Follow up reports and missing information: when the next clock starts

A follow up is either the message that finally makes an incomplete report into a case, or a later message about a case you already have. At a small biotech both messages usually arrive by email. The first one names a rash and a product and leaves out the patient. The reply, a few days later, adds an age, a hospital admission, or a lot number, and the subject line does not name the case. If those two messages are not stored as one case, with the date of each one, the company cannot tell which clock started, or whether it started at all.

That is a patient safety problem, not a filing inconvenience. A serious unexpected reaction that stays incomplete is a reaction nobody has fully evaluated. A receipt date that lives only in a mailbox is a clock nobody can defend. The drug safety inbox is where those messages get lost. This page is about what to do with the second message, and with the questions that never get an answer. It is not a standard operating procedure. The procedure should cite the text the company actually follows.

A missing criterion is not the same as a thin case

FDA's E2D(R1) guidance for industry (March 2026) is the agency's current thinking on postapproval individual case safety reports. The notice of availability is 91 FR 10619, published on 4 March 2026. The guidance says it does not establish rights, it is not binding on FDA or the public, and a different approach is acceptable if it meets the applicable statutes and regulations. The ICH Step 4 text was adopted on 15 September 2025. Section 2.2 in both documents lists the minimum criteria: at least one adverse event or adverse drug reaction, or another observation the document covers; at least one suspect or interacting medicinal product; an identifiable patient; and an identifiable reporter. A case missing any of those does not qualify for ICSR reporting. The same section says the company should exercise due diligence to collect the missing criterion, and it points that work to section 6.4.

EU GVP Module VI (Rev 2) section VI.B.2 uses a related list, and it is not a copy of the ICH sentence. A valid ICSR needs an identifiable reporter, one identifiable patient, at least one suspected adverse reaction, and at least one suspect medicinal product. The module also says a report is not valid if the primary source has explicitly excluded a causal relationship and the company agrees, or if the reaction is unspecified. Read that section before you treat an ICH "other observation" as an EU ICSR. What a patient or healthcare professional has to be asked in the first place is on the reporter forms page. This page does not repeat that form.

A case can meet those criteria and still be thin. Outcome, dose, lot, labs, and medical history can all be absent. Those gaps do not, by themselves, keep the case from being an ICSR under the texts above. They are the reason you ask follow up questions. The FDA E2B(R3) implementation guide section 3.3.1 uses the same four items as the minimum for a valid safety report (an identifiable patient, an identifiable reporter, one adverse event or reaction or outcome, and one suspect or interacting drug) and then says that for most reports a number of data elements will be unknown and therefore not transmitted. Unknown is allowed. A missing minimum criterion is not.

Write down two dates, because the rules do not share one

Teams collapse three different start dates into one phrase, "day zero." The documents do not.

• ICH day zero. E2D(R1) section 5.2 says the reporting clock starts on the date when any personnel of the marketing authorisation holder obtains enough information to determine that the case meets the minimum criteria. Personnel includes third parties such as service providers and other contractual partners acting for the company. That date is day zero unless a region specifies otherwise. For literature and for digital platforms, the guideline has separate sentences in sections 4.2 and 4.3. Use those sections for those sources. Do not reuse the spontaneous rule without reading them.
• EU day zero. GVP Module VI.B.7 says the clock starts as soon as the information containing the minimum criteria has been brought to the attention of any personnel of the marketing authorisation holder, including medical representatives and contractors. That is day zero even when the information arrives on a weekend or a public holiday. Only a valid ICSR is submitted. The timelines are calendar days.
• US initial receipt. 21 CFR 314.80(c)(1)(i) says each adverse drug experience that is both serious and unexpected is reported as soon as possible and no later than 15 calendar days from initial receipt of the information by the applicant. 21 CFR 600.80(c)(1)(i) uses the same initial receipt rule for a licensed biological product. Neither sentence says the clock waits until the four minimum criteria exist. The content of the ICSR is a different paragraph. The ICSR intake guide and the FDA reporting requirements guide walk through that content list.

