Promotional Review Pitfalls: A PMCPA Case Study

By the time material reaches the medical signatory, the decisive questions may already have been answered elsewhere: Was the communication correctly classified? Was the right version routed for review? Were the prescribing information and other mandatory elements checked against the current product information? Could the final approved version actually be traced after publication?

Recent PMCPA rulings show what happens when those questions are left implicit. A promotional article can reach publication without certification. An email invitation can be treated as event administration even though its purpose and context make it promotional. Product information can remain out of date across a substantial period. None of these failures is best understood as a single person missing a box on a form. They are failures of governance around the signatory process.

The uncomfortable part is that the underlying requirements are not obscure. The difficulty lies in applying them consistently across teams, channels and successive versions of the same asset.

The Anatomy of Certification Failures: Lessons from Recent PMCPA Rulings

The ABPI Code requires promotional material to be certified in its final form before it is issued. The two required signatories have different roles: one must be a UK-registered medical practitioner and the other an appropriately qualified person, commonly a pharmacist. The final-form requirement is central. The material released to the audience must correspond to the version that the signatories reviewed and approved.

That distinction matters because promotional content rarely remains static. A headline may change after medical review. A reference may be removed by marketing. A layout change may affect the prominence or readability of prescribing information. A digital team may upload a revised file while assuming that the change is merely technical. The more complicated the production route, the easier it becomes for a company to retain evidence of approval for one version while distributing another.

Teva’s experience in Case AUTH/3656/6/22 illustrates the risk at its most basic. An article in P3 Pharmacy was found to be promotional in nature and had been issued without certification. The PMCPA found breaches relating to certification, prescribing information, the adverse-event statement, the black triangle symbol, consistency with the SPC and the use of the term “new” outside the permitted period. The case therefore involved more than an absent signature. It showed how the absence of certification can allow several other review controls to fail at the same time.

The Clause 2 finding should be understood separately from the Code’s requirements concerning the maintenance of high standards. Clause 2 is a particularly serious finding associated with conduct that brings discredit upon, or reduces confidence in, the pharmaceutical industry. It was the cumulative seriousness of the circumstances that mattered in the case, rather than Clause 2 being the provision that itself sets out the general high-standards requirement. That distinction is not academic. Misstating the role of the clause can lead organisations to misunderstand both the underlying breach and the level of concern expressed by the Panel.

The signatory process does not fail at the signature. It fails when the material arrives at the signatory’s desk already treated as a finished decision.

The important governance question raised by the Teva ruling is not simply why a medical signatory missed the material. It is how a promotional article reached external publication without a reliable control confirming that certification had taken place. That points to a process problem: unclear ownership, an ineffective release gate, inadequate version control, or a distribution channel that sits outside the ordinary promotional workflow.

Novartis faced a different but related set of issues in Case AUTH/3861/12/23. The case involved an incorrect European Medicines Agency Summary of Product Characteristics, an email that the PMCPA considered to be disguised promotion, and internal governance concerns. The ruling touched Clauses 2, 5.1, 5.5, 11.2, 12.1, 12.10 and 15.6. The significance of the Clause 2 finding lay in the overall picture. The Panel considered the totality of the failures, rather than treating each problem as an isolated technical defect.

This is a recurring feature of serious promotional compliance cases. An inaccurate reference might be corrected quickly if it is found during a controlled review. The same inaccuracy becomes more consequential when it sits alongside unclear promotional intent, weak oversight and an inability to demonstrate who approved what. In other words, medical signatory errors in promotional compliance are often symptoms of a wider control environment.

What a robust certification record needs to show

A defensible process should allow the company to reconstruct the route from content creation to external use. At a minimum, the record should make clear:

• which item was classified as promotional and why;
• which version was reviewed, including the relevant date or version identifier;
• who approved the final form and in what capacity;
• which supporting materials and product information were used during review;
• whether any changes were made after approval;
• where and when the approved material was issued;
• how withdrawal, correction or replacement would be handled if the product information changed.

This is not a demand for paperwork for its own sake. The record is what allows a company to distinguish a controlled approval process from a retrospective attempt to infer that approval must have happened somewhere.

Beyond the Signature: Governance Gaps in Digital and Email Promotion

Digital communications create real compliance risk, but not because every message sent to a healthcare professional is automatically promotional. The first question remains the same as it is for print: what is the purpose and content of the communication, and how would the audience reasonably understand it?

An operational email about venue access is not automatically equivalent to a promotional email. A medical information response is not automatically promotional merely because it is sent by a pharmaceutical company. Conversely, an invitation can acquire a promotional character when it is connected to a product, a therapeutic message, a sponsored meeting or other commercial communication.

