Solution Briefs
Understanding, Experience, and Technology for Compliance
Home > Solution Briefs

Automated Enterprise Risk Management in Life Sciences
Streamline enterprise process management for safety, quality and risk management
   Favorites Favorites
PDF Download Download
Life sciences industry is experiencing a period marked by growing consumption of drugs and medicines, rising consumer demand for improved healthcare, proliferating competition, shrinking market cycles, changing business models, and increasing financial constraints. Further, continuing price wars, rising quality standards, and increasing compliance costs are adding to the pressure.

The life sciences industry has always been under close scrutiny, leading to rising audit burdens, quality inspections, and fines. As a result, there is a continuous threat of losing reputation and public trust, resulting in low net worth and decreased stakeholders’ confidence. Pressure to track consumer usage, continuously monitor the history and life cycle of a drug increases risks in conducting business operations.

To overcome these risks, life sciences industry need to adopt a more proactive and structured enterprise risk management (ERM) system. Risk Managers in life sciences industry, today, are assigned the critical role of recognizing and eliminating the inherent risks (endangering the safety or performance), minimizing their effects, evaluating the controls and remedies, documenting the procedures, and so on.

This paper discusses the risks and challenges in life sciences industry and elaborates on automated solutions for managing these risks. Though the scope of the industry is far and wide, this paper focuses primarily on pharmaceuticals, biotechnology, and medical devices and services industry.

Types of Risks in Life Sciences Industry
Risks in life sciences industry can be broadly categorized into:

Solution Highlights

Powerful reporting with executive dashboards for analytics, trend analysis and visibility for executive oversight and intelligent decision-making

Flexibility to meet specific requirements and adapt to changing business processes and regulatory procedures

Scalable, web-based architecture with an easy-to-use interface for rapid deployment and adoption
Product Lifecycle Risks
Product manufacturing in life sciences industry entails high risks, as the investments in terms of time, money, and expertise are huge. As per industry estimates it takes almost a decade to develop a new drug. Common risks during product development include:
  • Clinical Trials: Clinical Trial conducted during the development of the drug , is often threatened by risk of the negative or even fatal side effects of the drugs on the participants.
  • Controlling Costs: Proactively identify, track and resolve safety and quality issues by creating a transparent and integrated environment where decisions are based on hard facts and metrics
  • Increased Competition: Increased competition impacts market share and can jeopardize product development.
  • Product Safety Risks: Life sciences industry has stringent regulatory requirements for releasing product in the market. Post product release, companies face severe issues associated with product safety in usage, hazards related to product usage and any legal lawsuits which can negatively impact company’s brand.
  • Intellectual Property Risk: Life sciences businesses capitalize out of the intellectual property asset such as patents, copyrights and trademarks. This brings in the risks of theft, misappropriation or misuse of intellectual property.
  • Patent Related Risks: Pharmaceutical companies spend enormous R&D budget to invent drugs and apply for patents to capitalize in future. Patent expiration poses serious risks associated with future earnings.

Regulatory Risks
Life Sciences industry is governed by a number of regulations like Electronic Common Technical Document (eCTD), Electronic Records 21 CFR Part 11, Prescription Drug Marketing Act (PDMA), and Current Good Practices (CGXP). Failure in adhering to these regulations raises the risk of regulatory noncompliance which can result in penalties, inspections, product recall and even plant shutdowns.

Ethics and Integrity Risk
Ethics and integrity risk arise in life sciences industry during product manufacturing, marketing and distribution. Corrupt, illegal pricing schemes, inducements to customer by sales representatives to purchase products and misbranding are some of the common practices which can severely impact companies.

Operational Risks
Operational risks arise during research and development of products, product manufacturing capacity planning, expansion, product commercialization, mergers and acquisition and supply chain.

Environment Health & Safety Risks
Pharmaceutical, bio technology and medical device product development process has significant impact on environment, health and safety of the employees and overall community. Risk arises from strict regulatory requirement of environmental agencies such as Environmental Protection Agency (EPA), OSHA for work environment and regional and multiple international regulations.

Standards for Risk Management

Life sciences industry have defined the standards for risk management in Medical Devices, Pharmaceuticals, and Biotechnology

Risk Management Approach – ISO 14971 Medical Devices
ISO 14971:2007 specifies a process for a manufacturer to identify the hazards associated with medical devices, including in vitro diagnostic (IVD) medical devices, to estimate and evaluate the associated risks, to control these risks, and to monitor the effectiveness of the controls. The requirements of ISO 14971:2007 are applicable to all stages of the life-cycle of a medical device.

Risk Management Approach – ICH Q9 Pharmaceutical
ICH guideline (ICH Q9) describes the use of risk management procedures as part of the quality management of pharmaceutical manufacturing and development. Manufacturers should have procedures to quantify and manage these risks. The tools for risk management help companies to assess and manage the risks presented by their products. Essentially the process involves identifying the potential risk, estimating how often it is likely to occur, and assessing the effect.

