safety database.
The Pharmacovigilance System Master File
The holder must maintain a Pharmacovigilance System Master File and make a copy available to NAFDAC on request, available at the holder's premises. NAFDAC's guidelines add that holders in Nigeria must submit the master file during application for a Certificate of Registration, that it must be located either at the Nigerian site where the main pharmacovigilance activities are performed or where the QPPV operates, and that applicants for and holders of listings for traditional herbal medicinal products must also submit one. Our PV Readiness Guide covers how the master file connects to governance, case handling and inspection preparedness.
Audit, self inspection and regulatory inspection
The holder must perform regular audits of the pharmacovigilance system and implement corrective and preventive actions based on the findings. NAFDAC may conduct pharmacovigilance inspections at any time to determine whether the holder is operating in compliance, and the holder must permit the Agency to access, copy and verify any pharmacovigilance records. The holder must also carry out self-audits and keep the records. NAFDAC's guidelines require the master file to carry a list of completed audits covering five years plus the audit schedule, and where an audit raises a significant finding, a note remains in the file until corrective action is demonstrably complete or independently verified.
NAFDAC GVP compliance checklist
Use the following as a practical summary of the areas a Nigerian pharmacovigilance system is expected to cover. This checklist is a practical summary, not a substitute for the applicable NAFDAC regulations and guidelines.
System and governance
- Pharmacovigilance system established and adequately resourced
- Roles, responsibilities and authorities defined, communicated and implemented
- QPPV appointed and resident in Nigeria
- QPPV qualifications and residency requirements met and documented
- Deputy or back-up QPPV arrangements formally in place
- QPPV job description and organisational chart current
- Adequate pharmacovigilance personnel available for the portfolio
- Pharmacovigilance System Master File maintained and available at the premises
- Business continuity arrangements for critical pharmacovigilance processes
Procedures and case handling
- Written procedures and SOPs established, controlled and version managed
- Adverse event intake process established across all channels
- ICSR validation, processing and coding process established
- Follow-up process established and documented
- Duplicate detection performed
- Reporting timelines monitored and measured
- Submission evidence retained
- Reconciliation between safety, quality complaint and medical information systems
Monitoring and risk
- Signal detection procedures written and roles documented
- Sources, analysis and methods for signal detection documented
- Cumulative case review performed
- Actions arising from signal detection documented
- Pharmacovigilance plan established for safety data collection
- Risk minimisation outcomes monitored
- Literature monitored on a defined frequency
- Aggregate safety reports scheduled and submitted
Quality, records and oversight
- Initial and continuing training delivered, effectiveness verified, records kept
- Records comprehensive, authorised, retrievable, traceable and access restricted
- Privacy of personal data in adverse reaction records protected
- Facilities and equipment checked, qualified or validated as appropriate
- Regular pharmacovigilance audits conducted
- Self-audit performed and records kept
- Corrective and preventive actions implemented and effectiveness verified
- Compliance monitored on an ongoing basis
- Outsourced pharmacovigilance activities governed by written contract
- Delegated activities described in the master file with a list of subcontracts
Is your pharmacovigilance system ready? Download the NAFDAC QPPV Compliance Checklist to identify potential gaps across your system.
Download the Checklist PDFWhat happens if pharmacovigilance activities are outsourced?
Outsourcing is common and entirely permissible in Nigeria, including outsourcing the QPPV role itself. What outsourcing does not do is move the regulatory responsibility.
Where a Certificate of Registration Holder subcontracts pharmacovigilance activities to another organisation, the arrangement must be subject to a written contract, and the holder retains responsibility for ensuring that an effective quality system is applied to those activities. NAFDAC's guidelines reinforce the point: ultimate responsibility for the fulfilment of all pharmacovigilance tasks and for the quality and integrity of the system always remains with the Certificate of Registration Holder, as does full responsibility for the completeness and accuracy of the master file.
