Compliance Architects

Consulting Technology Outsourcing

Admissions of Failure – A Lesson from Google for FDA-Regulated Companies?

corporate compliance

Admissions of Failure – A Lesson from Google for FDA-Regulated Companies?

Imagine seeing the following (imaginary)  Wall Street Journal headlines:

ACME Pharmaceutical Admits Product is No Better Than Competitor

CRO Co. Report Shows Poor Clinical Program Effectiveness

Device Co. Reveals Close to 25% of Research Money Wasted

Without a doubt, these headlines would surprise us. As well-educated, experienced industry participants, we have come to expect virtually everything we read about FDA-regulated companies to have gone through the most rigorous of spin cycles:   multiple levels of internal review, crisis communications committees, internal and external legal counsel, public relations, investor relations, and perhaps even a review by the CEO.     Having direct experience with these types of activities as an attorney and compliance executive, and knowing how carefully managed the image of most of the companies we work with is, I was taken aback recently by one of my favorite successful companies:  Google.

Google

Almost singular among companies, Google requires no introduction.    All of us use Google on virtually a daily basis, and it has become the definitive knowledge attainment tool of the Internet Age.    We look up to Google.   We are impressed at its size, success, culture, performance, results, and influence.   Given the ubiquitous nature of Google and its search product, and how important Google is to virtually everyone’s lives today, Google has become the new AT&T – the new Microsoft – the new Goliath for the David companies to attempt to knock down.

We would expect a company such as this to be incredibly careful about its image.   We would expect nothing to emanate from within Google’s four walls without an armada of attorneys having transformed the initial informative message from the original content into a soft, chewy pablum of weasel words and non-committal language.    However, it appears that nothing could be further from the truth.

Google Unvarnished

About a week ago, Google itself provided the entire world with a comprehensive, straightforward report about its poor performance in an important area of its business:   how well its website products show up in search results.    Now although this report doesn’t tie directly to its core AdWords product, it does discuss, in detail, how Google dropped the ball – badly – in an area that they should have had the skills and talent to be the best in the industry.    In effect, they provided the entire world with a detailed report that would allow the creation of headlines just like the ones above.

See

1) Google Admits SEO Failures: http://news.cnet.com/8301-27076_3-20000121-248.html and

2) Google SEO Report:    http://www.google.com/webmasters/docs/google-seo-report-card.pdf

Looking at this report got me to thinking – why would Google do such a thing?  Why would they show a fallible side?    What do they stand to benefit?    And, given the industry that I spend my days in, what lessons can we learn from this admission that could be applied to and/or benefit FDA-regulated companies?

Apples to Oranges?

Now to be fair, I’m not sure that many companies in many industries would be so open as to air their dirty laundry so openly and honestly.   It’s virtually unheard of for companies, in any industry, to even acknowledge, much less admit, the negative aspects or performance of their organization or their product or service portfolio.    However, particularly for FDA-regulated companies, it has become almost Gospel that negative information should be suppressed; that it should always be presented in a positive light; and that acknowledging failure or mistakes will result in all sorts of terrible things happening.    Regardless of whether the information deals with business strategies, product lifecycle challenges, R&D failures, or manufacturing deficiencies, the standard line out of FDA-regulated companies seems to be:   “We’re fine.”   “We have it under control.”    “We know what we’re doing.”    “We don’t need to change anything.”

So is this the right approach?    Are FDA-regulated manufacturers missing an opportunity?    Would a greater level of transparency and willingness to show fallibility be beneficial to the bottom line?

Balance Point

Like most difficult concepts, responding to the above questions isn’t an either/or proposition.    It is clear that our industry products are significantly different from Google’s search product, and, they certainly live under a far different regulatory scheme.    And, there is a much greater liability (legal and regulatory) exposure for mistakes and defective product offerings in our industry when compared to Google.    So, admission of mistakes, failures, and poor performance needs to be done carefully, and must balance the benefits to be realized, with the risks from disclosure.

