1.0 OBJECTIVE:
1.1 The objective of this Standard Operating Procedure is to define a structured and comprehensive Business Continuity Plan for Pharmacovigilance that ensures uninterrupted access to essential PV systems, tools, communication channels, and critical safety functions during any emergency or disruption that prevents routine operations from being performed in the usual manner.

1.2 This SOP describes the controlled approach for initiating alternative access arrangements, implementing predefined mitigation measures, performing continuity checks, documenting temporary operations, and verifying the readiness of PV systems during emergencies, in accordance with applicable regulatory expectations under EU-GVP Module I and WHO Pharmacovigilance Guidelines.

2.0 SCOPE:
2.1 This SOP applies to all PV activities performed internally or through contracted partners, and all PV personnel, QPPV, Deputy QPPV, IT team, RA, and key cross-functional stakeholders.

3.0 RESPONSIBILITIES:
3.1. Pharmacovigilance (PV) Department:
3.1.1 To activate continuity measures when access to PV systems is impaired.
3.1.2 To verify availability and functionality of predefined mitigation controls.
3.1.3 To maintain emergency communication pathways and ensure PV information continues to be received.
3.1.4 To maintain BCP-related documentation including activation logs, communication logs, and mitigation test outcomes.
3.1.5 To oversee BCP activation and ensure continuity of all legally required PV obligations.
3.1.6 To approve initiation and completion of BCP operations during an emergency.
3.1.7 To ensure the Deputy QPPV is available and capable of assuming duties where required.
3.2. Regulatory Affairs (RA):
3.2.1 To ensure emergency communication pathways with regulatory authorities remain operational.
3.2.2 To support PV where alternate reporting channels become necessary.

3.3. Quality Assurance (QA):
3.3.1 To verify BCP documentation, deviations, and CAPAs arising from disruptions or mock tests.
3.3.2 To ensure compliance with Quality Management System requirements.

4.0 DEFINATIONS:
4.1 Business Continuity Plan (BCP): A structured plan that ensures continuation of essential PV activities when normal systems, tools, or resources become unavailable.

4.2 Critical PV Processes: ICSR intake, case processing, regulatory reporting, literature monitoring, and safety communication, all of which have strict regulatory timelines and cannot be interrupted.

4.3 Minimum Operational Capability: The minimum level of PV functioning required to meet regulatory obligations even during an emergency.

4.4 Fallback Procedure: A temporary alternative manual or semi-manual process activated during system outages to ensure continuity.

4.5 QPPV (Qualified Person for Pharmacovigilance): Person legally responsible for PV system oversight, including continuity during disruptions.

5.0 PROCEDURE:
5.1 Identification of a Continuity-Impacting Event:
5.1.1 Any PV personnel who identify a system-related, infrastructure-related, or personnel-related disruption that may hinder routine PV operations shall immediately notify QPPV, Deputy QPPV, IT, RA, and QA, providing details on the nature and expected impact of the disruption.

5.1.2 Examples of continuity-impacting events include but are not limited to loss of access to the PV mailbox, inability to log into PV systems, loss of VPN connectivity, failure of laptop or workstation, and situations in which PV personnel cannot access the office environment.

5.2 Activation of the Business Continuity Plan:
5.2.1 The QPPV shall evaluate the impact of the disruption and approve activation of the BCP if continuity of essential PV functions cannot be maintained through normal procedures.

5.2.2 Upon activation, the PV personnel shall initiate the BCP Activation Log and begin implementing mitigation measures described in this SOP.

5.3 Emergency Access to PV Systems:
5.3.1 Alternate PV mailbox credentials, secondary email accounts, or backup cloud-based access shall be used if the primary mailbox is inaccessible. Access details shall be maintained in the controlled PV Emergency Contact & Access Register.

5.3.2 If the safety database cannot be accessed through the standard login, PV shall attempt login through alternate VPN routes, backup virtual machines, or remote access pathways facilitated by IT.

5.3.3 In situations where primary laptops or workstations fail, pre-assigned backup laptops shall be used. If backup hardware is unavailable, secure login through personal devices may be permitted under QPPV and IT approval, following data protection controls.
5.3.4 If internet connectivity is interrupted, PV shall use mobile hotspot, backup network cards, or alternate office connectivity options, subject to IT clearance.

5.4 Mitigation Measures and Their Utilization:
5.4.1 PV shall use predefined fallback communication channels such as alternate email IDs, backup mobile phones, or emergency messaging tools to ensure uninterrupted receipt of PV information.

5.4.2 If digital storage systems are inaccessible, PV shall use offline templates, controlled hard copies, or pre-downloaded resources essential for continuity.

5.4.3 QPPV and Deputy QPPV emergency contact details shall always remain accessible through printed or offline contact directories maintained by PV.

5.4.4 All mitigation measures utilized during an emergency shall be documented in the BCP Activation Log.

5.5 Communication Requirements During Continuity Events:
5.5.1 PV shall initiate the BCP Communication Log to document all critical internal and external communications made during the continuity period.

5.5.2 Where continuity events are expected to create delays in meeting PV timelines, RA shall be informed to initiate proactive communication with applicable regulatory authorities.

5.6 Monitoring and Verification of Mitigation Controls:
5.6.1 PV shall verify that all mitigation controls remain functional throughout the continuity event. Any malfunctioning control shall be escalated immediately to IT and QPPV.

5.6.2 PV shall confirm that emergency access tools are being used correctly and consistently as per the defined procedures.
5.7 Deactivation of the BCP:
5.7.1 Once PV confirms that normal access to systems, tools, and communication pathways has been restored, the QPPV shall approve deactivation of BCP procedures.

5.7.2 PV shall complete all required documentation including the BCP Deviation & Reconciliation Report, summarizing activities performed during the continuity period.

5.8 Periodic Mock Testing of the BCP:
5.8.1 BCP mock testing shall be conducted at least once every 12 months to ensure continued readiness of mitigation measures.

5.8.2 The mock test shall simulate realistic emergency scenarios such as mailbox unavailability, loss of VPN access, or workstation failure.

5.8.3 Each mock test shall be documented using the BCP Mock Testing Form, and outcomes shall be reviewed by QA.

5.8.4 Any gaps identified during mock testing shall result in corrective and preventive actions.

6.0 REFERENCES:
6.1 WHO Technical Report Series (TRS) – PV guidance

6.2 EU Good Pharmacovigilance Practices (GVP)

6.3 Company QMS SOPs (Document Control, Training, Audit, Risk Management, Deviation & CAPA)

7.0 RECORDS:
Sr No. Title Document No.
1 BCP Activation Log F/PV010/001 – 00
2 BCP Deviation & Reconciliation Report F/PV010/002 – 00
3 BCP Mock Testing Form F/PV010/003 – 00
4 PV Emergency Access Register F/PV010/004 – 00

8.0 REVISION HISTORY.
Amendment Date: Update Summary Version No.
NA New SOP 01