The Drug Development Playbook - Part 7

Author: Aryan Kenia
Life Sciences Analyst

If Part 1 through Part 6 taught readers how a drug moves from idea to approval, Part 7 shows how you keep it safe, useful, and paid for after approval. Post approval runs for years and shapes real patient outcomes, company value, and reputations. Treat it as a product system, not a project. If you build the right systems before launch, you run fewer fires and keep more value.

Key Summary

• Approval starts a multi-decade program of safety, evidence, and supply work that must run like a system, not a project.
• You need both passive signal detection and active evidence generation to manage real risks and protect market access.
• Build a one-page Post Approval Evidence Map now and make weekly standups mandatory for the first 90 days post launch.

Acronyms used in the article

• PV – Pharmacovigilance
• ICSR – Individual Case Safety Report
• PBRER – Periodic Benefit Risk Evaluation Report
• PSUR – Periodic Safety Update Report
• REMS – Risk Evaluation and Mitigation Strategy
• RMP – Risk Management Plan
• PMR – Postmarketing Requirement
• PMC – Postmarketing Commitment
• RWD – Real World Data
• RWE – Real World Evidence
• EHR – Electronic Health Record
• EudraVigilance – European Union adverse reaction database
• FDA – Food and Drug Administration
• EMA – European Medicines Agency
• QPPV – Qualified Person for Pharmacovigilance
• PV SOP – Pharmacovigilance Standard Operating Procedure
• HTA – Health Technology Assessment
• MEA – Managed Entry Agreement
• Q12 – ICH Guideline Q12 on product lifecycle management

A short case study

Imagine a small biotech that won an approval for a novel immunomodulator. Month one after launch they saw a cluster of spontaneous reports suggesting a rare but serious liver signal. Because the company already ran a linked registry and had an RWE team on duty, they quantified incidence within weeks, adjusted the label wording, and proposed a focused REMS discussion with regulators. That quick response saved patients and preserved market access. If they had waited to stand up systems, they would have faced a months-long firefight, bigger regulatory demands, and lost trust.

That scenario shows why post approval is not a nice to have. It is the whole business.

What post approval actually means

Approval ends an approval pathway and begins an operational program. You must run continuous pharmacovigilance, deliver any required PMRs and PMCs, maintain and update REMS or RMPs, manage CMC changes, operate registries, generate RWE for payers, and support HTA dossiers. Those activities pull in PV, medical affairs, pharmacoepidemiology, RWE and HEOR teams, regulatory affairs, CMC, and market access. Regulators expect a functioning safety system that meets statutory reporting timelines and periodic benefit-risk reporting requirements.

Pharmacovigilance essentials

Core regulatory obligations and timelines

In the United States you must report serious and unexpected adverse experiences under 21 CFR, typically within 7 days for life-threatening or fatal events and 15 days for other serious unexpected cases. You also submit periodic aggregated safety reports in the PBRER or PSUR format. In the European system you submit ICSRs into EudraVigilance within statutory windows and provide periodic reports. These obligations drive how you staff case processing, regulatory submissions, and aggregate review.

Passive versus active surveillance

Use both. Passive spontaneous reports give wide net coverage and often provide first alerts. Active surveillance and registries quantify risk and provide denominators. The FDA Sentinel System and similar networks show how active database surveillance can detect and confirm signals using claims and EHR data. You need both hypothesis generation and hypothesis testing capabilities.

Signal detection and assessment

Set a clear signal workflow: detect, triage, validate, analyze, and act. Use disproportionality statistics like PRR or ROR for early flags, and empirical Bayes or Bayesian approaches to stabilise sparse data. Then do case level review for plausibility, timing, and dechallenge/rechallenge patterns. Decisions range from monitoring to label changes, additional studies, REMS modifications, restricted distribution, or in extreme cases suspension. Document every step and every decision window.

Post-marketing evidence toolbox

PMRs and PMCs explained

PMRs represent studies the regulator requires by law, often after accelerated approval or when a safety signal needs clarification. PMCs are agreed studies that sit outside statutory mandates but still matter for the program. Regulator expectations can include randomized confirmatory trials, long-term observational cohorts, or focused registries. Missing PMR deadlines can produce enforcement actions and reputational damage.

Study types and when to use them

• Phase IV RCTs – best for head-to-head effectiveness questions or confirmation of surrogate endpoints.
• Pragmatic randomized trials – embed in routine care to estimate real world effectiveness cost effectively.
• Registries – track long-term safety, rare events, and special populations.
• Observational cohorts and case control studies – evaluate rare events and compare risks across real world practice.
  Pick the method based on the question: causal inference needs, the expected event rate, and feasibility. Do not try to force a registry to answer a randomized question.

