Compliance Architects

Consulting Technology Outsourcing

Urgency: Promise or Problem for FDA-Regulated Companies

strategy

Urgency: Promise or Problem for FDA-Regulated Companies

A couple of months ago I was engaged in a brief, friendly dialogue with one of my close friends – a college buddy – about a current business imperative:   urgency. My friend is a Senior Partner with a large, very well-known business consulting firm, and has responsibility for major projects within large pharmaceutical companies.

As part of our regular communications, my friend forwarded me the following “book review” that he thought would be of interest:

Latest book from John Kotter: “Urgency”

Essentially talks about how people/organizations need to develop “true urgency” as a core competency.  With the rate of change at an ever escalating pace, the traditional episodic approach to change (aka projects) will not be sufficient to sustain competitive advantage.  He describes three modes of operation:

1. not urgent — protecting the status quo 2. false urgency — frenetic activity… but not aligned, goal is to stay “busy” vs winning 3. true urgency — objective is to WIN – NOW, by doing something important everyday

My reaction to this review was somewhat less enthusiastic than I’m sure he was hoping for.  It initially struck me as “consultant speak” and self-serving – something that I feel is all too common in consulting circles.    After thinking about it further, I think that much of the challenge facing FDA-regulated companies, and business in general, is that individuals within these companies don’t challenge conventional wisdom nearly enough, and simply “lap up” the concepts presented to them. On this topic – the topic of “urgency” – I don’t think that we aren’t moving fast enough in the business world – in fact, I think we are often doing without thinking – we respond often without seeking to understand deeper issues just because we have to get a response developed, NOW! In this context, I offered the following back to my friend:

Being the contrarian that I am, I would suggest that “Urgency” has a big price — ask Toyota or BP.  The more things change, the more they stay the same — fundamentals are key today — and failure to focus on fundamentals (culture, the long view, structural profitability, maximum asset contribution, portfolio stability and strategy, etc.) is where companies are having difficulty. It would seem that viewing business challenges as running faster on the hamster wheel is a convenient distraction to actually achieving anything that builds long-term value.

My $0.02

Since that was a sound-bite, I’ll expand upon the principles I was trying to convey there. I am a strong believer in robust strategy development; open, honest communication and feedback; and comprehensive program planning and execution. Call me old-fashioned, but I’m a strong believer in fundamentals, and this is an area that I don’t think industry, and especially FDA-regulated industry focuses on enough.

I had three high-school football coaches that taught me life lessons I still embrace today (Thank you Coach Gilbo, Coach Cotter and Coach Guyette!), and one of the most important was the power of fundamentals. They used to tell me that in football, every play was meant to score a touchdown – if each person executed their blocks perfectly – the play would score. Simple. Fundamentals.

My friend responded back;

love the spar

Fact is the world has changed… no arguing the globalization and pace of continuous change we all deal with today  — due to advances in technology, the flattening of the globe, the information access afforded by the internet… etc.

Point is urgency (action towards competing the important activities — aka those that give you advantage) must be transformed from project specific and baked into the fabric of the enterprise (CULTURE)

Too many mistake “busy” for progress.

Now, I’m not exactly sure what he meant by this, but I’m guessing he bills more by the hour than me! Call me crazy, but I’m more in line with the ”Haste Makes Waste” camp than John Kotter’s (or my friend’s!) camp.

So, what do you think? Are we not moving fast enough? Or are we moving too fast? Any comments are welcome!

——————————————————–

For information on how to urgently address FDA compliance deficiencies and build sustainable compliance solutions within pharmaceutical, medical device and other FDA-regulated companies, please contact Compliance Architects® at info@compliancearchitects.com or at 888-734-9778.

CAPA – The Untold Story

Try as I might in my consulting work, I can never seem to get away from CAPA.    As much as I would like to help companies prospectively improve their process control;   embrace better quality system integration and document design;   assess and implement computer-based quality systems; and use process risk analysis to rationalize quality system decisions and improve inspection outcomes (among other things I love to do), it always seems like companies need help – and lots of it – with CAPA.