Risk Management Approach: ISO 14000 Biotechnologies
This section addresses various aspects of environmental management. The very first two standards, ISO 14001:2004 and ISO 14004:2004 deal with environmental management systems (EMS). ISO 14001:2004 provides the requirements for an EMS and ISO 14004:2004 gives general EMS guidelines. The other standards and guidelines address specific environmental aspects, including: labeling, performance evaluation, life cycle analysis, communication and auditing.

 

Risk Management Approach
Life sciences companies are advised to follow an enterprise wide risk management approach which includes:

  • Identifying hazards associated with the components;
  • Estimating and evaluating the associated risks; and
  • Controlling these risks and monitoring the effectiveness of the control.

An organization needs to prepare a formal risk management plan that defines the scope, roles and responsibilities, requirements for review of risk management activities and criteria for risk acceptability. The approach shall include the following steps:

  • Risk Analysis: It identifies characteristics related to the safety of the product, recognizing known and unforeseen hazards, and estimating risks for each hazard.
  • Risk Evaluation: For each identified hazard, the manufacturer decides, using the criteria defined in the risk management plan, whether the estimated risk(s) is so low that risk reduction need not be pursued.
  • Risk Control: It involves identifying appropriate risk control measures, and recording risk control requirements.
  • Risk Reduction: When risk reduction is required, the manufacturer follows the process to control the risk(s) so that the residual risk(s) associated with each hazard is judged acceptable.
  • Post Production Information: The manufacturer establishes and maintains a systematic procedure to review information in the post-production phase.

Solution

MetricStream risk management solution offers capabilities managing compliance requirements for:

Financial Compliance
  • Sarbanes Oxley
  • Internal Audits

    • Operational Compliance
  • cGMP
  • CFR and other FDA regulations
  • SPL, PLR

    • EH&S Compliance
  • Environmental Regulations –
        Regional and International
  • Occupational Safety – OSHA,
        ISO 1400
    		•
    Life sciences organizations, today, realize far reaching benefits of automated enterprise risk management solution. It helps in minimizing and managing enterprise risks. GRC enables life sciences companies to establish a platform that maintains a single and consistent system of record for enterprise risk and compliance while managing the intricacies and relationships of risk and compliance. GRC platforms are quite helpful in creating a centralized hub of risk and compliance documentation, assessment, analysis, and loss information from every part of the business.

    The MetricStream solution provides a common framework and an integrated approach to manage cross-industry mandates and regulations such as SOX, FDA (cGMP, CFR), OSHA, EH&S, and Data Management laws.

    The key benefits realized by MetricStream customers are:

    • Reduced Noncompliance Risk: By adopting an integrated systems-oriented approach, with compliance built into each system, helps organizations adhere to regulations and standards such as FDA 21 CFR Part 11, Part 210-211 and ICH Q7A; thereby reducing non compliance risks.
    • Increased Real-Time visibility: By virtue of GRC platforms, organizations can accelerate production and release cycle by gaining real-time visibility into the quality and document management process and its key performance metrics.
    • Lowered Cost: The solution helps in building operational efficiencies in quality systems. This lowers the cost of regulatory compliance and reduces the risk of penalties due to poor quality.
    • Improved Processes: A robust GRC solution proactively identifies, tracks, and resolves quality and compliance issues by creating a transparent environment where decisions are based on hard facts and metrics.

    Rather than floundering under a wave of regulatory mandates and legal challenges, life sciences companies must recognize both the imperatives and the benefits of a structured approach to GRC. MetricStream helps customers to adopt Governance, Risk & Compliance (GRC) Management; to mitigate risks and also revisit their business processes to capture value generating business opportunities. In addition, Metric Stream’s ComplianceOnline.com, a leading portal and online community for worldwide professionals, provides the latest information, best practices, training, products and tools on corporate governance, risk management, regulatory compliance and quality management.

    Benefits

    MetricStream Enterprise Compliance Platform is a robust and scalable infrastructure that provides core services and capabilities leveraged by the Safety, Quality and Risk Management solution including:

    Embedded best practices - out-of-the-box solution with the flexibility to meet specific requirements and adapt to changing business processes

    Fast implementation with a workflow and collaboration engine that provides configurable forms design and creation, information flows, notifications, alerts and escalation paths

    Secure web-based access for all users with appropriate views and tabs for initiating actions, responding to events, managing to-do lists and assigned tasks, viewing reports and dashboards

    Built-in reporting for analytics and business intelligence for statistical process control with a tool to create custom reports that can be emailed or exported into formats like MS Excel and Adobe PDF

    Executive role-based dashboards for graphical views of information with the ability to drill down to the finest level of detail to see the underlying data

    Ability to easily integrate with external systems to retrieve, store and deliver data; leverage XML-based adapters for connectivity to other enterprise applications

    Support for electronic signatures and accurate time-stamped audit trails for regulatory compliance