The day zero sentence in E2D(R1) section 5.2 is also the sentence in the FDA guidance. It does not rewrite 21 CFR 314.80. Where the two dates differ, keep both. The regulation is what the applicant has to meet. A Friday email that names the product and the rash, and does not identify the patient, has a US receipt date of Friday if the applicant received it on Friday. It may not have an ICH or EU day zero until a later call supplies an age or initials. The procedure should record both dates. The date someone retypes the thread on Monday is a third date, and it is the wrong one for either clock. What late intake does is the process description of the work that waits on a valid case. It is not a mortality estimate, and this page does not add one.

When later information starts a new clock

Once a case exists, new information is not a new case, and it is not always the same kind of clock.

Marketed drugs and biologics in the United States

21 CFR 314.80(c)(1)(ii) says the applicant must promptly investigate all adverse drug experiences that are the subject of these 15 calendar day alerts and must submit followup reports within 15 calendar days of receipt of new information, or as requested by FDA. If additional information is not obtainable, records should be maintained of the unsuccessful steps taken to seek it. 21 CFR 600.80(c)(1)(ii) is the same followup rule for a licensed biological product. The paragraph says "new information." It does not use the EU word "significant." A team that waits to decide whether a fact is significant enough can miss the US date. The procedure should say which text it is applying, and it should not paste the EU filter onto the US sentence.

Followup on an experience that was submitted in a periodic report may go in the next periodic report. That is 21 CFR 314.80(c)(2)(i). The periodic report is the US periodic adverse drug experience report. It is not a PSUR or a PBRER. How those aggregate documents differ, and why an intake workspace does not write them, is on the aggregate reports page. The case data still has to be clean enough for whoever writes the periodic report. A follow up that never gets attached to the case is missing from that report too.

Two smaller US duties are easy to lose in the same mailbox. 21 CFR 314.80(b) says applicants are not required to resubmit adverse drug experience reports that FDA forwarded to them, and that they must submit all followup information on those reports. And if a person whose name is on the label, other than the applicant, chooses to send serious reports to the applicant instead of to FDA, 21 CFR 314.80(c)(1)(iii) gives that person 5 calendar days from their own initial receipt. The applicant then follows the applicant clock. The split belongs in the agreement. The pharmacovigilance agreement page is the note on this site for that contract. The contract does not erase 21 CFR 314.80.

An IND

Investigational follow up is 21 CFR 312.32(d), not 21 CFR 314.80. The sponsor must promptly investigate all safety information it receives. Relevant followup information to an IND safety report must be submitted as soon as the information is available and must be identified as a followup IND safety report. The regulation uses the label "Followup IND Safety Report." Paragraph (d)(2) does not add a second 7 calendar day cap. If the investigation shows that an event not initially determined to be reportable is reportable, paragraph (d)(3) requires an IND safety report as soon as possible and no later than 15 calendar days after the determination. A separate sentence, 21 CFR 312.32(c)(1)(v), covers additional data FDA requests: as soon as possible and no later than 15 calendar days after the sponsor receives the request. The initial 7 calendar day and 15 calendar day IND clocks are the subject of the SUSAR reporting guide. This page does not restate them.

ICH and the EU, after the first report

E2D(R1) section 5.2 says that when additional medically relevant information is received for a previously reported case, the clock begins again for the follow up report. Day zero for that follow up is the date the company receives the additional information. A case that was not expedited becomes expedited if the follow up shows it should be reclassified, for example from not serious to serious, and day zero is the date that follow up was received. An amendment to a previously submitted report, such as a correction from an internal quality review, with no receipt of additional information, does not get a new day zero.