Now don’t get me wrong – I certainly understand the importance of CAPA, and why it is such a necessary system.     And all you have to do is read a few FDA Warning Letters or look at industry training offerings to see how significant CAPA is to the FDA, and as a result, to FDA-regulated industry.    And CAPA in its current form has been around a long time – at least since the 1996 formal effective date of the medical device Quality System regulation.     Unfortunately though, CAPA has gone far beyond being just an important sub-system that helps to resolve any one of those many, many things that can “just go wrong” for a manufacturer of FDA-regulated products.   CAPA has in recent years become the de facto cornerstone of FDA-regulated quality systems (with the expectation expanding far beyond just devices!)      Given this development, you have to ask yourself:    What does it say about the state of control within FDA-regulated industry that a system that is designed to remediate failures is now the cornerstone of most companies’ quality systems?     As troubling as the implications of this statement are, it is a topic I will leave to discuss another day.

That’s because today I want to talk about CAPA – The Untold Story.

REAL WORLD CAPA PROBLEMS

As I alluded to above, I see lots of CAPA systems.     Or better said, I see a lot of CAPA procedures.     Or more precisely, I see a lot of CAPA procedures masquerading as CAPA systems.        What I mean by that is – I see a lot of companies in their desire to have “an SOP” in place for CAPA, confusing the process of CAPA completion with the need to have a CAPA system of incident identification, analysis, categorization, evaluation, investigation, reporting, follow-up, etc.    In large part, because CAPA has become such a fundamental part of FDA’s regulatory expectations, the scope and extent of what we now call CAPA has grown along with it.    This growth in scope – by well intentioned Investigators looking to CAPA as the primary solution to a company’s problems, and by companies that are only trying to do the right thing by having a comprehensive CAPA program in place – is itself causing some of the poor outcomes with CAPA.   As scope increases, complexity often increases.    So despite the focus on CAPA – what’s wrong?   Why do many companies – solid, name companies in addition to small and mid-size companies – have such continuing trouble with CAPA? From what I see, despite this focus and good intent, there are many causes for poor CAPA system designs and compliance outcomes.  A few of these include:

  1. Failure to differentiate between the CAPA system and the CAPA execution process;
  2. Failure to describe in an easy to understanddocument or documents:
    • how the different elements  of CAPA work together;
    • how to define and differentiate trigger events; and
    • how the different elements  collectively contribute to the overall concept of control.
  3. Insufficient knowledge and lack of training for SMEs on how to document, investigate, analyze, and most importantly, write-up good, understandable CAPA documents;
  4. Overcomplicating the simple; and
  5. Trying to make CAPA something it is not (like Six Sigma/DMAIC) or failing to understand CAPA is a regulatory requirement – not something that you can adapt to your liking in the guise of something like “continuous improvement.”

As figure 1 below shows conceptually, there are a lot of inter-related elements to a good CAPA program, and using text based documents – SOPs – to describe how these inter-related systems work, and where process begins and system ends, can be a challenge.

CAPA System Integration

This is where the concept of “The Untold Story” comes into play…

THE UNTOLD STORY

So what do I mean by “The Untold Story?”    I mean – or better said I see (and this may be the biggest “duh” thing I’ve ever written)  – that many firms fail to communicate effectively in their quality and compliance documents.    And, nowhere is this more apparent than in the documents that define and constitute CAPA.

Initially, many of the CAPAs that I read are almost unintelligible!  They are filled with jargon , disconnected statements, proprietary acronyms, unsupported conclusions, data and statistics with no explanation, and often, internal inconsistencies.    Further, many companies have almost no idea of how the sub-process elements (or some would call “inputs”) of CAPA work together, much less are able to describe this effectively.      From this and a review of many other types of compliance documents (submissions, procedures, etc.)  I have come to believe that one of the most important failures in FDA compliance activities is the failure to communicate simply and effectively.  (2018 Update:  See Writing for Compliance®)

So what does this mean to CAPA?   Well, in my strong belief, good CAPA is nothing more than a good story – or better said, a series of related stories.    But why stories?     Why not a report?  Why not a quality record?   Why not an investigation protocol?    Why not a journal?

