About GxPVigilance

The questions below come up most often in scoping calls — what a GxP audit actually assesses, what Australian sponsors are obliged to do, and what governed AI adoption looks like in a regulated environment.

What does a GxP auditor do in Australia?

A GxP auditor independently assesses how regulated activities are actually performed, not what the procedures claim. In Australia that covers Good Clinical Practice (GCP) for clinical trials, Good Pharmacovigilance Practice (GVP), Good Laboratory Practice (GLP), and the quality management system holding them together.

The TGA expects sponsors to maintain oversight of the activities they contract out. An independent audit is one of the few ways to discharge that obligation with evidence rather than assurance.

We audit against ICH E6(R3) and TGA inspection expectations, and we write findings to the standard an inspector would apply — evidence, traceability, escalation, and whether CAPA actually worked. You get findings with realistic closure timelines, not a report to file.

Do Australian pharmaceutical sponsors need a QPPV?

No. Australia has no QPPV requirement equivalent to EU GVP Module I. That does not reduce the underlying obligation.

Sponsors holding ARTG entries remain responsible for operating a pharmacovigilance system and meeting TGA safety reporting timeframes. Most appoint an Australian Pharmacovigilance Contact Person (A-PVCP) to hold TGA correspondence and local reporting.

We design A-PVCP arrangements and QPPV-aligned governance for sponsors carrying international obligations. Where we hold the role, it comes with active oversight — metrics, escalation paths, and documented decisions — not a name on paper.

What is AI governance in a GxP environment?

AI governance is the documented answer to three questions a regulator will ask: who approved this system, how do you know it works, and what happens when it gets something wrong.

In practice that means defining which tools are used, for what purpose, under what controls, with which human approval points, and how outputs are reviewed and retained as records. ISO/IEC 42001 and GAMP 5 (Second Edition, including Appendix D11) are the frameworks we work to. The work covers risk classification of each use case, human-in-the-loop design, audit trail requirements, change control for model updates, and validation evidence.

Governance before automation. Human oversight before scale.

What is the difference between GCP and GVP auditing?

GCP auditing looks at how a clinical trial is run — design, conduct, documentation, delegation, and oversight against ICH E6(R3) and TGA expectations. GVP auditing looks at the safety system — how adverse events are captured, assessed, reported within timeframes, reconciled, and followed up.

They fail in different ways. A trial can be well run and still carry a safety reporting gap; a safety system can be sound while site oversight drifts. Sponsors with obligations in both areas need both assessed.

We run them separately, or as one combined programme where the same vendors and systems sit behind both.

How long does a pharmacovigilance system audit take?

Plan on two to four weeks end to end. The assessment itself is short — typically one to two days, remote or on-site — but the schedule around it determines the date.

We lock the agenda two weeks before an on-site audit, or two and a half to three weeks for remote and complex audits, with the document request issued a week ahead. Tentative findings are discussed at close-out on the day. The draft report is issued within ten working days, and you have five to ten working days for factual accuracy review before the final report.

Scope, the number of contracted providers in the chain, and how much evidence the auditee has ready are what move that timeline. CAPA remains yours to own; plan review, monitoring, and effectiveness verification are available as separate tiers if you want support closing it.

What does ‘human-in-the-loop’ mean for AI in pharmaceutical operations?

It means a qualified person reviews and approves any AI-generated output before it becomes part of a regulated record or decision.

Treat it as a regulatory control rather than a precaution. TGA, ICH and GAMP 5 all expect documented human accountability for decisions affecting product quality and patient safety, and “the system generated it” is not a defensible answer at inspection.

We build the approval points into the workflow itself — who reviews, at what stage, against what criteria, with the decision logged. AI supports — humans approve.

What is ICH E6(R3) and how does it affect Australian clinical trials?

ICH E6(R3) is the current Good Clinical Practice guideline. It moves GCP from prescriptive compliance toward risk-proportionate quality — critical-to-quality factors identified up front, quality management built into the protocol, and explicit expectations for data governance across electronic systems.

The TGA recognises ICH guidelines and expects Australian sponsors and CROs to be operating to current E6 expectations. The practical effect is that a monitoring plan or oversight model designed under R2 will not automatically satisfy an R3 assessment.

We audit against E6(R3) and support sponsors working through the transition, including where legacy studies and R2-era vendor agreements are still running.