Every minute, somewhere in the world, an adverse event report is being filed. EudraVigilance alone collected and managed 1,765,581 Individual Case Safety Reports (ICSRs) in 2025, taking its cumulative post-authorisation total to over 29 million reports since 2002.Across the Atlantic, the FDA’s Adverse Event Reporting System (FAERS) held more than 28 million reports as of December 2023, with around 95% of submissions originating from application holders in the pharmaceutical industry rather than direct public reporting.
Behind every one of those reports sits a tightly choreographed workflow. The job of pharmacovigilance case management is to convert a fragmented, often unstructured account of a patient experience into a fully coded, regulator-ready ICSR within tight, expedited reporting windows, with an audit trail that holds up under inspection.
This guide walks through how a spontaneous adverse event report becomes a structured ICSR, what each stage of the workflow is responsible for, and where AI-driven case intake and automation-led safety database tools change what is operationally possible.
What Makes an ICSR Valid: The Four Minimum Criteria
Before any case enters formal processing, it goes through a validity check. ICH E2B(R3), the global standard adopted by the FDA, EMA, PMDA, MHRA, and Health Canada, defines four minimum data elements an ICSR must carry to be accepted for regulatory submission.
- An identifiable patient. Any one of several elements is sufficient: initials, age, gender, date of birth, or a patient identification number.
- An identifiable reporter. A healthcare professional, consumer, or other person who can be contacted for follow-up. Qualification and country are required at a minimum.
- A suspect drug or biological product. Name, dose, route, or partial product details.
- An adverse event or reaction. A specific reaction. A bare outcome (for example, "death") with no clinical context does not qualify.
A report missing any one of these is classified as non-valid. It is still logged for traceability, but it cannot be submitted until follow-up information closes the gap.
Why this matters operationally: Validity is the first quality gate. A weak intake step pushes invalid cases deeper into the workflow, where rework is far more expensive. PV teams that catch validity gaps at the point of intake protect every downstream stage from contaminated data.
| Stage | What Happens | Compliance Anchor |
|---|---|---|
| 1. Case Intake | Reports arrive through call centres (MICC), email, web portals, partner forms, social media monitoring, and literature surveillance. Source documents (CIOMS, MedWatch, SAE forms, free-text emails, voice transcripts) are converted into structured data. | ICH E2D Day 0 starts at receipt of the four minimum elements. This ‘Date of Awareness’ triggers the regulatory clock (7 or 15 calendar days) for expedited submission. |
| 2. Validity Check & Triage | Each report is checked against the four ICH E2B(R3) criteria. Valid cases are then triaged for seriousness using ICH E2D criteria (death, hospitalisation, life-threatening, disability, congenital anomaly, or other medically important events) and routed accordingly. | ICH E2D, GVP Module VI. |
| 3. Data Entry & MedDRA Coding | Reactions, indications, and medical history are coded against MedDRA. Version 28.0 spans 27 System Organ Classes, 26,920 Preferred Terms, and 89,774 Lowest Level Terms, the controlled vocabulary used across global regulators. | ICH M1 (MedDRA), ISO 27953-2. |
| 4. Causality & Narrative | Reviewers apply causality methods (WHO-UMC, Naranjo, or sponsor-defined criteria) to assess the relationship between the suspect product and the event. The case narrative captures the clinical sequence, concomitant medications, medical history, and outcome in structured but readable prose. | WHO-UMC causality categories; sponsor SOPs. |
| 5. Quality & Medical Review | QC reviewers check completeness, coding accuracy, and narrative coherence. A qualified medical reviewer signs off on the clinical assessment before the case can be locked. | 21 CFR Part 11, EU GMP Annex 11 audit trails. |
| 6. E2B(R3) Submission | Validated cases are converted to E2B(R3)-compliant XML and transmitted via secure gateways (typically AS2) to the relevant health authorities. ICH guidelines mandate 7 calendar days for fatal or life-threatening unexpected reactions and 15 days for other serious unexpected reactions. | ICH E2B(R3), regional implementation guides. |
| 7. Follow-up Management | When initial information is incomplete, PV teams issue follow-up queries to the reporter, capturing all correspondence in the audit trail. Each response generates a versioned case record to track the evolution of data. This stage also includes Nullification and Duplicate Management to merge redundant reports. | GVP Module VI Rev. 2. |
50
New molecular entities cleared by the FDA in 2024. Each approval extends a post-marketing surveillance obligation that the sponsoring organization must maintain indefinitely — expanding workloads without automatic increases in team capacity.
A few operational realities the workflow has to absorb
- Validity is the non-negotiable entry point A report only becomes a "case" when it meets the four minimum criteria (identifiable patient, reporter, product, and event). Without these, the regulatory clock cannot start, and the report remains in a "follow-up" status.