Well simply, because humans are hard-wired for stories!

It’s in our DNA – it’s in our genes.    From the water-cooler to the television;  from the dinner-table to the cinema;    from political speeches to the evening news, humans process communication best if it the communication takes the form of a story.   And with CAPA (like other FDA-required documents) why do we create these documents anyway?    Because we have to?   Well yes, but more importantly, we create them so that we can communicate – effectively – in this case to an FDA Investigator – what we do, and how we do it.

So if we want to communicate effectively to FDA, we need to communicate more stories.   We need both our CAPA system and our individual CAPAs to tell a story!

My experience has been extremely positive working with clients on this one simple concept.    Stories are actually pretty simple to write – and CAPA’s actually are perfectly adapted to follow the same basic structure:

STORY STRUCTURE1 CAPA STRUCTURE
Exposition:    Character /
Scene Development		 Background and Details of Event/Incident
Conflict / Rising Action Investigation
Crisis / Climax Root Cause Analysis
Falling Action / Resolution Corrective / Preventive Action

The application of a basic, simple story structure can help you immensely improve your technical writing for FDA compliance.   Clearly though, we are not writing childrens’ novels, or even adult fiction.   There will be references to SOPs, technical details, organizational structures, complex activities, etc.  However, when you place all of these complicated elements in the structure of a simple story, it becomes so much easier to understand than if you are forced to simply read, e.g.,  fishbone diagram outlining the factors in a root cause analysis without any context.   This type of writing will help FDA Investigators understand your operation, help you to know that your SMEs and responsible CAPA authors understand the issues associated with the failure, and overall, improve your compliance outcomes.  (2018 Update:  See Writing for Compliance®)

—————————–

For information on how to build sustainable FDA compliance with world-class CAPA programs for pharmaceutical, medical device and other FDA-regulated companies, please contact Compliance Architects® at info@compliancearchitects.com or at 888-734-9778.

1 Literary Elements (http://www.orangeusd.k12.ca.us/yorba/literary_elements.htm)

The Risk of Using the GMPs to Design Your Quality System

Holmes on Homes

Over the last few months, I’ve become a big fan of a TV show called Holmes on Homes.   The show features super-hero contractor Mike Holmes coming to the rescue of homeowners across Canada and the United States that have been the victims of shoddy home contracting work.   Wildly successful on HGTV, Holmes on Homes provides viewers with technical insight into the highly inconsistent world of home contractors, and highlights how “doing the minimum” or worse, can result in high levels of frustration, a very big repair bill, and incredible amounts of lost time by the affected homeowners.

As I watched Mike Holmes come to the rescue week after week, it became clear to me that many of the compliance problems that we encounter within FDA-regulated companies stem from a common problem that Mike runs into, namely, building something to “minimum code.”    Now, to a lot of people, the last statement might not seem to make sense, and goes against much of what they’ve been taught.   If we try to meet minimum code, then how could that be a problem?    If our quality systems meet the minimum stated requirements of the law, then how could the FDA have a problem with them?   Why should we do more?  And even if we wanted to, what should we do?    If I have a validation program – if I have a CAPA system –  if I do annual product review or management review – if I perform calibration – haven’t I done enough?

In short, the answer to these questions is an emphatic “no!”

GMPs:  Design Document or Checklist?