GVP Module VI.B.7 draws a line the US followup paragraph does not draw. Significant follow up is new medical or administrative information that could affect the assessment or management of a case, or could change its seriousness. Information that is not significant includes updated comments on the case assessment, or corrections of typographical errors. When significant follow up is received for a case already submitted, the clock starts again from the date of receipt. Serious valid ICSRs, initial and follow up, are submitted as soon as possible and no later than 15 calendar days after initial receipt of the information by company personnel, including contractors. If a case sent as serious becomes not serious on the new information, that information is still submitted within 15 days. Later follow up then uses the time frame for reports that are not serious.

Section VI.B.3 adds the work before that submission. Reports are often incomplete when they first arrive. They should be followed up as necessary to obtain supplementary detail that matters for the scientific evaluation. The module calls out monitored events of special interest, prospective pregnancy reports, deaths, and cases that report a new risk or a change in a known risk, in addition to the effort to collect any missing minimum criterion. Any attempt to obtain follow up information should be documented.

The same case number, and two dates in the E2B(R3) file

21 CFR 314.80(f)(5) says the ICSR includes whether the report is an initial report or a followup, and a unique case identification number which must be the same in the initial report and any subsequent followup report. A second email that is typed up under a new number splits that history. The person who opens the mail has to look for the existing case before a new number is minted. This page does not claim that a software product will find that duplicate for you.

The electronic shape of the case is E2B(R3). The FDA implementation guide, and the AEMS E2B(R3) data standards page that points sponsors at the regional guide, are the references for the file. Four elements decide whether the follow up is a new story or a correction of the old one:

• C.1.8.1 and C.1.8.2. The worldwide unique case identification number, and the first sender of the case, are populated and are not changed on a later transmission.
• C.1.4. For an initial case, this is the date the information was received from the primary source and the four minimum criteria were met. When you retransmit information that came from another company or a regulator, C.1.4 is the date you first received that information. Do not overwrite it with the date of a later email.
• C.1.5. This is the date of the most recent information for this report. It changes each time follow up information is received from a primary source. On a first report, when that date and the C.1.4 date are the same, the guide says to enter the C.1.4 date in C.1.5.
• C.1.11.1. Use this when a previously transmitted ICSR is nullified or amended. The guide allows 1 for nullification, for example when the whole case was found to be erroneous, and 2 for an amendment, for example when an internal review or an expert opinion corrects the event term, the seriousness, or the causality. For an amendment or a nullification with no new information from a primary source, C.1.5 stays as it was. C.1.11.2 is the reason, and it is required when C.1.11.1 is filled in. If a report that was nullified has to be submitted again, the guide says to assign a new sender report identifier and a new worldwide unique case identification number.

An internal spelling correction is an amendment. A hospital discharge summary that arrives on Thursday is follow up, and C.1.5 moves to Thursday. Calling both of them "an update" is how a clock gets restarted for a typo, or fails to restart for a death. How the file relates to the case, and who actually sends it, is on the E2B(R3) ICSR submissions page. Building the file is not the same job as capturing the Thursday email.

What to ask, and what to keep when nobody answers

E2D(R1) section 6.4 says initial reports often lack what a clinical evaluation needs, and that the company should seek more information, including when the reporter does not have first hand knowledge of the event. The highest priority is a case that is both serious and unexpected. Next are serious expected cases and unexpected cases that are not serious. Cases of special interest, including events under enhanced monitoring at the request of an authority, are prioritized as well. The company should ask specific questions, document every request and every attempt, and use a targeted questionnaire, preferably at the time of the first report. People with pharmacovigilance training and therapeutic expertise should be involved. Section 6.4 also says to be careful before following up a private message on a digital platform the company does not operate, because that contact can breach consent under local privacy law.

