Integrity with internal Code of Practice / policies / SOPs

01The Law Is the Floor, Not the Ceiling

Pharmaceuticals Act §66 (ban on exaggerated advertising), §68 (ban on advertising pre-approval drugs), §68-2 (duty of effort in information provision), the Standards for Fair Advertising of Drugs, and the Guidelines for Sales Information Provision Activities (MSA guidelines). These set the minimum a material must clear. But clearing the minimum and deciding your company may release it are two different things. Most pharma companies stack their own Code of Practice, policies, and SOPs on top of the law. What internal review examines is that upper layer, not the law.

When a vendor says "legal check done," its reach typically stops at the law and public standards. It does not reach your internal norms — and cannot. An internal Code of Practice is often not disclosed externally, so the vendor usually does not know its full text. There is no guarantee that a legally compliant deliverable passes internal review. Closing that gap is the job of the orderer, who holds the internal norms.

02Why Internal Standards Run Stricter Than the Law

Internal standards exceed the law for sound reasons, not from excess caution. First, the law is a binary "violation or not," but reputation erodes on a continuum. Step into the grey zone and, even short of administrative guidance, the loss of clinician trust and internal whistleblower risk accumulate. Second, lines learned from past findings, voluntary recalls, and industry sanctions — "we never do this again" — are woven into internal norms. Third, in global companies, headquarters policy or the IFPMA code imposes a uniform bar stricter than domestic law.

Internal standards ask not "can we legally say it" but "should we, as this company, say it." The orderer performs that test on behalf of the company against the vendor's deliverable.

03What to Check — Separate the Three Layers

Lumping everything as "alignment with internal standards" makes the check sloppy. In practice, apply three layers separately.

• Code of Practice: the top document of values, ethics, and prohibitions — the JPMA / IFPMA code adapted internally. It sets principles: ban on comparative claims, handling of patient groups, conflict of interest.
• Policies: domain-specific rules — promotional-material policy, digital/SNS policy, medical information policy. They define what, on which channel, to whom is permitted.
• SOPs: standard operating procedures — material review SOP, approval flow, version control, retention period, expiry management. They define procedure and forms.

Vendor deliverables most readily touch the Code and policy layers. The SOP layer is mainly the orderer's own process compliance — less about the artifact itself and more about with which version, when, and on whose approval it was ordered. The orderer applies a separate checklist to each layer.

04The Receipt-Stage Alignment Check — Place It After the Legal Check

Into the verification step of the receipt flow covered in Issue 3 (in preparation), build the internal-alignment check as an explicit second stage. The order is "(1) law / public standards → (2) internal Code / policy → (3) SOP procedure." Anything failing the law is bounced before alignment is even examined, so the legal check comes first.

1. Expression layer: do comparative, superlative, or absolute claims touch the internal banned-word list? Does it fit the patient-facing tone rules?
2. Evidence layer: does cited data meet the internal evidence-level bar? Is it a standalone subgroup or exploratory-analysis claim? Is the safety-volume balance within the rule?
3. Channel layer: is the intended channel (MR hand-carried / web / SNS / patient-facing) permitted for this material type under internal policy?
4. Procedure layer: are the version, approver, and expiry at the time of order recorded per the SOP form?

05A Decision Template — Leave a Record of the Internal-Alignment Finding

Having "looked" does not discharge the duty. As a precondition for the documentation covered in Issue 10 (in preparation), capture the finding in structured form at receipt. The minimal decision form carries the following fields.

The key is to give "compliant under law but needs fix under internal standards" its own field. The more materials that fill this field, the more would have slipped through had the vendor's "legal OK" been taken at face value. Making the gap visible also supplies the evidence to explain your decision history at a later audit.

06Internal Norms Move — Build Version Control into the Alignment Check

The Code of Practice, policies, and SOPs all get revised. A review of MSA-guideline operation, an amendment to the JPMA code, an update to headquarters policy — each flows into internal norms and bumps the version. The problem case: a material judged "compliant" in the past no longer meets the bar after a norm revision.

The orderer always tracks two versions — the material version and the version of the norm applied. Record "which version of the Code the match was made against," and when the norm is revised you can identify by version which materials need re-matching. Run this together with expiry management. On a norm revision, inventory the materials in circulation and re-examine those passed under the old standard.

07What You Can and Cannot Hand the Vendor

Final responsibility for internal alignment stays with the orderer, but the gap can be shrunk upstream. At the brief stage, hand the vendor the internal standards you may disclose. Rules that translate into production — ban on comparative claims, evidence-level requirements for cited data, volume rules for safety statements — reduce rework when written into the brief. This meshes with the vendor-side quality build covered in the sister series Production Quality Management (/production-qm/).

Internal norms you cannot disclose — judgment criteria tied to competitive strategy, sensitive headquarters clauses — cannot go to the vendor. Matching against these can structurally only be done by the orderer. So design the split: the vendor builds in what the brief conveyed, the orderer applies the rest after receipt. Where to delegate and where to keep — drawing that line is itself the orderer's design responsibility.

08Manage SOP Deviations as Explicit Exceptions

On the ground, things do not always run per SOP. Emergency swaps, early use on an off-policy channel, a shortened approval flow. Wave these through as "unavoidable" and the SOP becomes a dead letter. The orderer's duty is neither to hide the deviation nor to block it rigidly, but to record and approve the deviation explicitly as an exception.

• What deviated (which step of which SOP, and why it was bypassed)
• The quality secured by substitute (who provided the alternative check for the shortened approval)
• Approver (the person with authority to approve the deviation, named)
• Post-hoc correction (the condition for returning to standard procedure next time)

With an exception record, you can explain at audit that "the deviation was recognized and kept under control." Without it, the same deviation reads as "a control gap." Even absent a legal violation, the absence of internal control becomes the orderer's liability. Alignment with internal norms turns only when it includes not just routine matching but exception handling at the moment of deviation. For the related advertising and MSA lines, see the Standards for Fair Advertising of Drugs and the Sales Information Provision Guidelines; for the industry norm, the JPMA Code.