The reason that following the minimum code – in this case, the GMPs (or rather, using the GMPs as the sole basis for how your quality system should function) is not sufficient to meet FDA requirements or expectations is that the GMPs are not design documents! In other words, whether it’s the GMPs, (or as Mike Holmes often finds, the building code) these documents are not, and never were, intended for the purpose of designing something that needs building.   These documents are intended solely to establish basic minimum requirements – legal requirements – but they are most certainly not design documents!    Now these documents are important – I’m not recommending you ignore the GMPs;   however, they are important within a very specific context only, i.e., the verification of the adherence of design and function of your quality system to the stated regulations and FDA expectations.     And for the purposes of this discussion, I won’t even discuss the fact that much of what is required by the FDA is not found within the GMPs and is often extremely difficult to identify and apply.

In addition, what happens within many FDA-regulated companies is that people that have no experience with the design and building of systems, even if they had the proper design documents, are given the task of designing, developing, and building these complicated quality systems, using nothing more than the minimum code – the GMPs.     As a result, these systems are almost always built without consideration of the  products’ particular technologies, intended purpose, patient population, the company’s facilities, the complexity of the processes, the company’s organizational model, personnel capabilities, risk tolerance, product supply strategies, fulfillment strategies, etc.,

Given this, it’s no wonder why there is a poor
track record of compliance within FDA-regulated industry.

Thinking further about the challenges Mike Holmes encounters, it is likely that more design effort is typically expended in building a $300,000 residential home than is spent by most companies on the quality systems that form the basis for hundreds of millions of dollars in operational spend!    At least most residential homes have blueprints – which are at least design documents;   most quality systems have nothing approximating blueprints.

Savvy companies can use these failings of their competitors to great competitive advantage.   Well designed quality systems can improve your product quality, fulfillment and compliance outcomes; can help maintain or reduce fixed costs; and will result in a more predictable supply-chain operation for executive management.   Also, well-designed quality systems can keep you on the right side of the law.   The investment in a solid quality system design effort – or often, a re-design effort – can yield better performing systems and improved inspection outcomes.

Design for Compliance Points to Consider

Given the foregoing, what are some things executives of FDA-regulated companies should consider to improve their quality systems and ensure they are designed and built to meet FDA requirements and expectations:

1)       To use an analogy, consider that that just because you live in a house, doesn’t mean you can build one! Your company’s quality team may do an excellent job with managing base business; however, that doesn’t mean they know how to design and build effective, compliant quality systems.    The skills to manage and operate within a well-designed system are not the same skills required to build one.   Get professional assistance with designing these systems for maximum outcomes and effectiveness.

2)     The FDA will not, and cannot, tell you what you need to do to comply with legal requirements.   FDA personnel are severely constrained with what they can tell you about how to comply with their regulations and expectations.  More importantly, FDA personnel aren’t quality system design professionals and really don’t know how to design quality systems for business and compliance success.    To use another analogy, would you hire a building inspector to build your house??   No, you wouldn’t.    The skills that an FDA Investigator brings to bear on assessing your operation are not the same skills that are necessary to design and build good quality systems in the first instance.

3)     Even if you were fortunate to have a well-designed quality system a number of years ago, due to the natural evolution of business operations, it’s a good bet that these systems need re-development.    Changes to your business through outsourcing, new products, changes in personnel, changes in individual procedures, acquisitions, mergers, in-licensing, etc. all create disconnects and dis-integration of systems that can create significant quality, compliance and operational failure possibilities.   Have skilled design professionals “re-engineer” your systems every few years to be sure they are operating at maximum effectiveness.

4)     Be careful with focusing too much on spending just the minimum to comply with the GMPs.     There is no bright-line of compliance when dealing with the FDA, and many a company has played the game of nickel and dime-ing quality and compliance expenditures only to be stuck with a very, very big bill later on!     The saying, “penny-wise and pound-foolish” exists for a reason, and it could not have more relevance than in the context of FDA-regulation.

Companies that look at FDA compliance as merely a checklist activity to engage in to write some SOPs for an FDA Investigator to look at when they walk in the door are doing themselves a grave disservice.     The development of FDA-compliant quality systems takes an extraordinary combination of subject matter expertise, high-level design effort, visualization, integration activities, and document drafting expertise (among other things) to ensure successful outcomes.    Although doing so requires significant investment, when you eventually have to sit across the table from an FDA Investigator, you will be able to feel confident that you are well-positioned for compliance success and ultimately, for long-term business benefits.