But what are the benefits of admission? It is somewhat counter-intuitive that admissions of fallibility can yield benefits in a corporate setting, and especially with FDA-regulated companies.   Let’s however, explore three possible reasons why companies may want to be more transparent and more open to admission of failure.

1) Trust and Credibility

I would submit that the number one reason FDA-regulated companies should consider being more openly fallible is that such disclosures build trust and credibility – not only with their customers – but with the FDA and the DOJ, and if the situation was right, with juries and the Courts.      And there are two recent examples of this concept in play in the recent news.

At one extreme we have Toyota and their handling of the automobile acceleration issue that had been brewing for years, and which was somewhat mis-managed internally.   From the viewpoint of a casual observer, it appears that Toyota was more interested in managing its image than definitively fixing the issue and being honest with their customers and other stakeholders.   If that is the case, they are now paying the price – in very significant financial terms that have shaken the once unassailable company to its core.

At the other extreme, similar to Google, we have Domino’s, which has recently admitted, well, that their pizza has not really tasted that good all along.    In a public campaign of mea culpa and with what must have been an incredibly difficult admission, the CEO of Domino’s went on TV to say that their pizza just didn’t meet the standards of what they felt was necessary to satisfy customers, but, that they were going to change, and, then, asked if the consumers would give them another chance.   From all indications, consumers are doing just that – giving them a chance.

2) Empathy and Compassion

Empathy and compassion can be powerful attributes for your business.    People, including regulators, the Courts, and the public, can be very forgiving of a company that shows it is real and has real weaknesses and that makes mistakes, because then, the company is more “like us”.    Particularly for gargantuan enterprises like Google, and in our industry, the big pharmaceutical, medical device and biologics companies, empathy and compassion can be a little lacking.      Again, using the balance principle, you need to be careful about what admissions of fallibility you make; however, when properly positioned and considered, gaining empathy and compassion can be a powerful part of your overall business success model.

3) Continuous Improvement and Excellence

The most successful companies in the world are in a constant state of continuous improvement.    Excellence in product design, service delivery, customer service, regulatory compliance, or any of a number of other business functions requires a constant willingness to be hyper-critical of your own organization within the context of positive change.    To quote an oft-used phrase, you sometimes have to be willing to accept that your baby is ugly.

So how does admission and acceptance of fallibility fit into continuous improvement and excellence?    In short, it flows from tone at the top.   If a company is willing to be transparent and forthright – admitting its failures and mistakes – individuals within the company will be more comfortable and trustful that raising the issues that are important won’t result in negative ramifications.    From direct experience and observation, I have learned that in most cases, companies have people within their organization that know the problems – know where the issues are – and know how to fix them – and that in many cases, their company’s culture won’t permit them to be honest, direct and forthright – to the company’s detriment.     By allowing admission – by being fallible – by showing that you want to identify your mistakes – a company can send a powerful message to its employees that it recognizes the importance of its people, and that it wants them to foster positive change for the organization.

The Way Forward

These concepts are incredibly difficult to put into practice, and likely, that’s why they aren’t seen more often.    It’s much easier for a company to simply say nothing, or to create highly-spun content that says or reveals nothing, than to think hard about how to be fallible, and to have someone make a decision that, admittedly, may sometimes backfire.     However, I would submit that there very well may be a lot to gain in the long run from a more open, transparent, direct corporate culture, and from being trusted and credible in the marketplace.

So what do you think – am I off here?   Am I missing something?    Is FDA-regulated industry just so different that considerations of trust, credibility, empathy, and compassion don’t apply, or, can FDA-regulated companies really learn something from Google?

Tick, Tick, Tick: FDA Steps Up Criminal Investigation Activity

A review of FDA enforcement news over the last year should clearly demonstrate an important shift in approach by the FDA that the “cop” side of FDA is back on the beat.   During the last 8 – 10 years, in a period marked by principles of de-regulation and reduced oversight for all businesses, the federal government went to great pains to work with industry, and in this context, FDA-regulated industry, to be reasonable and understanding of both the challenges these businesses face, and the financial realities of drug development, commercialization and manufacturing.    As evidenced by the small number of serious enforcement actions during this 8 – 10 year period, the FDA was extremely cooperative relative to traditional regulatory enforcement approaches.

