AUDIT AND INSPECTION READINESS CHECKLIST

This checklist is one of many resources available on the PIPA website. It was designed to help medical information departments identify key points to focus on during the preparation for an inspection, and has been recently updated. A downloadable version is available via https://pipaonline.org/medical-information/inspection-checklist/

Do your MI processes align with global and regional documentation, and if there are any local variations are these documented? Can you describe each step? Can you clearly indicate the relationship with Pharmacovigilance and Quality Assurance to ensure adverse events (AEs) and product quality complaints (PQCs) are reported? Are you able to describe the process for handling MI requests on safety related topics?

Do you have a process in place for reconciliation of AEs/PQCs, reported by MI? If your medical information database is interfaced with the PV or the Quality database, are there regular checks to ensure the systems are exchanging the relevant information such as MI details needed for the AE report, and the AE report tracking number for MI to add to the case in the MI enquiry system?

Can you retrieve all up-to-date MI applicable standard operating procedures (SOPs)/working practices and any relevant documented local business processes? (e.g. SOPs/working practices describing company requirements and processes followed by MI staff to report AEs/PQCs, to comply with copyright, data protection etc).

Process Details

Do you have a local policy / regulatory requirement for retaining hard copy source documents? If so, have you ensured that your archiving procedure is clear? If you are taking detailed paper notes prior to logging into your database, do you ensure that the notes are scanned and attached to the system?

Do you provide an out of hours service? If so, do you have a process flow chart or documentation to support this service? Is testing of the service performed and adequately documented? If you do not provide an out of hours service, do you have a process to ensure AEs and PQCs are handled/processed in the required timeframe (if reported) (e.g. left on voicemail after business hours, during a holiday shutdown, system outage)?

Do you have a current disaster recovery/business continuity plan that covers your processes, as appropriate?

What type of back up do you have for your department to show continuous daily business hour coverage? (i.e. to ensure AEs and PQCs are handled/processed in the required timeframe).

Process Roles

Job descriptions - does a job description exist for all positions in MI (contract or permanent)? (The job description should describe all key activities of the current role).

Training

Can you provide the role based curriculum for MI in your country/location if asked?

Are training records for MI staff complete?

Do you have an onboarding/training program for new MI staff? Is this documented?

Are the onboarding/training materials (slide decks etc.) for MI staff easily retrievable?

Do you have evidence of MI role-specific training that MI professionals need to undertake regularly, to perform their role? e.g. ABPI Code and other pharmaceutical regulations; internal annual AE reporting training; product and disease state training; miscellaneous annual training etc.

For training completed outside of the training system, e.g. external courses, training at conferences, etc. have you added these to your training system and do they show in your electronic training transcript? If not, do you have documentation (e.g. training roster[s]) as a record of the training?

For other types of training that you provide (e.g. sales representatives, external business partners [e.g. call centre agents] etc.), do you have retrievable training materials and training rosters?

Personnel

Is an up-to-date CV available for all MI staff (permanent and contract, including all call centre staff [if any])? Are CV(s) easily retrievable if requested? (Note: CVs for contract staff may be held by the supplier/vendor but should be readily available on request). Are CV(s) updated, signed and dated on an annual basis?

Does the CV align with the job description i.e. do the skills and qualifications of the personnel in the role (this includes past employees) match with those required to perform the job?

Do you have an up-to-date organisational chart?

Contracts

Do you have service contracts for outsourced MI service providers (if any)? Are these contracts easily retrievable? Do these contracts depict clear procedures for the handling of AEs/PQCs reports by these partners?

Monitoring

Can you describe the quality monitoring program for your database/system? Do you know who to contact globally if questions outside of your scope are asked?

Do you have a process for monitoring the quality of MI responses provided by outsourced MI service providers? If so, is this process documented? Can you show evidence (documentation) that this is conducted on a regular basis?

Do you have a documented approval/withdrawal process for non-promotional materials that the medical information team are responsible for creating/updating/disseminating e.g. scientific decks for Medical Scientific Liaison (MSLs)? Do you perform spot checks on random job bags/materials to check for compliance with the process?

If you are involved in the provision of risk minimisation materials, do you have a monitoring process in place to ensure that these are sent in line with the specific product’s risk minimisation plan?

Regulations

Can you show how you document off-label MI requests (if required) and/or off-label patient exposure? Can you describe how you determine if patient exposure is off-label?

Can you show how you comply with data privacy and copyright regulations applicable to your country/location?

Inspection

For your department/location, have you assigned the appropriate inspection designee(s)? (Departments/locations may have one or more personnel designated as the point-of-contact for inspections).

Have all MI staff received inspection readiness training? And is this documented?

Are you aware of any previous audit/inspection findings impacting MI? Are they resolved? If they are not resolved, can you explain the status of those findings?

Mi Databases

Are you able to easily retrieve MI enquiry data from your MI database? e.g. in an excel report format.

Can you run the report within your team, or do you have to request this via your MI outsourced vendor?

If using an outsourced vendor do they use your MI system? If so, do you regularly train them on updates to the system?

What is the process for informing the MI teams and keeping them up to date with training and any new releases of the MI system(s)?

If your outsourced provider uses their MI system, do you have access to the system to perform quality checks?

What procedure do you have in place in case the outsourced vendor has a system outage?

If you are changing MI systems, have you ensured that you have considered how to access legacy MI enquiries? (For example, via a report that is saved internally, or via an offline version of the decommissioned system, or by migrating the enquiry data into the new system.)

Is your system validated? Can you guarantee you get the same results each time you run a query against it?

Are appropriate security measures in place so only the correct people are able to access and view enquiries and enquiry responses?

Do you run regular system tests to ensure everything is working correctly?

If your MI team is global, are appropriate local data protection rules followed? Do you have appropriate data retention and data privacy policies in place?

Do you have a process document that explains who has access to the database and why?

Mi Telephone Lines And Calls

Do you use a local rate/freephone medical information phone number? If you use an 0845 or other business rate phone number, have you considered the potential implications of this to patient safety due to the potential call charges?

Do you have ownership of the medical information phone number or is it owned by a third party/outsourced vendor? What contracts do you have in place around this?

Do you or the Quality department regularly check the status of the medical information phone line and perform test calls? Are the line checks and test calls logged in an accessible place, if asked for evidence?

If you change the telephone number, have you conducted an impact assessment to work out where the number appears and what materials/assets need to be updated - including digital assets such as websites as well as product packaging/labelling?

What are your business continuity procedures if there is a phone line outage?

Do you perform regular quality checks of calls handled by the MI team (if calls are recorded)?