Most first-time IND sponsors file a pharmacovigilance plan that looks finished and cannot be run. The gaps show up when the first serious adverse event arrives: nobody can point to Day 0, the company core data sheet version used for expectedness, or who compiles the aggregate report. The notes below are the misses that show up over and over. Related reading: what the drug safety inbox actually contains and when Argus or Veeva is more system than the program needs.
Mistake 1: Treating the PV Plan as a Template Exercise
The most common mistake is downloading a pharmacovigilance plan template, filling in the blanks, and filing it with the IND. The document checks a box but describes a program that does not actually exist in the organization.
A PV plan is an operational commitment. It should describe exactly how your team will receive an adverse event report, who is responsible for triage, how cases will be documented, what system will serve as the system of record, how 7-day and 15-day reporting timelines under 21 CFR 312.32 will be tracked, and who has the authority to make the causality and expectedness determinations that drive those timelines.
If you cannot walk an FDA investigator through the actual workflow described in your plan using your actual systems and your actual team, the plan is not finished.
Mistake 2: No System of Record for Adverse Events
Small biotechs frequently handle adverse event intake through a combination of email inboxes, shared spreadsheets, and paper forms. None of these constitute a validated system of record under GAMP 5 or 21 CFR Part 11. When an FDA inspection includes a review of your ICSR handling, the investigator will ask to see an audit trail. A shared Excel file does not have one.
Your PV plan needs to name the system of record. A shared inbox is not one. When that system is Veeva Vault Safety, Oracle Argus, or ArisGlobal LifeSphere, AE Connect integrates with it and with any other safety database. It holds the source narrative, drafts an assessment, and records what a reviewer accepted. Those products remain the system of record. Naming AE Connect in the plan does not replace your own validation work.
Mistake 3: Vague Reporting Timeline Language
PV plans for first-time sponsors frequently include language like "serious adverse events will be reported to the FDA in accordance with 21 CFR 312.32." That sentence is true but operationally useless.
Your plan should specify:
- How clock-start is defined and documented for every case (Day 0 = date of first receipt of minimum valid ICSR criteria)
- Who is responsible for making the seriousness determination and when
- How the expectedness assessment against the current Investigator Brochure is conducted and documented
- Who is responsible for submission and through which pathway (FDA ESG, Safety Reporting Portal)
- What the escalation path is if the responsible person is unavailable on Day 5 of a 7-day case
Vague language around timelines is not just a documentation gap. It is an operational gap that will surface on the first expedited report your team has to process under pressure.
Mistake 4: Ignoring the Aggregate Reporting Obligations
Expedited 7-day and 15-day reports get most of the attention from first-time sponsors. Aggregate safety reporting obligations get overlooked.
Under 21 CFR 312.33, IND sponsors are required to submit an Annual Report that includes a summary of IND safety information, including a line listing of serious adverse events and a narrative summary of significant safety findings from the reporting period. If your program has global reach, a Development Safety Update Report (DSUR) under ICH E2F may also apply.
Your PV plan should address both expedited and aggregate reporting, including who is responsible for compiling the annual safety summary, what data sources feed into it, and what the internal review and approval process looks like before submission. An intake tool does not write the DSUR or the IND annual report. If the cases never leave email, the person compiling the aggregate report is reconstructing the year from a mailbox.
The company core data sheet is part of the plan
Expectedness is a comparison, not a feeling. For a marketed product the reference is the company core data sheet. For an IND-stage program it is usually the current Investigator's Brochure, which is doing the CCDS's job until you have one. First plans often say "expectedness will be assessed" and never name the document, the version, or who updates the assessment when the IB changes.
That version is what makes a serious case a SUSAR or not, and it is what the aggregate report is summarizing against. Put it in the plan: document name, owner, where the current PDF lives, and how a new version reaches the person doing triage. AE Connect can draft an expectedness suggestion from the narrative you paste. It does not store or author the company core data sheet, and a reviewer still makes the call against the document you actually have on file.
Mistake 5: Writing the Plan in Isolation from the Clinical Team
Pharmacovigilance plans written entirely by the drug safety or regulatory team without input from clinical operations tend to have a critical gap: they do not account for how adverse events will actually reach the safety desk from clinical sites.
Your plan needs to describe the full chain of custody from the site level to the safety database. How will site staff report an adverse event? What is the expected timeframe from site awareness to sponsor awareness? How does that interface with your clock-start definition? Are investigators trained on your specific reporting requirements, or are they relying on the general instructions in the protocol?
These questions need to be answered in the PV plan and in investigator training materials, not left to informal understanding. When an event occurs at a site at 4pm on a Friday, your team should not be improvising the intake process.
- Named roles and backups for every safety function, not just job titles
- A validated, designated system of record for all ICSR case management
- Explicit clock-start definition and timeline tracking process
- Expectedness assessment tied to a named, versioned Investigator's Brochure or company core data sheet
- Both expedited and aggregate reporting obligations addressed
- Site-level to sponsor intake pathway documented and tested
- ESG account established and test submissions validated before the first report
- Version-controlled document with a defined review frequency
The Bottom Line
A pharmacovigilance plan that cannot be executed is a liability, not an asset. Regulators are not looking for beautiful documents. They are looking for evidence that your organization understands its obligations and has built a real operational structure to meet them.
If the plan cannot be walked with the inbox you actually have, it is not finished. The AE Connect workspace is a place to put the narrative, draft the assessment, and keep the reviewer's decision. E2B(R3) submission, the company core data sheet, and the aggregate report stay with the process you write down. The E2B(R3) checklist is the submission side of that same question.