For further information on how to develop high-performing quality systems for pharmaceutical, medical device and other FDA-regulated companies, please contact Compliance Architects® at info@compliancearchitects.com or call us at 888-734-9778.

Admissions of Failure – A Lesson from Google for FDA-Regulated Companies?

Imagine seeing the following (imaginary)  Wall Street Journal headlines:

ACME Pharmaceutical Admits Product is No Better Than Competitor

CRO Co. Report Shows Poor Clinical Program Effectiveness

Device Co. Reveals Close to 25% of Research Money Wasted

Without a doubt, these headlines would surprise us. As well-educated, experienced industry participants, we have come to expect virtually everything we read about FDA-regulated companies to have gone through the most rigorous of spin cycles:   multiple levels of internal review, crisis communications committees, internal and external legal counsel, public relations, investor relations, and perhaps even a review by the CEO.     Having direct experience with these types of activities as an attorney and compliance executive, and knowing how carefully managed the image of most of the companies we work with is, I was taken aback recently by one of my favorite successful companies:  Google.

Google

Almost singular among companies, Google requires no introduction.    All of us use Google on virtually a daily basis, and it has become the definitive knowledge attainment tool of the Internet Age.    We look up to Google.   We are impressed at its size, success, culture, performance, results, and influence.   Given the ubiquitous nature of Google and its search product, and how important Google is to virtually everyone’s lives today, Google has become the new AT&T – the new Microsoft – the new Goliath for the David companies to attempt to knock down.

We would expect a company such as this to be incredibly careful about its image.   We would expect nothing to emanate from within Google’s four walls without an armada of attorneys having transformed the initial informative message from the original content into a soft, chewy pablum of weasel words and non-committal language.    However, it appears that nothing could be further from the truth.

Google Unvarnished

About a week ago, Google itself provided the entire world with a comprehensive, straightforward report about its poor performance in an important area of its business:   how well its website products show up in search results.    Now although this report doesn’t tie directly to its core AdWords product, it does discuss, in detail, how Google dropped the ball – badly – in an area that they should have had the skills and talent to be the best in the industry.    In effect, they provided the entire world with a detailed report that would allow the creation of headlines just like the ones above.

See

1) Google Admits SEO Failures: http://news.cnet.com/8301-27076_3-20000121-248.html and

2) Google SEO Report:    http://www.google.com/webmasters/docs/google-seo-report-card.pdf

Looking at this report got me to thinking – why would Google do such a thing?  Why would they show a fallible side?    What do they stand to benefit?    And, given the industry that I spend my days in, what lessons can we learn from this admission that could be applied to and/or benefit FDA-regulated companies?

Apples to Oranges?

Now to be fair, I’m not sure that many companies in many industries would be so open as to air their dirty laundry so openly and honestly.   It’s virtually unheard of for companies, in any industry, to even acknowledge, much less admit, the negative aspects or performance of their organization or their product or service portfolio.    However, particularly for FDA-regulated companies, it has become almost Gospel that negative information should be suppressed; that it should always be presented in a positive light; and that acknowledging failure or mistakes will result in all sorts of terrible things happening.    Regardless of whether the information deals with business strategies, product lifecycle challenges, R&D failures, or manufacturing deficiencies, the standard line out of FDA-regulated companies seems to be:   “We’re fine.”   “We have it under control.”    “We know what we’re doing.”    “We don’t need to change anything.”

So is this the right approach?    Are FDA-regulated manufacturers missing an opportunity?    Would a greater level of transparency and willingness to show fallibility be beneficial to the bottom line?