What a company must therefore build around a vendor:
- A detailed, current written agreement describing the delegated tasks, interactions, data exchange, definitions, tools, assignments and timelines
- A description of the delegated activities and services inside the Pharmacovigilance System Master File
- A list of subcontracts in the master file annex, specifying the products concerned
- Defined processes for checking on an ongoing basis that the agreed arrangements are being adhered to
- Risk-based audits of the vendor, or other documented methods of control and assessment
- Access rights to the vendor's records sufficient to satisfy the holder and the Agency
- Reconciliation to confirm no cases are lost at the interface between the vendor and the holder
NAFDAC's guidelines also record that the organisation to which activities have been subcontracted may itself be subject to inspection at the Agency's discretion, and that all the guidance in the framework applies equally to that organisation.
What is the difference between GVP compliance and simply reporting adverse events?
Adverse event reporting is one activity. GVP compliance is the system that supports the company's broader pharmacovigilance responsibilities.
The distinction is easiest to see through a scenario. A company receives twelve adverse event reports in a year and submits all twelve on time. On the reporting metric it is faultless. Now ask the questions an inspector asks:
- Were there more than twelve? Was there an intake channel nobody was monitoring?
- Was follow up attempted on the incomplete ones, and is the attempt documented?
- Were the twelve reviewed together for a pattern, or only individually?
- Is there a written signal detection procedure, and did anyone follow it?
- Can the company produce measured timeliness figures, or only an assertion?
- Are the staff who received those reports trained, with records?
- Does the master file describe the system that actually processed them?
A company can have submitted every adverse event report it received and still have significant weaknesses in its overall pharmacovigilance system. Reporting is visible. The system is what gets inspected.
How can a pharmaceutical company tell if its GVP system is compliant?
Before commissioning a formal assessment, work through the following questions. Each one should have an immediate, evidenced answer.
- Who is your QPPV, and where do they reside?
- Can the company demonstrate the QPPV's responsibilities in a job description and organisational chart?
- Who covers the role when the QPPV is unavailable, and is that documented?
- Where are your pharmacovigilance SOPs, when were they last reviewed, and who approved them?
- Who receives adverse event reports, across every channel the company operates?
- How quickly are cases escalated internally, and how do you know?
- How are follow-up attempts documented?
- How is safety information monitored in aggregate, and who performs that review?
- How are outsourced pharmacovigilance activities controlled, and when was the vendor last audited?
- Where are pharmacovigilance records maintained, and who has access?
- How do you demonstrate staff competency, including for staff outside the safety team?
- How does the company identify its own compliance gaps between inspections?
If several of these questions do not have clear answers, the company may benefit from a pharmacovigilance gap assessment. Speak with the MedNova team about a full system assessment.
Common GVP compliance mistakes Nigerian pharma companies make
Five patterns account for most findings.
Treating pharmacovigilance as an adverse event inbox
The system, not the form, is the obligation.
Appointing a QPPV without building the supporting system
A named person with no authority, no database access out of hours and no deputy does not satisfy the requirement.
Having SOPs that nobody follows
A procedure that describes an aspirational process is worse than no procedure, because the gap between document and practice is itself a finding.
Outsourcing pharmacovigilance without adequate oversight
No written agreement, no vendor audit, no reconciliation, and full retained liability.
Failing to maintain sufficient records
Activities that cannot be evidenced are, for regulatory purposes, activities that did not occur.
GVP compliance for new pharmaceutical companies in Nigeria
Companies entering the Nigerian market often build pharmacovigilance last, after registration is secured. That sequencing creates avoidable exposure, because the pharmacovigilance obligation attaches to the product being on the market, not to the company feeling ready. Companies preparing to enter should read our NAFDAC product registration guide and market entry and compliance overview alongside this article, since pharmaceutical registration in Nigeria and pharmacovigilance readiness are best planned together.
A workable build sequence:
- Establish what your regulatory obligations actually are for your specific product categories
- Establish pharmacovigilance governance, including who owns the system at board or management level
- Appoint the QPPV and supporting personnel, and document authorities
- Write and approve the standard operating procedures the system needs
- Establish intake and reporting mechanisms across every channel the company will operate
- Establish documentation, record management and the Pharmacovigilance System Master File
- Establish quality and compliance monitoring, including performance indicators
- Test the system before it is needed, using a mock case and a mock Agency information request
The eighth step is the one most often skipped and the one that most reliably exposes weaknesses while they are still cheap to fix.
