6th April 2020

Using Third Parties in Business Continuity Plans

Outsourcing of at least some of the activities associated with the pharmacovigilance system is common across the pharmaceutical industry.

Indeed, multi layers of sub-contracting often leads to a complex matrix of parties involved.  An indicative example is below:

So, whilst the sponsor may delegate certain responsibilities to a variety of providers and those providers may also do the same, the sponsor remains ultimately accountable for all aspects;  When a Competent Authority assess a sponsor’s delivery of pharmacovigilance, issues that arise from areas with the root cause in either the contractual arrangement or the delivery of services by a third-party form part of the overall compliance of the sponsor.

One of the risk mitigating activities required of third-parties is to have a robust Business Continuity Plan (BCP).  Our definition of a BCP is:

“…to prepare pharmasol to continue with business operations in the event of an emergency, crisis or disaster, regardless of the cause. The objectives of this business continuity plan are to:

• Assess risks to business continuity and define appropriate mitigation.
• Define the general procedure to follow in case of a disaster to ensure business continuity.”

This assures that the agreed third-party services can continue, albeit often in either a reduced or alternative way, during a period when that service is adversely impacted.

This is all well and good when the service being provided is fully covered by an existing contractual agreement and therefore the vendor’s BCP.

But what if the service being sought is only relevant when an event occurs that would require the invocation of the BCP, such as a need to provide additional services due to an office or staff being unavailable?

Well, in those situations it is necessary to consider these services in the same way as any standard third-party services you might be drawing upon on a regular basis.  That is, the services should be defined, reviewed, approved and managed in-line with your internal procedures as if they were standard services.

This is likely to include:

• Ensuring that the third party is competent and authorized to carry out the service(s) (most often via an audit)
• Ensuring a fully signed contract for the services is in place (including a definition of the level of service that is required)
• Ensuring that appropriate Non-Disclosure Agreements are in place
• Ensuring that regular follow-up/reviews of the vendor and contract are conducted

This may seem overkill, especially for a service that you hope will never be needed.  However, it will of course be necessary to satisfy an inspector or auditor (and of course the business) that the Business Continuity Plan is ready to be invoked when necessary.

pharmasol provides Argus administration Business Process Outsourcing (BPO) services (Products, License and Study management; user management; report creation and more) to our SaaS and Hosted Customers on a regular basis and on demand.

Through the BPO service we enable customers to quickly extend their organization without the need to identify, onboard or train additional staff.   And of course, high availability of a broad resource pool of technical, computerized system validation and process experts comes as standard.  The BPO model is further discussed in a previous article.

But what if you are not a current customer?  Well the good news is that pharmasol can now offer this on-demand service to our non-client customers to both bridge any expected gap in resources or for inclusion into BCPs.  We have a dedicated, experienced pharmacovigilance team and full customer support infrastructure including help desk, in-house technical support, self-help articles, training and documented working procedures.

If you would like to know more about our Business Process Outsourcing services, please get in contact using the form at the bottom of the page