Unfortunately for industry, the FDA of (at least) the next few years
is going to be a whole lot less cooperative!

Regardless of how well you think your company has been doing with respect to your compliance obligations, you now have much, much more to worry about.    Starting last August when the new FDA Commissioner, Margaret Hamburg, gave the first ever speech solely dedicated to enforcement, and continuing with the recent upticks in enforcement showing FDA’s increasing impatience with companies, FDA has been flexing its enforcement muscles in earnest.    Now, on the heels of this recent activity, FDA is the recipient of a report by the General Accounting Office that criticizes its Office of Criminal Investigation for not being internally accountable, and “falling short” with respect to performance standards.   See  FDA Set to Ramp Up Criminal Prosecutions.  This report is damning at a time when FDA is under pressure from Congress, and the new Administration, to provide more assurance of consumer protection, food safety, and safe product supply chains.

Given these changes, what can executives in FDA-regulated companies do to minimize the risk of business disruption from enforcement action, or even worse, the risk of criminal activity at your company?

Initially, as an executive in this industry, you are in a high-profile, high-risk situation.    You need to be sure that you’ve mitigated to the extent possible, company risk of regulatory enforcement, and, your own personal risk derived from your responsibility as an executive in charge of regulated operations.    In this regard, you need to be absolutely sure that you’ve prospectively looked for and identified any risk, or worse, criminal or fraudulent actions that may be occurring in your operation.

Further, as an executive, it is your personal responsibility to be proactive and thorough in vetting your regulated operation for enforcement risk.   In general, criminal activity is directly tied to knowledge & intent — what did you know and when did you know it.    However, under the Food Drug and Cosmetic Act, criminal liability is strict — meaning, you can be criminally liable without direct knowledge of a violative act.  See US v. Park, US v. Dotterweich.     So, either assess your operations yourself – or, if you don’t have the capabilities to dig deep and thoroughly into all aspects of your operation — get help doing so.

3)  Finally, it hasn’t been in vogue of late to think about the penalty side of Food and Drug law and regulation.  It’s much more — palatable — to talk about risk, harmonization, working together, etc.   The problem is that during the good old “friendly government days” many FDA-regulated companies failed to execute on fundamentals, and now these same companies are at significant risk from not spending the time, effort and resources to put in place the appropriate systems and activities that the Agency expects.

I predict that the Agency is, right now, planning a major enforcement action that will, after so many relatively cooperative years, refocus the industry’s attention on compliance and quality issues.    You would think that $2.3 billion paid by Pfizer in January of 2009 would be sufficient, but, it seems that it wasn’t.   You don’t have to be the executive on the receiving end of the Agency’s next example enforcement action – but, if you don’t understand the sea change going on right now in Washington, you may well be.

Compliance on a Budget: Can it be Done? What are the Risks?

Like a lot of people, when I was a younger, I always wanted the newest toy or the shiniest item in the store.    An unfortunate reality of growing up is that as we become adults, we come to the realization that things cost money and that there are limits to what we can spend.    We find out that everyone has a budget — whether we like it or not.   (Let’s not get into the Government budget process!)

Similarly, as quality and compliance professionals we are often challenged by the realization that what we would like to accomplish with our operations costs a lot of money.   People cost money;   instruments cost money;   computers cost money;    excellence costs money.     We are given budget targets (often reduced year over year) to hit, and increasing expectations regarding inspection performance and enforcement actions.  Particularly in the current business climate, executive management is scrutinizing all expenditures for value and return on investment, and adding fixed costs (translated:  people) is simply not being considered.     Given that the departments central to carrying out the activities that support FDA quality and compliance are resource-intensive functions, and that even with the best computerized systems, there is simply a great deal of work that people (yes, living-breathing people) have to do, how can we do this on a budget?     Is it possible to be successful in this environment?     In other words, what can we not afford to do and what risks do we incur by not spending as much as we would like?