GVP compliance for established pharmaceutical companies
If your company has been operating in Nigeria for years, the relevant question is different. It is not whether you have a pharmacovigilance system. It is whether the system you have is still fit for the company you have become.
Triggers that warrant a system review:
- Product portfolio changes, particularly the addition of a new molecule, a vaccine or a biological
- Change of QPPV, or a period during which the role was vacant
- Significant staff turnover in the safety, regulatory or quality functions
- A move to outsource case processing, or a change of vendor
- Migration or replacement of the safety database
- Acquisition, merger or in-licensing, where a portfolio arrives with pharmacovigilance history attached
- Regulatory change, including revisions to NAFDAC guidelines and the wider harmonisation of Nigerian requirements with international standards
- SOPs that have not been reviewed within their stated review period
- An approaching inspection, or an inspection elsewhere in the group that raised findings
Regulatory change deserves particular attention. Nigeria's regulatory environment has moved substantially: NAFDAC attained WHO Maturity Level 3 in 2022 and has sustained it through re-benchmarking, and in November 2025 it moved from observer to full membership of the International Council for Harmonisation. A pharmacovigilance system designed against the expectations of five years ago is being assessed against a materially more demanding environment today. Our regulatory change briefs cover how to turn regulatory developments into controlled implementation steps.
NAFDAC GVP compliance: key takeaways
- GVP compliance is a system, not a single form.
- The Certificate of Registration Holder retains responsibility for its pharmacovigilance system at all times.
- A QPPV resident in Nigeria is a central and non-negotiable part of the system.
- Documentation, procedures, reporting, monitoring and quality controls all carry equal weight.
- Outsourcing pharmacovigilance activities does not remove the company's responsibility for oversight.
How MedNova supports GVP compliance in Nigeria
MedNova Lifesciences provides pharmacovigilance services in Nigeria covering pharmacovigilance system setup and SOP development, ICSR intake and case processing, aggregate reporting, signal detection and risk management, weekly literature surveillance, inspection readiness and CAPA management, and local QPPV representation for Marketing Authorisation Holders. On the regulatory side we provide regulatory affairs support spanning NAFDAC product registration, dossier and registration preparation, import permits, variations, renewals and lifecycle management, alongside clinical development services and training and consulting for pharmacovigilance and regulatory teams.
For the wider Nigerian regulatory picture, read the regulatory affairs primer. To review our full scope of work, see the MedNova capability statement or browse the complete resources library.
Next step: download the NAFDAC QPPV Compliance Checklist to identify areas of your pharmacovigilance system that may require attention, or contact our team to discuss a full compliance assessment.
Not sure your GVP system would hold up to inspection?
MedNova Lifesciences supports companies with pharmacovigilance system builds, QPPV representation, documentation remediation, and inspection-ready compliance in Nigeria and across Africa.
Contact MedNova LifesciencesRelated resources
Frequently asked questions
What is GVP compliance?
GVP compliance means having the systems, people, processes and controls needed to identify, assess, document, report and monitor medicine related safety information in line with applicable pharmacovigilance requirements, and being able to demonstrate that capability to the regulator.
What does GVP mean in pharmacovigilance?
GVP stands for Good Pharmacovigilance Practice. It is the framework of standards governing how safety information about medicinal products is collected, assessed, documented, monitored and acted upon throughout a product's time on the market.
What are NAFDAC's pharmacovigilance requirements?
In outline: operate a pharmacovigilance system that is adequately resourced and continually improved, appoint a QPPV resident in Nigeria, employ sufficient competent personnel, establish a quality system with written procedures, collect and report suspected adverse reactions, maintain a Pharmacovigilance System Master File, run signal detection, manage risk, communicate safety information with Agency approval, maintain traceable records, and audit the system with corrective actions implemented.
