Business continuity in pharmaceutical company research and development – can one size fit all?

April 2021 | EXPERT BRIEFING | RISK MANAGEMENT

financierworldwide.com

2020 turned out to be the year that business continuity was pushed to the forefront of many minds. Until the emergence of coronavirus (COVID-19), business continuity was mostly something performed in the background, often by a few risk professionals. This became apparent as many business continuity plans were never triggered, despite being drafted to help organisations continue critical operations during a major crisis and recover quickly after.

But why?

COVID-19 was, and still is, a truly unprecedented event that has affected the entire globe in some way – both professionally and personally. A ‘typical’ crisis response is limited to a select few trained individuals who deal with recovery and resumption activities. This time, it really was a case of ‘all hands-on deck’. It was not solely the job of business continuity teams to make sure things kept running. That, coupled with the necessary focus needed to maintain the long-term wellbeing of employees, made this a unique experience.

Comprehensive business continuity planning addresses pandemics as a disrupting scenario, but the usual assumption is based on the impact to people, and strategies are put in place to deal with a reduced workforce. However, for many organisations this was not the case, and most employees were able to switch from their office environment to home working with relative ease. The nature of the crisis means that our virtual connectivity has accelerated as our free movement has been restricted. Despite being aware of the global nature of business and supply chains, most business continuity plans did not account for border closures and global restriction of personnel movement.

The complex nature of the interactions from hospitals and clinics, to patients and health authorities, means that continuity is far more than a simple business issue for the pharmaceuticals industry, which requires full compliance not only with international business continuity standards and best practices, but also with a number of industry regulations requiring a higher level of adherence.

The types of potential disruption, which may range from pandemic to supply chain interruption, from power failure to cyber attack, are less important in business continuity planning than the consideration of the impact. All these types of disruptions could result in delays to clinical trials and regulatory reporting, patient outcomes, product launches, or loss of sponsors, investors and collaborators.

What is so special about research & development (R&D)?

There is no single best way to approach resilience planning. Each approach is reliant on the organisation and its setting. R&D relies on its ability to be novel for its longevity and success, and as such will have various requirements dependent on its vertical market, size and programme development.

Everyone loves the ease of ‘one size fits all’, however this is rarely fit for purpose. Too often this ‘size’ is enormous, excessively small, or simply not right. A business continuity programme needs to embrace the nuance of its environment, be pliant to it, and ready to change and develop as the business unavoidably does. The programme must be appropriate for objectives and goals, as no organisation is a ‘one size fits all’ organisation.

Biomedical research requires specific business continuity planning. One typical strategy is to shift critical business processes to an alternate site. This would not be possible due to the specialised nature of equipment, vivarium, laboratory facilities in need of environmental controls, and in some cases, special licences for the premises from regulatory authorities (biosafety labs and animal welfare, for example).

The unique nature of specialised equipment and processes also brings challenges in the planning phase. Certain consumables may only be available from one vendor or may require a lengthy order-to-delivery time, thus making another classic business continuity strategy of dual sourcing unsuitable. Ensuring surplus stock of these rare materials and off-site storage becomes key. So too does the creation of back-up repositories for critical biological samples that require cold storage to enable easy retrieval of these critical assets once businesses are up and running again.

In the development area, the challenges are equally unique. There are no typical scenarios on which to base your planning. The global pandemic showed us that business continuity planning had to extend beyond the usual workplace boundaries and consider how patients could get to hospitals to receive their investigational medicinal product, if indeed drug supply was still guaranteed.

The sheer time (up to 14 years) and cost (between £1bn and £11bn) it takes to get from basic research to drug product launch means that some form of business continuity planning is of huge value. The traditional application of classing a process as key for inclusion in the scope of planning is often set at 30 days, which can limit the thinking of business continuity professionals. Couple that with the inherent nature of R&D, where only 12 percent of basic research ‘hits’ even make it to a phase 1 (safety test) clinical trial, makes it hard to know where to begin and where to end when starting a business continuity programme.

Once at the clinical trial phase, there is a shift of focus from preserving intangible creations of the human intellect and physical assets such as a compound, to protecting intellectual property and ensuring the safety of patients and trial subjects.

In both research and development, the specialised knowledge and expertise of staff, both in-house and outsourced, is paramount to achieving business objectives. These staff cannot be easily replaced due to the extensive training required for them to undertake critical tasks, often in an environment with complex information technology.

How do we measure success?

It is paramount to ensure true business continuity and incident response capabilities are always in place. The key takeaway is to keep plans flexible and agile.

Success is often not about the plan itself; rather, it is based on the embedded personal and organisational resiliency it brings. The well-rehearsed teams who can quickly adapt to work around serious disruptions will help to not only continue with the most critical operations, but to safeguard people, assets and reputation to minimise adverse impact. Organisations that thrive in these circumstances are those that trust their employees to do the right thing and offer them flexible tools and working options to achieve.

The true sign of success is not when a business continuity plan is formally activated during a crisis, but when people are working together on a common goal, making informed decisions and empowered to take the right actions, meaning the plan never needs to be invoked.

What next?

The benefits that come from being adequately ready for any situation, rather than firefighting, far exceed the time and resources needed to ‘do’ risk management well, regardless of industry.

2020 highlighted the need to strengthen our horizon scanning for emerging risks and collectively improve our ability to find value creation in our risk management efforts, to add to the standard value protection benefit.

Many organisations already had mature business continuity management systems. Despite this, many plans were left gathering dust in the bottom drawer. It is evident that a focus on organisational resilience is needed and traditional business continuity is no longer enough. One cannot separate critical business processes and human factors. What is needed is a forward-thinking approach with a risk mindset, being open-minded and flexible, accepting that what is valid today may not be tomorrow.

Finally, while advances in data and digital expansion have been progressing steadily over the years, especially in the pharmaceutical sector, major crises like COVID-19 have significantly accelerated the pace of adoption of digital transformation technologies. Business continuity planning needs to follow the trend. Whatever our business, we cannot predict the unknowns, but we can plan for them.

Susie Ansary-Smith, global head of risk & resilience at Novartis Global Drug Development. She can be contacted on +41 (79) 825 1061 or by email: susie.ansary-smith@novartis.com.

Susie Ansary-Smith

Novartis Global Drug Development