CSL Vifor’s voluntary report to the PMCPA concerned an uncertified email invitation to a UK healthcare professional for a dinner meeting at a European congress. The PMCPA found breaches of Clauses 5.1, 8.1, 8.2, 12.1, 12.9 and 12.10. The case is useful precisely because it does not support a simplistic rule that all digital communication requires identical treatment. It shows that an email which may appear administrative can still fall within the Code when its purpose, context and content make it promotional or otherwise regulated under the relevant provisions.

That is the narrower and more practical lesson. Digital format does not remove a communication from the Code. Nor does digital format, by itself, establish that the communication is promotional. Classification must happen before the email is released, not after a complaint has forced the company to explain what it intended.

The same principle applies to social media, conference platforms and automated communications. A company should not assume that a communication is outside review merely because it is short, generated from a template, hosted on a third-party platform or sent by an events team rather than brand marketing. But the review pathway should be proportionate to the communication’s actual regulatory character. Treating every HCP-facing message as promotional would create noise and encourage teams to work around the process; treating none of them as promotional creates an obvious control gap.

The relevant question is not whether a message looks administrative. It is whether its purpose and content place it within the Code’s reach.

Where digital review commonly breaks

The failure points are usually operational rather than technological:

1. Ownership is unclear. Marketing assumes events owns the invitation; events assumes medical has approved the scientific content; an external agency assumes the client has completed the required certification.

2. The template is mistaken for approval. A previously approved invitation is reused after the product reference, speaker information or meeting context has changed.

3. The distribution list is treated as irrelevant. Teams focus on the wording but fail to consider who will receive the communication, particularly when a campaign crosses national borders or audience categories.

4. The platform obscures the final form. The version approved as a PDF is not necessarily the version displayed in an email, registration portal or conference application.

5. Automation bypasses the release gate. A scheduled journey or event-management system can continue sending a message after its underlying content has become outdated or its approval period has ended.

A compliant digital process therefore needs both classification and release controls. The signatory should be able to see the material as the audience will receive it, or at least a faithful representation of that final presentation. A generic approval of the campaign concept is not necessarily approval of every individual execution.

The High Cost of Administrative Oversight: Prescribing Information and SPC Accuracy

Some of the most difficult PMCPA findings to explain internally are the ones that arise from information that was already available. The company may have the current product information, an established template and a documented review procedure. Yet an outdated version remains attached to promotional material or is carried forward into new uses.

Theramex’s public reprimand in Case/0303/09/24 is important in this respect. The Code of Practice Appeal Board found fundamental compliance errors concerning the provision of up-to-date prescribing information for the Evorel range and Intrarosa over a period of several years. The case establishes the persistence of outdated prescribing information. It does not, by itself, establish that the omission resulted from simple forgetfulness, identify one individual as the cause, or prove that every subsequent promotional item was affected in exactly the same way.

Those distinctions matter when converting a case report into a control response. A company should investigate the actual asset population, the dates of use, the versions attached to each item and the points at which product information changed. It should not replace that investigation with an assumption about what someone must have intended.

Prescribing information is also not interchangeable with the full Summary of Product Characteristics. Promotional material may need to include the prescribing information required by the Code and applicable presentation rules; that does not mean that every promotional piece must reproduce the complete SPC. The precise requirements depend on the type of material, its audience, its medium and the provisions engaged by the communication. A review process that labels every product-information problem as a failure to include the entire SPC is likely to be inaccurate as well as inefficient.

The practical control is a clear link between product-information change management and the promotional asset library. When the approved product information changes, the organisation should be able to identify which materials refer to the affected product, determine which remain in use and assess whether they need revision, withdrawal or reapproval.

The comparison should not be reduced to a claim that every company made the same mistake. Teva’s central failure concerned absent certification. Novartis involved a combination of product-information, promotional and governance issues. CSL Vifor demonstrates the risk of misclassifying a particular email invitation. Theramex demonstrates the consequences of allowing outdated prescribing information to persist over time. The common theme is weaker: compliance was not sufficiently embedded in the lifecycle of the material.

That weaker conclusion is also more useful. It points to controls that can be tested rather than to a narrative about negligence that the evidence may not support.

Strengthening the Signatory Firewall: Mitigating Risk in Promotional Review

A functional signatory process begins well before the approval screen. Signatories cannot compensate for a system that gives them incomplete context, an unfinalised asset or no realistic opportunity to challenge the proposed communication.