Real World Evidence

Regulators now expect fit-for-purpose RWE. The FDA’s RWE framework asks three questions: is the data source suitable, is the design rigorous, and are analytic methods valid? Good RWE starts with a question framed as a target trial, then chooses data and methods that emulate that trial. Use propensity scores, doubly robust methods, or instrumental variables to reduce bias. If you plan to use external control arms or RWE for label expansion, pre-specify analyses and validate data quality.

Safety governance and PV operations

Build or buy a validated safety database, hire QPPV and safety physicians, and define SOPs for case intake, coding, medical review, signal detection, and aggregate reporting. Typical validated platforms include Argus, Veeva Vault Safety, and similar systems. Budget for licensing, integrations with EHR and call centers, and training. Keep inspection readiness in mind: regulators audit PV systems, not just deliverables.

REMS, RMPs and risk minimisation

Treat REMS and RMPs as living documents. You must show how risk minimisation measures perform and update them when new evidence arrives. A REMS can impose distribution controls and monitoring. Regulators will accept relaxation when RWE demonstrates reduced risk. Build REMS evaluation milestones into your Post Approval Evidence Map.

Label changes and communication

Label updates fall into two categories: safety driven changes and effectiveness or population driven expansions. Communicate clearly and early. Draft Dear Healthcare Provider letters with direct, factual language, and coordinate any patient communications with medical affairs. Avoid defensiveness. Regulators and clinicians trust transparent, timely communication.

Lifecycle CMC: Q12 thinking

Apply ICH Q12 thinking early. Identify established conditions, build comparability strategies, and create PACMPs where possible. That reduces the chance that a late CMC change triggers a major review or supply disruption. Start Q12 conversations before or during pivotal trials, not after launch.

Lifecycle CMC: Q12 thinking

Apply ICH Q12 thinking early. Identify established conditions, build comparability strategies, and create PACMPs where possible. That reduces the chance that a late CMC change triggers a major review or supply disruption. Start Q12 conversations before or during pivotal trials, not after launch.

Metrics, KPIs, and dashboards you should use

PV KPIs

• Volume of ICSRs and serious cases
• 7/15 day expedited reporting compliance rate
• Time from receipt to case closure
• Time from signal detection to assessment

RWE / registry KPIs

• Enrollment vs target
• Data completeness rates
• Time from protocol lock to first analysis

Commercial-safety KPIs

• REMS enrollment and adherence
• Uptake by segment and discontinuation rates

Make dashboards living tools and review them weekly with cross-functional owners.

Decision gates and escalation paths

Define concrete triggers for escalation and the owners who act. Example gates:

• Any signal that meets expedited reporting criteria enters triage within 48 hours.
• Disproportionality metrics above pre-specified thresholds plus clinical plausibility moves a signal to formal assessment.
• A confirmed increased rate of a serious ADR triggers regulator notification and a review of REMS/RMP options.
  Set timelines for each step and publish the escalation matrix to the executive team.

Common pitfalls to avoid

• Treating PV and RWE as compliance checkboxes rather than business assets.
• Waiting to start registries until a signal appears.
• Understaffing case processing and letting backlogs form.
• Running weak observational studies that regulators and payers dismiss.
• Failing to align label ambition with HTA expectations.

Costs and timelines – orders of magnitude

Expect to budget for: validated safety database licensing and integrations, a core PV team, RWE platform costs, and registries or pragmatic trials. Simple, small registries start in the hundreds of thousands USD; larger multi-country registries run millions to build and hundreds of thousands per year to maintain. PV system and outsourced services range widely by scope. Get vendor quotes early and build contingency budgets.

Parts of this series

• Part 1 – From Idea to Patient: How Drug Development Actually Works
• Part 2 – Disease Understanding and Target Identification: Picking the Biology Worth Backing
• Part 3 – Hit Discovery and Lead Optimization – how teams turn a validated target into an actual drug candidate
• Part 4 – Preclinical Development and IND/CTA Readiness: making the candidate safe enough to test in people
• Part 5 – Clinical Development: Phases I to III
• Part 6 – From Pivotal Data to Approval: The Regulatory Review Strategy
• Part 7 – After Approval: Running Safety, Real World Evidence, and the Product Lifecycle

References and sources

1. FDA Expedited Safety Reporting and postmarketing reporting regulations – 21 CFR 314.80.
2. ICH E2E Pharmacovigilance Planning guideline.
3. EMA EudraVigilance and ICSR implementation guidance.
4. FDA Real World Evidence Program and guidances.
5. ICH Q12 Guideline on product lifecycle management.