5 Pharmacovigilance Compliance Mistakes Nigerian Pharma Companies Make

Treating pharmacovigilance as an adverse event inbox

What it looks like

A shared email address receives side-effect reports. A member of staff, often in regulatory affairs or medical information, fills in a form and submits it. The case is filed. Nobody can describe the procedure that governs this, because there is not one. When asked about the company's pharmacovigilance system, management points to the submission record.

What NAFDAC actually requires

NAFDAC's guidelines define a pharmacovigilance system as a quality system used by the Certificate of Registration Holder to fulfil its regulatory responsibilities, designed to monitor the safety of authorised products and to detect any change to their benefit to risk balance. The guidelines then name the processes treated as critical. Case handling is only one of them. The list also includes continuous safety profile monitoring and benefit to risk evaluation, risk management and evaluation of risk minimisation, signal detection and management, periodic safety update reporting, responding to Agency requests, interaction between pharmacovigilance and the product quality defect system, safety communication, keeping product information current, and implementing safety variations. Every element of the quality system must be documented in written policies and procedures.

The fix

• Write down the system as it is today, honestly, including what is missing
• Map each of NAFDAC's critical processes to a named owner and a written procedure
• Issue standard operating procedures for intake, validation, follow up, submission, signal management, safety communication, deviation handling and archiving
• Define performance indicators and start measuring them
• Put business continuity arrangements in place for the critical processes

Evidence to retain

A controlled SOP library with version history, a process map with owners, performance indicator results and a business continuity plan. Our breakdown of what GVP compliance means in Nigeria sets out the full system in detail.

A QPPV in name only

What it looks like

A QPPV has been named to NAFDAC, but the person sits in a regional office outside Nigeria, or holds the role alongside a full-time commercial job with no protected time. There is no documented deputy. The QPPV cannot access the safety database outside office hours. Nobody told the QPPV about the product the company acquired last quarter, and the QPPV was not consulted on the vendor contract that now handles case processing.

What NAFDAC actually requires

The Certificate of Registration Holder must have an appropriately qualified QPPV permanently and continuously at its disposal, and the guidelines state that the QPPV should reside and operate in Nigeria. Beyond residency, the requirements are about substance, not titles:

• The QPPV's duties must be defined in a job description, and the reporting line shown on an organisational chart
• The company must give the QPPV sufficient authority to influence the performance of the quality system and the pharmacovigilance activities
• The QPPV must have access to, and authority over, the Pharmacovigilance System Master File
• Back-up procedures must exist for the QPPV's absence, and the deputy must hold all the information needed to act
• The company must have a procedure enabling the QPPV to obtain information from the safety database at any time, including outside normal working hours, to answer urgent Agency requests
• The QPPV acts as the single pharmacovigilance contact point for the Agency on a 24-hour basis and as the contact point for inspections
• The company must provide the QPPV with training on its pharmacovigilance system before the QPPV takes up the position
• The QPPV should be notified as early as possible in due diligence when the company plans to acquire products, and involved early when partnerships affect the pharmacovigilance system
• Tasks delegated by the QPPV must be documented

The 2018 situational analysis cited above recorded NAFDAC's concern about the competence of some QPPVs. Competence is not only a matter of qualifications. A capable QPPV without authority, access or cover cannot discharge the role.

The fix

• Confirm the QPPV resides and operates in Nigeria, and notify NAFDAC of the name and contact details
• Issue a job description and place the QPPV on the organisational chart with a clear reporting line
• Appoint and train a deputy, and document the handover procedure
• Establish and test out-of-hours access to the safety database
• Write the QPPV into due diligence, partnership and vendor contracting procedures
• Document every delegated task

Evidence to retain

The appointment letter and NAFDAC notification, the curriculum vitae, the job description, the organisational chart, the deputy appointment, training records for the QPPV and deputy, the out-of-hours access procedure with a test record, and the delegation log. MedNova provides local QPPV representation in Nigeria, and our QPPV Support Essentials guidance covers governance and oversight.

Letting cases leak at the edges

What it looks like

A medical representative hears from a pharmacist that a patient was hospitalised after starting a product, and mentions it in a monthly sales report. A product complaint arrives at the quality department describing a rash, and is investigated as a packaging issue. A distributor keeps its own log of customer complaints and never shares it. The pharmacovigilance team processes every case it receives, correctly. It never receives these.

What NAFDAC actually requires

• Adequate training for staff whose activities may affect the pharmacovigilance system even though they hold no pharmacovigilance role, naming clinical trials, technical product complaints, medical information, sales and marketing, regulatory affairs, legal affairs and audit
• Interaction between the pharmacovigilance and product quality defect systems treated as a critical process
• The master file must describe all parties responsible for solicited and spontaneous case collection, including medical information sites, affiliates, licensing partners and local distribution or marketing arrangements
• Subcontracted pharmacovigilance tasks governed by detailed, current written agreements describing delegation and each party's responsibilities, with the delegated activities described in the master file and the subcontracts listed in its annex

The company retains full responsibility for the quality and integrity of the system, and regular risk-based audits of the other organisation are recommended. The vendor may itself be inspected at the Agency's discretion.