First, the signatory must review the final form. This means more than checking a near-final document while accepting that minor changes will follow. The final version should be identifiable, locked or otherwise controlled, and linked to the version eventually distributed. Where a change is made after certification, the organisation needs a defined rule for deciding whether the material must return to the signatories. That decision should not depend on informal assurances that the change was immaterial.

Second, the organisation needs a workable definition of promotional material. It should cover the communications that are reasonably likely to engage the Code without collapsing every HCP-facing interaction into one category. A disease-area communication, an event invitation, a product-linked email and a response to an unsolicited medical question may require different handling. The distinction should be documented and applied consistently.

Third, product-information currency should be managed as a live operational issue. The following controls are particularly valuable:

• a single controlled source for current prescribing information and relevant product documents;
• automated or documented notification when approved product information changes;
• an inventory of active promotional assets and their associated products;
• a review of digital and event templates, not only major campaign materials;
• withdrawal and replacement procedures that cover third-party platforms and scheduled communications;
• periodic sampling to confirm that the material in circulation matches the approved version.

Fourth, the release process should make an absent approval visible. If a user can export, publish or schedule material without the required certification record, the workflow contains a bypass. A standard operating procedure cannot repair a system that permits distribution by default and records compliance only if someone remembers to update the file.

There is also a human factor. Signatories need enough time and authority to challenge the brief, the evidence or the proposed audience. If their role is treated as an approval service attached to the end of the marketing timetable, the process will encourage superficial review. A signatory firewall works only when stopping or returning material is an accepted outcome, not a failure to support the business.

A signatory should be the final independent control, not the person expected to legitimise a decision that has already been made.

Operationalising Compliance: Managing PMCPA Inquiries and Record Retention

A complaint or PMCPA inquiry changes the task from prevention to reconstruction. The company must establish what happened, preserve the relevant evidence and provide a response that addresses the actual allegations. Speed matters, but the available case material should not be turned into a false promise of automatic sanctions for every missed administrative date.

Companies commonly work to an initial acknowledgement period of around ten working days and a longer period, often approximately thirty days, for a substantive response. The exact timetable depends on the correspondence and the process in the particular matter. These periods should be treated as deadlines to manage carefully, not as evidence that any delay automatically creates an additional Code breach. If more time is needed, the appropriate response is to communicate promptly and seek clarity rather than allow the matter to drift.

A useful response process should establish:

• the precise material and communication under review;
• the audience, channel and dates of use;
• the product information and references available at the time;
• the people and systems involved in creation, approval and distribution;
• the certified version and any later amendments;
• the company’s position on each alleged breach;
• any corrective or preventive action already taken.

The response should be factual and specific. A general statement about commitment to compliance does not answer whether the item was promotional, whether it was certified, whether the prescribing information was current or whether the material was consistent with the relevant product information. Equally, the response should not speculate about an individual’s motive where the evidence only establishes that a control failed.

Record retention is the point at which many certification systems reveal their weakness. The Code requires certificates and associated promotional materials to be retained for not less than three years after final use and made available when requested by the PMCPA or the MHRA. Retention therefore needs to cover more than the final PDF. The company should preserve the evidence needed to connect the approved version to the distributed version, including the relevant approvals, product-information source and distribution history.

A retention system should answer four basic questions without relying on memory:

1. What was approved? The final asset should be stored in an identifiable form.

2. Who approved it? The two signatory approvals should be linked to that asset.

3. What information supported the review? The relevant prescribing information, references and substantiation should be recoverable.

4. Where and when was it used? The record should provide enough distribution context to determine the period of final use.

This becomes especially important for digital material. A screenshot alone may not show the audience, the destination page, the underlying link or the version served by an automated system. A content-management record may not show the approvals. The retention design needs to reflect how the material was actually delivered.

The strongest response to a PMCPA inquiry is not a polished narrative prepared after the complaint. It is a process that has preserved enough evidence to make the narrative reliable.

The case studies considered here do not support the idea that every email involving a healthcare professional requires certification, that every product-information issue is equivalent to omitting the full SPC, or that every missed response date automatically creates a new breach. They support something more precise and more demanding: classification must be reasoned, final-form approval must be real, product information must be controlled over the life of the asset, and records must survive beyond the campaign team that created them.

The ABPI Code’s certification requirements are not complicated in principle. The challenge is maintaining the connection between intent, content, approval, distribution and retention. When that connection breaks, the signature becomes a formality. When it holds, the signatory can perform the role the system actually needs: an independent control capable of stopping material before it becomes a PMCPA case.