Like the adult that has come to the realization that we can’t afford everything, we need to accept that modern companies, particularly the FDA-regulated companies we work for, will never stop their quest for continual cost-reduction.   This is especially true now that revenue streams from blockbuster products are in jeopardy, and companies are scrambling to maintain profitability against the specter of government-influenced pricing.  Unfortunately, many companies simply reduce heads without an in-depth understanding of what parts of their operations will be compromised, and call that effective fixed-cost management.    The problem with this approach is that most people in today’s corporations are not sitting around reading The Wall Street Journal – many people are already working 10-12 hours per day, efficiently, and are already using technology.      So, simply cutting people that may already be working hard, without much consideration about what work is now not going to be done, can actually impede your business revenue and profitability objectives, and worse, can place your company at significant legal or regulatory risk.

The secret of how to accomplish these difficult, conflicting goals is really not so secret.  It does, however, require companies to do a little planning, a little analysis, and embrace a little change.    Let’s explore two basic principles that I would submit are fundamental to successful headcount reduction, or, maintenance of existing staffing while still improving outcomes:

It Starts With Risk…

It seems like everyone is talking about risk management these days.    Risk management has been formally embraced by the FDA, risk MAPs are required for new pharmaceutical product introductions, risk concepts have been formally integrated into ICH Q10, and there is a growing cottage industry related to risk management and how to perform it.    While everyone is talking about risk management, most substantive information I review on risk management refers to risk management as the identification of all risk and the comprehensive set of activities that are intended to minimize or eliminate that risk.

However, true risk management starts with a very fundamental, and sometimes difficult principle for people to embrace – that is – that not all risk is equivalent, and that differentiation of risk is the most important factor in cost-effectively managing today’s quality and compliance operations.    The reason this is so difficult is that by differentiating risk, and focusing on only those risks that, well, present the most risk, you are implicitly acknowledging that you will take no action – purposefully – against some things that you know may go wrong.   This is a difficult concept to embrace in Corporate America today – executives have been less than enthusiastic about embracing mistakes – and, it is a difficult concept to present to the FDA when things go wrong.   However, it is imperative to understand that if you don’t differentiate risk, and address significant risks accordingly, you face the prospect of spreading your limited resources thin and ultimately, facing greater failure or more significant issues in areas that could create extraordinary problems for your company.   So, risk differentiation is an essential part of managing FDA-regulated operations today;   and fortunately, with the right assistance, there are methods and practices that can help you truly separate the proverbial wheat from the chaff with respect to your company’s quality and compliance risk.

… It Ends With Change

The other essential aspect to maintaining your functional operational outcomes while reducing or maintaining your fixed costs (headcount) is that you can’t expect other people to just “pick up” work that the targeted resources are performing, or, add additional  work to their already over-crowded plates.  There has to be a change in the way work is performed to make the work processes more efficient – in other words, so you can do more with less.     Without doing so, you simply are cutting possibly essential activities from occurring without understanding the impacts of the reduction.

The changes that could be considered to achieve efficiency improvements are extremely diverse.    You may need to make changes to process design;   you may need to implement new or improved computer systems;  you may need to change/upgrade your personnel capabilities;  you may need to add new equipment or automation;  you may need to make your documentation simpler.    The possibilities and the interrelated permutations are many and varied, but, it is essential that these possibilities be identified, and that maximum returns on investment be considered before changes are made.

On this topic, much has been made of what are called “lean” principles for process redesign and improvement.   The terms “Lean Quality” and/or “Lean Compliance” have become de rigueur in certain circles.    I guess because I hate buzzwords, I have refrained from embracing these terms – I look at the concept of Lean as basically a structured repackaging of pre-existing principles, and accordingly, not something that is really all that new (albeit, also not often well applied!).     Lean is, at its core, a very sound and effective approach to process redesign and organizational improvement.   In fact, Lean, like Six Sigma, and a host of other quality management and engineering tools, can provide significant value to the enterprise when applied and used properly as supportive of the changes that are necessary for the organization to make to ultimately, achieve more with less.