The fix

• Map every route by which safety information can enter the company, including sales, quality, medical information, customer service, social media channels the company controls, distributors, licensing partners and patient programmes
• Train every function on that map to recognise and forward safety information, with a defined forwarding timeline, and record the training
• Reconcile the safety database against quality complaint and medical information records on a fixed cycle
• Execute a pharmacovigilance agreement with every distributor, partner and vendor that could receive safety information
• Audit key partners on a risk basis and track findings to closure
• Record the receipt date as the day any company employee or contracted party first received the information, not the day the safety team saw it

Evidence to retain

The intake channel map, training records for non-pharmacovigilance staff, reconciliation records with discrepancies and resolutions, signed pharmacovigilance agreements, the subcontract list in the master file annex, and partner audit reports. Our medical information and adverse drug reaction glossary entries set out the definitions staff need to recognise a case.

Processing cases but never reviewing them together

What it looks like

Every case is validated, coded, followed up and submitted on time. The case processing metrics look excellent. But nobody has ever sat down with all the cases for a product and asked whether they show a pattern. There is no signal detection procedure. When asked what signals the company identified in the last two years, the answer is none, and there is no record of anyone having looked.

What NAFDAC actually requires

Signal detection and management is named as a critical pharmacovigilance process in NAFDAC's guidelines, alongside continuous safety profile monitoring and benefit to risk evaluation. The master file must describe the process for continuous monitoring of the product's benefit to risk profile, including signal generation, detection and evaluation, and the decision-making that follows. The company must also have procedures for continuous monitoring of pharmacovigilance data and scientific evaluation of all information on product risks.

The same 2018 situational analysis observed that PSURs submitted to NAFDAC often lacked Nigeria-specific data, and that Nigerian risk management plans were difficult to adapt to the local situation because that situation was unknown. Both are downstream consequences of cases being processed but never analysed.

The fix

• Write a signal detection procedure that states the method, the data sources, the frequency, the roles and the escalation route
• Adopt a designated medical event list so that clinically significant events trigger review on a single occurrence
• Run cumulative review by product on a fixed cycle, reading the case series rather than counting it
• Review safety actions taken by other regulators on the same molecule, since signals arising outside Nigeria are in scope
• Minute every review, including reviews that identified nothing
• Feed conclusions into the risk management plan, product information and aggregate reports

Evidence to retain

The signal detection procedure, review minutes with attendees, method and data sources, validation decisions with reasoning, signal assessments and the actions that followed. Our article on signal detection in pharmacovigilance in Nigeria explains why standard statistical methods underperform on small Nigerian datasets and what to use instead, and the glossary entry on the Risk Management Plan sets out where conclusions should land.

Running a system you cannot prove

What it looks like

The company does most things reasonably well, but the evidence is scattered or missing. The Pharmacovigilance System Master File was written for the registration application three years ago and has not been touched since. Nobody can say what percentage of serious cases went in on time last year. An audit was scheduled and postponed twice. A finding from the last partner audit is still open, and nobody is sure who owns it. In an inspection, this company looks almost identical to one that does nothing at all.

What NAFDAC actually requires

• The master file must contain evidence of ongoing monitoring of system performance, including an explanation of how correct ICSR reporting is assessed and figures showing the timeliness of 15-day and 90-day reporting over the past year
• A list of performance indicators must be provided in the master file annex alongside actual measured results
• Changes to the master file must be recorded in a logbook showing the date, the person responsible and the nature of each change
• The master file must hold a list of completed audits covering five years and the audit schedule
• Where an audit raises a significant finding, a note stays in the master file until corrective action is demonstrably complete or independently verified
• A record management system must ensure retrievability and traceability of the measures taken to investigate safety concerns, their timelines and the decisions reached
• The QPPV must be informed of scheduled audits, must be able to trigger an audit, and must receive the corrective and preventive action plan after each audit

The fix

• Instrument the case workflow so that receipt date, submission date and elapsed days are captured automatically
• Report reporting timeliness monthly and review it at management level
• Assign a master file owner, set up the change-control logbook and review the file on a defined cycle
• Publish an audit schedule, complete audits on time, and track every corrective action to verified closure
• Set record retention periods and confirm records can be retrieved within minutes, not days
• Run a mock inspection before NAFDAC runs a real one

Evidence to retain

The current master file with logbook, timeliness figures and graphs, performance indicators with results, the audit schedule and five-year audit list, CAPA records with effectiveness checks, and mock inspection reports. Our PV Readiness Guide covers inspection preparation in depth.