For pregnancy reports from a healthcare professional or a consumer, where the embryo or fetus could have been exposed through the mother or the father, section 6.4.1.2 says the company is expected to follow up and to collect the pregnancy outcome, the health of the newborn, and, where appropriate, the development of the child. That expectation does not apply to exposure during pregnancy for a product specifically indicated for use in pregnancy when there is no adverse event. GVP Module VI.B.3 names prospective pregnancy reports as one of the follow ups that matter for the scientific evaluation. This page is not a pregnancy procedure. It is a reminder that some follow up is still required after the first valid case, because the outcome does not exist yet.

The questions that change a clock or a code are usually short. Outcome and the date of the outcome. Whether the patient was hospitalised, and the dates. Dose, route, and the dates of therapy. Whether the event stopped when the product stopped or the dose was reduced, and whether it returned when the product was restarted. Relevant history and labs. A lot number and an expiration date when the story also sounds like a product defect. A lot plus a fever is still an adverse event until someone shows it is not, which is the subject of the product quality complaint guide. Reporter qualification and country, if the EU file needs them and the first email omitted them. The PV case intake form is where those fields should already have a place, so the answer has somewhere to land.

When the answer never comes, the absence is part of the record. 21 CFR 314.80(c)(1)(ii) says to keep the unsuccessful steps. 21 CFR 314.80(j) says the applicant must maintain for 10 years records of all adverse drug experiences known to the applicant, including raw data and any correspondence. A query that lived only in a sent folder, and a reply that lived only in an inbox, are not that record. Email fails here in three ordinary ways. The reply does not carry the case number, so it is opened as a new case. The date the company treats as receipt is the date someone downloaded the mailbox, not the date the message arrived. The unanswered query is never stored, so the unsuccessful steps do not exist on paper either.

Where the follow up has to live

PV case intake is the place the first message and the later message should meet. If Oracle Argus, ArisGlobal LifeSphere, or Veeva Vault Safety is the system of record, it stays the system of record. The comparison tables are on the integrations page. AE Connect does not replace those products, and it is not an official partnership with Oracle, ArisGlobal, or Veeva. It can feed them. It can also be the safety database for the full ICSR and the E2B(R3) file when the company does not run one of those systems yet.

The workspace is customizable electronic intake plus AI triage. You paste the later narrative or you upload a PDF, a Word file, text, an email, a CSV, or an image. The draft covers seriousness, a suggested MedDRA preferred term and system organ class, an Uppsala Monitoring Centre causality category, expectedness, whether regulatory reporting looks required, and a reporting timeline, each with a short rationale. Expectedness is a suggestion to check against the current company core data sheet or the investigator brochure. AE Connect does not author or version that document. A reviewer accepts or overrides every field. The draft is decision support. This workspace does not collect an electronic signature, and it does not transmit the ICSR to the FDA Adverse Event Monitoring System (AEMS), formerly FAERS, or to EudraVigilance. Aggregate reports, including a PSUR, a PBRER, a DSUR, and the US periodic report, stay outside the workspace.

You create a 14 day sandbox at the registration page with your name, a company email, a password, your company name, and your role. After you verify the email, you are the admin of a new organization. The sandbox has unlimited cases. After the sandbox, the annual plans are Starter, Growth, and Scale. This page does not list prices. Questions go to info@qfsnow.com or to the demo form.

A sequence a small team can run this week

1. Save the source and the date any person at the company, including a contractor, received it. Save the later message the same way. Do not replace the first date with the second.
2. Mark which minimum criterion is still missing, using the ICH list and, if you report in the EU, the GVP list. Mark the US receipt date separately when the experience may be serious and unexpected.
3. If a case number already exists for this patient and product, attach the new source to that number. Do not mint a worldwide case number for a reply.
4. Write the specific questions, send them, and file each attempt, including the attempts that get no answer.
5. A person decides whether the new material is US "new information," ICH medically relevant information, EU significant follow up, or an internal correction. That decision picks the clock, the C.1.5 date, and whether C.1.11.1 is an amendment.
6. The safety database, or AE Connect when it is the database, keeps the same case identifier on the E2B(R3) file. Submission to a regulator is a later step, in that system of record.