Does every pharmaceutical company in Nigeria need a QPPV?
A Certificate of Registration Holder must have permanently and continuously at its disposal an appropriately qualified person responsible for pharmacovigilance. Companies should confirm the application of this requirement to their specific product categories against the current NAFDAC regulations.
Does a QPPV need to reside in Nigeria?
Yes. NAFDAC's requirement is that the QPPV resides in Nigeria, and the guidelines state that the QPPV should reside and operate in Nigeria. A regional or head office contact based outside the country does not meet this requirement.
Can pharmacovigilance activities be outsourced?
Yes, including the QPPV role. Where activities are subcontracted, the arrangement must be subject to a written contract, and the delegated services must be described in the Pharmacovigilance System Master File with a list of subcontracts in the annex.
Who is responsible when pharmacovigilance activities are outsourced?
The Certificate of Registration Holder. It retains responsibility for ensuring an effective quality system applies to the outsourced activities, and ultimate responsibility for the quality and integrity of the pharmacovigilance system and the accuracy of the master file never transfers to the vendor.
What should a pharmacovigilance system contain?
Organisational structure, responsibilities, procedures, processes and resources, together with resource management, compliance management and record management. In practice that means a QPPV, trained personnel, written procedures, case handling and reporting capability, signal detection, risk management, documentation and records, a master file, and audit with corrective action.
What is an ICSR?
An Individual Case Safety Report is the structured record of one patient's suspected adverse reaction to one or more products. It is the standard unit of safety data internationally and the format in which national reports are transmitted to the World Health Organization global database.
Does GVP compliance only involve adverse event reporting?
No. Adverse event reporting is one activity within a broader system. A company can have submitted every report it received and still have significant weaknesses in quality management, records, signal detection, vendor oversight, training or the master file.
How can a company assess its pharmacovigilance compliance?
Through a structured gap assessment against the applicable NAFDAC requirements, covering governance, personnel, procedures, case handling, signal detection, records, vendor oversight and audit.
What happens during a pharmacovigilance compliance audit?
An audit evaluates the pharmacovigilance system against defined criteria, examines evidence, and produces findings. NAFDAC requires holders to perform regular audits and self audits, to keep the records, and to develop and implement corrective and preventive actions based on the findings. NAFDAC may also conduct its own inspections at any time and must be permitted to access, copy and verify pharmacovigilance records.
Official regulatory sources
- National Agency for Food and Drug Administration and Control. NAFDAC Good Pharmacovigilance Practice Guidelines (Doc. Ref. PV/PMS-GDL-017-01). https://www.nafdac.gov.ng/wp-content/uploads/Files/Resources/Guidelines/PVG_GUIDELINES/NAFDAC-Guidelines-on-Good-Pharmacovigilance-2021.pdf
- National Agency for Food and Drug Administration and Control. Good Pharmacovigilance Practice Regulations, 2021.
- National Agency for Food and Drug Administration and Control. Good Vigilance Practice Regulations, published pharmacovigilance regulations document.
- National Agency for Food and Drug Administration and Control. Pharmacovigilance and Post Market Surveillance Guidelines index. Use this page to confirm the current edition of any document referenced above.
- National Agency for Food and Drug Administration and Control. Handling Adverse Drug Reactions (ADRs) and ADR reporting channels.
- National Agency for Food and Drug Administration and Control. Regulatory resources and guidelines index.
- World Health Organization. Egypt and Nigeria medicines regulators achieve high maturity level in WHO classification, 30 March 2022.
- National Agency for Food and Drug Administration and Control. NAFDAC Announces a Transition from Observer Status to Full Membership of the International Council for Harmonisation.
- Uppsala Monitoring Centre. Operating the WHO Programme for International Drug Monitoring.
- MedNova Lifesciences. Pharmacovigilance services, Nigeria and Africa. mednovalife.com/pv.html
- MedNova Lifesciences. Regulatory affairs services, Nigeria and Africa. mednovalife.com/regulatory.html