Balance Point

Like most difficult concepts, responding to the above questions isn’t an either/or proposition.    It is clear that our industry products are significantly different from Google’s search product, and, they certainly live under a far different regulatory scheme.    And, there is a much greater liability (legal and regulatory) exposure for mistakes and defective product offerings in our industry when compared to Google.    So, admission of mistakes, failures, and poor performance needs to be done carefully, and must balance the benefits to be realized, with the risks from disclosure.

But what are the benefits of admission? It is somewhat counter-intuitive that admissions of fallibility can yield benefits in a corporate setting, and especially with FDA-regulated companies.   Let’s however, explore three possible reasons why companies may want to be more transparent and more open to admission of failure.

1) Trust and Credibility

I would submit that the number one reason FDA-regulated companies should consider being more openly fallible is that such disclosures build trust and credibility – not only with their customers – but with the FDA and the DOJ, and if the situation was right, with juries and the Courts.      And there are two recent examples of this concept in play in the recent news.

At one extreme we have Toyota and their handling of the automobile acceleration issue that had been brewing for years, and which was somewhat mis-managed internally.   From the viewpoint of a casual observer, it appears that Toyota was more interested in managing its image than definitively fixing the issue and being honest with their customers and other stakeholders.   If that is the case, they are now paying the price – in very significant financial terms that have shaken the once unassailable company to its core.

At the other extreme, similar to Google, we have Domino’s, which has recently admitted, well, that their pizza has not really tasted that good all along.    In a public campaign of mea culpa and with what must have been an incredibly difficult admission, the CEO of Domino’s went on TV to say that their pizza just didn’t meet the standards of what they felt was necessary to satisfy customers, but, that they were going to change, and, then, asked if the consumers would give them another chance.   From all indications, consumers are doing just that – giving them a chance.

2) Empathy and Compassion

Empathy and compassion can be powerful attributes for your business.    People, including regulators, the Courts, and the public, can be very forgiving of a company that shows it is real and has real weaknesses and that makes mistakes, because then, the company is more “like us”.    Particularly for gargantuan enterprises like Google, and in our industry, the big pharmaceutical, medical device and biologics companies, empathy and compassion can be a little lacking.      Again, using the balance principle, you need to be careful about what admissions of fallibility you make; however, when properly positioned and considered, gaining empathy and compassion can be a powerful part of your overall business success model.

3) Continuous Improvement and Excellence

The most successful companies in the world are in a constant state of continuous improvement.    Excellence in product design, service delivery, customer service, regulatory compliance, or any of a number of other business functions requires a constant willingness to be hyper-critical of your own organization within the context of positive change.    To quote an oft-used phrase, you sometimes have to be willing to accept that your baby is ugly.

So how does admission and acceptance of fallibility fit into continuous improvement and excellence?    In short, it flows from tone at the top.   If a company is willing to be transparent and forthright – admitting its failures and mistakes – individuals within the company will be more comfortable and trustful that raising the issues that are important won’t result in negative ramifications.    From direct experience and observation, I have learned that in most cases, companies have people within their organization that know the problems – know where the issues are – and know how to fix them – and that in many cases, their company’s culture won’t permit them to be honest, direct and forthright – to the company’s detriment.     By allowing admission – by being fallible – by showing that you want to identify your mistakes – a company can send a powerful message to its employees that it recognizes the importance of its people, and that it wants them to foster positive change for the organization.

The Way Forward

These concepts are incredibly difficult to put into practice, and likely, that’s why they aren’t seen more often.    It’s much easier for a company to simply say nothing, or to create highly-spun content that says or reveals nothing, than to think hard about how to be fallible, and to have someone make a decision that, admittedly, may sometimes backfire.     However, I would submit that there very well may be a lot to gain in the long run from a more open, transparent, direct corporate culture, and from being trusted and credible in the marketplace.

So what do you think – am I off here?   Am I missing something?    Is FDA-regulated industry just so different that considerations of trust, credibility, empathy, and compassion don’t apply, or, can FDA-regulated companies really learn something from Google?