- Seriousness assessment is not the same as severity A mild rash that leads to hospitalisation is serious. A severe headache that resolves at home may not be. AI-driven case intake tools can pre-flag candidate seriousness criteria from narrative text, but the determination remains a regulated medical decision.
- Expectedness is the third pillar of triage While seriousness drives the priority, expectedness (whether the event is already listed in the Investigator’s Brochure or Summary of Product Characteristics) determines if a serious case qualifies as a SUSAR (Suspected Unexpected Serious Adverse Reaction). This determines if you are looking at a 7-day or 15-day expedited window.
- MedDRA coding is where signal noise begins or ends Two reviewers coding the same reaction inconsistently across markets distorts aggregate data. Coding suggestions with confidence scores, validated by trained coders, narrow the variance.
- Follow-up is not optional If an initial narrative is missing dose, dates, or outcome, the case is incomplete, and follow-up is mandatory. Regulators expect documented attempts and clear evidence of when information was sought and received.
These principles describe what the intake layer should do. The next question is what implementing them looks like in production.
Where the Modern PV Stack Earns Its Place
Modern ICSR processing succeeds or fails on two axes: how much friction the pipeline carries between intake and submission, and how defensible each step is under regulatory inspection. Patching individual stages with isolated tools tends to leave handoff gaps. Tools that work as a connected stack remove them.
Clinevo OnePV is built around both demands.
- Clinevo Case Intake (GenAI-enabled) Consolidates intake from MICC call centres, email, web portals, and partner forms into a unified workflow. NLP-driven extraction handles unstructured PDF source documents, voice transcripts from AWS Connect telephony , and free-text narratives, proposing pre-populated case forms with confidence scores for human validation. The platform supports CIOMS, MedWatch, and SAE forms, and prioritises cases by seriousness so expedited reports surface first.
- Clinevo Safety Database (automation-led) Manages the full ICSR lifecycle inside the database itself. Workflow automation routes cases by product, jurisdiction, and seriousness. Built-in soft validations and E2B validation run before submission, so structural errors are caught internally rather than at the gateway. SLA-driven dashboards surface cases approaching expedited reporting thresholds in real time, and database-integrated gateway configurations enable one-touch regulatory submissions to FDA, EMA, PMDA, and MHRA.
- Clinevo Literature Management (GenAI-enabled) Screens medical journal output and generates E2B(R3)-compliant XML for validated literature ICSRs , feeding them into the safety database without manual transcription between systems.
Compliance with 21 CFR Part 11, EU GMP Annex 11, GxP, and GDPR is built into the platform architecture. Every action, from intake through submission, is captured in timestamped, tamper-evident audit trails that are retrievable on demand for inspection.
Frequently Asked Questions
A spontaneous report (a phone call, email, web submission, or letter) is logged at intake with whatever information is available. The PV team then validates it against the four minimum criteria, triages for seriousness, codes the reaction terms in MedDRA, performs causality assessment, writes a narrative, and routes it through QC and medical review. Once locked, it is converted to an E2B(R3)-compliant XML message and submitted to the relevant regulator. Modern platforms automate most of the data capture and routing, with human reviewers focused on clinical judgement.
Four elements are required under ICH E2B(R3): an identifiable patient, an identifiable reporter, a suspect drug or biological product, and a suspected adverse event or reaction. Any one of several data points is sufficient to meet each criterion. A report missing one of the four is classified as non-valid and cannot be submitted until follow-up closes the gap.
AI-driven case intake tools can reliably extract candidate seriousness criteria from narrative text, hospitalisation language, fatal outcomes, life-threatening descriptors, congenital anomalies, and flag them for review with confidence scores. The final seriousness determination remains a regulated medical decision made by a trained reviewer. The role of AI is to surface signals consistently and accelerate triage, not to replace medical judgement.
The reviewer first identifies the verbatim reaction term as reported. They then locate the appropriate Lowest Level Term (LLT) in MedDRA, which auto-links to a Preferred Term (PT). The PT is what flows into reporting and signal detection. The PT then aggregates upward into High Level Terms, High Level Group Terms, and finally a System Organ Class. Coders use sponsor-specific coding conventions (for example, granularity rules for vague terms) to ensure consistency, and a second reviewer typically verifies the coding before case lock.
The case is logged with the available information and a follow-up request is issued to the reporter, capturing the request and any response in the audit trail. Each follow-up creates a new versioned case record. If the follow-up changes seriousness, causality, or expectedness in a way that meets expedited reporting criteria, the case clock starts again from the receipt of the new information. Multiple follow-up attempts may be required, and regulators expect documented evidence of what was asked, when, and what was received.
The receiving system returns an acknowledgement message confirming receipt and validation status. The case enters the regulator's database and becomes part of the ongoing safety surveillance dataset, available for signal detection, periodic safety reporting, and aggregate analysis. Marketing authorisation holders can download cases related to their products from EudraVigilance for their own signal management activities.
