What Compliance Capabilities to Require From a Pharma Media Agency
What compliance and specialist capabilities a pharma brand should require from its media agency: a checklist for MLR, ISI, adverse events, and privacy.
The short answer
A pharma brand should require its media agency to show a working MLR workflow tied to live placements, ISI handling for every format, an adverse event forwarding procedure, privacy review of audiences and tags, sensitive category and brand safety controls, an audit trail of what ran where, and documented training. Ask for redacted evidence of each. A capabilities slide is not proof.
Most agency RFPs for pharma ask about compliance in one line and get a paragraph of reassurance back. That tells you nothing. The useful version breaks compliance into specific operating capabilities and asks for artifacts. This article lists what I would require and how to test it. The manufacturer keeps regulatory responsibility; the point is to make sure the agency's execution does not create problems the brand then has to answer for. This is practitioner guidance, not legal advice.
Why compliance belongs in agency selection
When things go wrong in pharma media, the cause is rarely a planner who did not know the rules. It is a process gap: a creative version running past its expiry, a segment swapped without review, a comment mentioning a side effect that sat for a week. Those are agency operating problems. A strong agency in other categories can still be weak here because pharma adds steps that general workflows skip.
Compliance capability should sit next to planning and buying skill in the scorecard, not in a pass or fail box at the end. The pharma programmatic partner RFP scorecard and the guide to evaluating an agency's pharma programmatic capabilities cover the wider assessment.
The compliance capability checklist
For each capability, the right column is the evidence to ask for. Redacted examples are fine.
| Capability | What good looks like | Evidence to request |
|---|---|---|
| MLR workflow | Every live creative maps to an approval code and expiry; changes trigger resubmission; media context submitted with creative | A trafficking sheet with approval codes; their resubmission trigger list |
| ISI handling | Format matrix by unit size and length; prelaunch rendering checks on real inventory | A format matrix; a QA report with screenshots |
| Adverse event procedures | Written intake and forwarding SOP aligned to the brand's; named owners; training records | The SOP outline; training completion log; a sample forwarding form |
| Privacy review | Every audience documented with source and consent basis; state law checks; tag review on landing pages | An audience documentation template; a tag scan report |
| Sensitive category controls | Policies for conditions that carry stigma; geofencing restrictions; platform policy compliance | Their sensitive targeting policy; platform certification status where needed |
| Brand safety and suitability | Brand-specific settings, inclusion lists, and review cadence; measurement accredited where available | Current settings for a comparable client; incident log format |
| Audit trail | Change log of creative, targeting, and tags; placement-level delivery data retained | A redacted change log; their retention policy |
| Training | Annual pharma compliance training for all staff touching the account, including ad ops and social | Curriculum outline; completion rates |
MLR and ISI: the questions that separate agencies
Every pharma agency says it supports MLR. The difference shows up in specifics. Ask:
- How do you prevent an expired creative version from serving? Is it automated or a calendar reminder?
- What does your MLR submission include beyond the creative files? Do you show placement context, unit behavior, targeting, and sequencing?
- What happens when a publisher requires a size you do not have approved?
- Who checks ISI rendering on mobile web and in-app, and when?
An agency that answers with a named person, a tool, and a trigger is in better shape than one that says "our team is very experienced." For what a strong submission looks like, see MLR review for programmatic media.
Adverse event reporting: where agencies get exposed
Manufacturers have postmarketing safety reporting obligations, and they rely on partners to pass along potential adverse events they encounter. Agencies running social channels, community management, email response, or influencer programs will see them. A comment like "this gave me a rash" can qualify.
Ask the agency to describe its process step by step: who monitors, how a potential event is recognized, the form used, the forwarding window, and how they confirm receipt. Most brands set the window in the contract, often 24 hours or one business day; follow the brand's SOP. Check that ad ops and media staff, not only social teams, have been trained, because publisher reports and partner emails can contain events too.
Privacy review and sensitive category controls
Privacy capability is newer at many agencies and uneven. Ask how the agency documents audience sources, how it tracks state consumer health data laws, and whether it scans landing pages for tags before launch. Ask what it does when a vendor cannot answer a provenance question. The good answer is "we do not use the segment until it can."
Sensitive category controls cover both targeting and placement: avoiding inferred targeting on stigmatized conditions where policy or law restricts it, honoring geofencing bans, and following platform health policies. Brand safety settings should be specific to the brand, reviewed regularly, and paired with a way to report incidents. See brand safety and suitability for pharma.
Audit trail and training
If a regulator, a journalist, or your own compliance team asks what ran where in March, can the agency answer within a day? That needs a change log covering creative, targeting, and tags, plus placement-level delivery data retained for an agreed period. Put retention in the contract.
Training should be annual at minimum and cover every role that touches the account. The PhRMA Code is relevant for HCP-facing work, and FDA's rules apply to all promotional work. Ask for completion data, not a syllabus alone.
How to test an agency before you sign
- Request the evidence in the table above, redacted.
- Run a scenario: "We are adding a 320x50 mobile unit two days before launch. Walk us through what happens."
- Run a second scenario: "A comment on a sponsored post mentions a side effect on a Saturday."
- Ask who on the proposed team has run pharma ad ops before, by name.
- Write the answers into the contract as obligations with response windows.
The pharma marketing compliance guide explains the regulatory context behind each item.
Practical takeaway
Add the two scenarios above to your next agency review or annual evaluation, even for your current agency. Score the answers on whether they name an owner, a tool, and a time window. Anything less becomes a contract requirement with a deadline.
Frequently asked questions
What compliance and specialist capabilities should a pharma brand require from its media agency?
At minimum: an MLR workflow that tracks approval codes to live placements, ISI handling across formats, a written adverse event intake and forwarding procedure, privacy review of audiences and tags, sensitive category controls, brand safety settings, an audit trail, and regular training. Ask for evidence of each, not a description.
Should a media agency report adverse events?
The manufacturer owns pharmacovigilance, but agencies that run social, community, or response channels will encounter potential adverse events. Most brands contractually require the agency to forward them to the company's safety team within a short window, often 24 hours or one business day, under the brand's SOP.
How do you test an agency's compliance capability before hiring?
Ask for redacted artifacts: a trafficking sheet with approval codes, a tag scan report, an adverse event training record, and an example of how they handled a late creative change. Then give them a short scenario, such as a new unit size added two days before launch, and listen to the process they describe.
Sources
- FDA, The Office of Prescription Drug Promotion (OPDP)
- HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
- PhRMA, Code on Interactions with Health Care Professionals
- Media Rating Council, Standards and Guidelines
External guidance and platform documentation change. Links were current at publication; check them again before relying on them for a decision.
Editorial note. Analysis and frameworks are the author's own and do not represent Acxiom or any current or former employer, client, or named platform. Examples labeled hypothetical or illustrative are not results from real campaigns. Nothing here is legal, regulatory, or medical advice.
New pharma programmatic breakdowns, occasionally
One email when I publish something worth reading. Benchmarks, measurement teardowns, and case studies with the caveats attached. No cadence promises, no reselling your address.
Unsubscribe any time. See the privacy policy.
Working through this decision on a real plan?
I work on health and pharma data, identity, and activation, after five years running HCP and DTC programmatic agency-side. Happy to talk through how this applies to your situation.