Compliance on a Budget: Can it be Done? What are the Risks?

Like a lot of people, when I was a younger, I always wanted the newest toy or the shiniest item in the store.    An unfortunate reality of growing up is that as we become adults, we come to the realization that things cost money and that there are limits to what we can spend.    We find out that everyone has a budget — whether we like it or not.   (Let’s not get into the Government budget process!)

Similarly, as quality and compliance professionals we are often challenged by the realization that what we would like to accomplish with our operations costs a lot of money.   People cost money;   instruments cost money;   computers cost money;    excellence costs money.     We are given budget targets (often reduced year over year) to hit, and increasing expectations regarding inspection performance and enforcement actions.  Particularly in the current business climate, executive management is scrutinizing all expenditures for value and return on investment, and adding fixed costs (translated:  people) is simply not being considered.     Given that the departments central to carrying out the activities that support FDA quality and compliance are resource-intensive functions, and that even with the best computerized systems, there is simply a great deal of work that people (yes, living-breathing people) have to do, how can we do this on a budget?     Is it possible to be successful in this environment?     In other words, what can we not afford to do and what risks do we incur by not spending as much as we would like?

Like the adult that has come to the realization that we can’t afford everything, we need to accept that modern companies, particularly the FDA-regulated companies we work for, will never stop their quest for continual cost-reduction.   This is especially true now that revenue streams from blockbuster products are in jeopardy, and companies are scrambling to maintain profitability against the specter of government-influenced pricing.  Unfortunately, many companies simply reduce heads without an in-depth understanding of what parts of their operations will be compromised, and call that effective fixed-cost management.    The problem with this approach is that most people in today’s corporations are not sitting around reading The Wall Street Journal – many people are already working 10-12 hours per day, efficiently, and are already using technology.      So, simply cutting people that may already be working hard, without much consideration about what work is now not going to be done, can actually impede your business revenue and profitability objectives, and worse, can place your company at significant legal or regulatory risk.

The secret of how to accomplish these difficult, conflicting goals is really not so secret.  It does, however, require companies to do a little planning, a little analysis, and embrace a little change.    Let’s explore two basic principles that I would submit are fundamental to successful headcount reduction, or, maintenance of existing staffing while still improving outcomes:

It Starts With Risk…

It seems like everyone is talking about risk management these days.    Risk management has been formally embraced by the FDA, risk MAPs are required for new pharmaceutical product introductions, risk concepts have been formally integrated into ICH Q10, and there is a growing cottage industry related to risk management and how to perform it.    While everyone is talking about risk management, most substantive information I review on risk management refers to risk management as the identification of all risk and the comprehensive set of activities that are intended to minimize or eliminate that risk.

However, true risk management starts with a very fundamental, and sometimes difficult principle for people to embrace – that is – that not all risk is equivalent, and that differentiation of risk is the most important factor in cost-effectively managing today’s quality and compliance operations.    The reason this is so difficult is that by differentiating risk, and focusing on only those risks that, well, present the most risk, you are implicitly acknowledging that you will take no action – purposefully – against some things that you know may go wrong.   This is a difficult concept to embrace in Corporate America today – executives have been less than enthusiastic about embracing mistakes – and, it is a difficult concept to present to the FDA when things go wrong.   However, it is imperative to understand that if you don’t differentiate risk, and address significant risks accordingly, you face the prospect of spreading your limited resources thin and ultimately, facing greater failure or more significant issues in areas that could create extraordinary problems for your company.   So, risk differentiation is an essential part of managing FDA-regulated operations today;   and fortunately, with the right assistance, there are methods and practices that can help you truly separate the proverbial wheat from the chaff with respect to your company’s quality and compliance risk.

… It Ends With Change

The other essential aspect to maintaining your functional operational outcomes while reducing or maintaining your fixed costs (headcount) is that you can’t expect other people to just “pick up” work that the targeted resources are performing, or, add additional  work to their already over-crowded plates.  There has to be a change in the way work is performed to make the work processes more efficient – in other words, so you can do more with less.     Without doing so, you simply are cutting possibly essential activities from occurring without understanding the impacts of the reduction.