Managing FDA-regulated operations is not for the faint of heart.   Heavy science.   Strict regulation.   Overwhelming documentation.   Significant risk.   Extraordinary cost pressures.    However, by properly differentiating risk, and by engaging in well-substantiated operational change, you can improve your odds of success with all your stakeholders – executive management, the FDA, and your customers.

Regulatory Alert: New FDA Proposed Rule — Sponsor Reporting of Falsified Data

Today the FDA has published a proposed rule in the Federal Register (75 FR 33 at 7412, 2/19/10) that will require sponsors (and defining petitioners under food/supplement submission rules as sponsors) to report to FDA any instance of falsified data that the sponsor company identifies within a proposed or current human or animal study in support of pharmaceutical, medical device,  food, color additives, or dietary supplement approvals or clearances.    The rule is broad in scope, and is intended to drive down instances of falsified data contained within product approval or clearance submissions to FDA.   The FDA’s intent is to prevent “ambiguity in the current reporting scheme” that has caused confusion among sponsors and to “help ensure the validity of data that the agency receives in support of applications and petitions for FDA product approvals and authorization of certain labeling claims and to protect research subjects.”

Initial Analysis: This rule will effectively require the tactical  implementation of certain compliance program elements within the oversight framework for human and animal studies.   At a minimum, it should require additional training on the rule, and expectations regarding the prohibition of falsification of data under any circumstances.  It should also lead to incorporation of personal certifications of data integrity on data submission, and individual acknowledgment of penalties for falsification of data.

Audits, Assessments & Corporate Compliance Investigations

Although audits, assessments and corporate compliance investigations are not something most executives get excited about, they are critical to ensuring your FDA-regulated business is ready for any and all types of review by the FDA, Department of Justice or other regulator.  Audits, Assessments, Corporate Compliance Investigations and (one additional item) Mock Inspections are generally defined as follows:

  • Audit: A formal, often-privileged, structured, in-depth review of a company’s regulated operation for the purpose of determining deficiencies and deviations from established and understood regulatory standards. Audits are often “scored” for purposes of determining performance of an operation against accepted standards.
  • Assessment: A formal, not-privileged, and loosely structured review of a company’s regulated operation for purposes of determining issues, deviations from regulatory standards, opportunities for improvement, best practices and readiness for audit or inspection.
  • Corporate Compliance Investigation: A for-cause investigation, generally performed at the direction of the Company CEO, General Counsel, or Chief Compliance Officer, possibly subject to privilege if authorized and executed properly, and focused on confirming, or disproving, allegations of illegal conduct or violations of a company’s code of conduct, procedures, policies or other mandates. Corporate compliance investigations must conform to the highest standards of critical review to ensure discretion, confidentiality, comprehensive assessment and legal analysis are performed properly.
  • Mock Inspection: An audit performed by someone posing as an FDA Investigator for the purposes of determining operational readiness for a real FDA or other health authority inspection. Mock Inspections are both a readiness and training tool and provide significant value to an organization when performed properly.

Each of the foregoing can vary in intensity and rigor in accordance with the needs of the organization. Depending on the amount of time spent, each of these can be more or less rigorous (and correspondingly more or less expensive) depending on what level of risk and confidence each organization possesses.

For small and medium-size organizations seeking to proactively assess compliance, Compliance Architects® recommends a three-day review activity. For medium to large size organizations seeking to proactively assess compliance, we recommend a week to two-week review activity. Where corporate compliance investigations are indicated, specialized planning and cooperation with the Chief Executive and counsel are typically indicated.

For additional information on audits, assessments and investigations, contact Jack Garvey at john.garvey@compliancearchitects.com, or visit:  www.compliancearchitects.com

Contact Us Today