The changes that could be considered to achieve efficiency improvements are extremely diverse.    You may need to make changes to process design;   you may need to implement new or improved computer systems;  you may need to change/upgrade your personnel capabilities;  you may need to add new equipment or automation;  you may need to make your documentation simpler.    The possibilities and the interrelated permutations are many and varied, but, it is essential that these possibilities be identified, and that maximum returns on investment be considered before changes are made.

On this topic, much has been made of what are called “lean” principles for process redesign and improvement.   The terms “Lean Quality” and/or “Lean Compliance” have become de rigueur in certain circles.    I guess because I hate buzzwords, I have refrained from embracing these terms – I look at the concept of Lean as basically a structured repackaging of pre-existing principles, and accordingly, not something that is really all that new (albeit, also not often well applied!).     Lean is, at its core, a very sound and effective approach to process redesign and organizational improvement.   In fact, Lean, like Six Sigma, and a host of other quality management and engineering tools, can provide significant value to the enterprise when applied and used properly as supportive of the changes that are necessary for the organization to make to ultimately, achieve more with less.

Managing FDA-regulated operations is not for the faint of heart.   Heavy science.   Strict regulation.   Overwhelming documentation.   Significant risk.   Extraordinary cost pressures.    However, by properly differentiating risk, and by engaging in well-substantiated operational change, you can improve your odds of success with all your stakeholders – executive management, the FDA, and your customers.

The Importance of Compliance Strategy

strat – e – gy [strat-i-jee] – noun

  1. skillful use of a stratagem: The salesperson’s strategy was to seem always to agree with the customer.
  2. a plan, method, or series of maneuvers or stratagems for obtaining a specific goal or result: a strategy for getting ahead in the world.
  3. The art or skill of using stratagems in endeavors such as politics and business.

(dictionary.com)

Strategy is not something often associated with compliance operations or activities. In fact, compliance is virtually never considered strategically, and certainly the design of compliance functions, staff models, document systems, computer operations, etc. are not designed strategically. This is a major mistake on the part of most regulated enterprises.

Exceptional compliance outcomes only result from top-tier compliance strategies, implemented with robust compliance architectures, compliance-supportive cultures and world-class teams!

How do you develop a world-class compliance strategy? Here are a few points to consider:

  • If you are an FDA-regulated company, it is likely that more than 80% of your business has extensive regulation. Weaving regulatory requirements, expectations and risk-tolerance together with your business objectives will help to ensure you have invested properly, understand your risks, and have taken the appropriate actions to protect your business for the future.
  • Most compliance activities have not been considered in a strategic review for fit to purpose, business supportive capability, or even appropriateness for risk-reduction. In fact, many executives have NO IDEA of how well performing their compliance functions are, and whether they are ready for the FDA or other regulatory body. This is astonishing considering upwards of 25% of operational fixed costs (CA estimate) can likely be attributed to regulatory compliance functions. Billions of industry dollars are spent each year on compliance operations, without high-level strategic integration and business support analysis. How can this be?
  • The compliance / enforcement record of FDA-regulated industry is abysmal! If we operated in the nuclear industry, the regular and consistent enforcement actions attributed to individual companies would be front page news in the Wall Street Journal! Yet, in FDA-regulated industry, we accept it as normal, and the cost of doing business. For companies committed to success, this enforcement track-record should not be acceptable.

Developing a compliance strategy is not hard — but it does take vision, knowledge, expertise, business acumen, and a commitment to excellence that is often lacking. We can help you ensure your compliance operations are strategically integrated into the your company’s long-term business success. Isn’t that the least your company deserves?

For information on how to develop a world class compliance strategy, contact Jack Garvey at john.garvey@compliancearchitects.com, or visit our website at:  www.compliancearchitects.com

Contact Us Today