Top Five Compliance Risks Facing Life Sciences Companies

By Scott Bruns and Kathleen Meriwether of Ernst & Young

It is difficult to adequately describe the risks facing life sciences companies these days without considering the exhaustive efforts to reform the US healthcare system. Questions related to drug and device pricing predominate this national effort, and the answers to those pending questions will most likely necessitate new industry approaches to ensure compliance with whatever regime US leaders ultimately elect.

While healthcare reform dominates the political agenda in the US and in many other key nations around the world, the economy continues to take front and center stage as global markets still struggle to recover from the financial crisis. In general, however, life sciences companies as a whole, have been relatively unscathed by the downturn compared to global companies in other industry sectors. Pressure to cut costs and rethink business models began well before the economic downturn as companies sought to address expiring patents on blockbuster drugs and weak product developments pipelines.

Recently, Ernst & Young sat down with corporate leaders across 14 industries to compare the challenges and lessons learned from the economic downturn. In our Lessons from change report, what stood out for the life sciences industry – compared to other industries – was the extent to which the crisis permanently changed the compliance-critical aspects of the business: risk management and the regulatory framework. The survey showed that 68% of life sciences companies, versus 56% across all industries, reported permanent changes to risk management practices. And 64% of life sciences companies, versus 45% across all industries, reported permanent changes to the regulatory framework.

Life sciences companies have continued to reach out to a growing network of suppliers, researchers, manufacturers, distributors and other third parties to collaborate on and, in some cases, to divest of non-strategic business functions. This evolving healthcare “ecosystem” has added further complexity to an already challenging compliance and risk management environment. Further, the potential harmonization of international accounting standards throws yet another wrinkle into the risk-taking environment.

As numerous challenges bear down on the life sciences industry, here are five that tend to top most compliance agendas:

Risk #1: Sales and marketing

Sales and marketing practices continue to receive significant scrutiny from regulatory agencies and other stakeholders worldwide. Yet compliance with the myriad of country-specific rules governing the promotion of pharmaceuticals on a global level remains challenging. Investigations and enforcement efforts regarding sales and promotion activities have focused on four key areas:

• Off-label promotion of non-approved uses of a drug
• Company interactions and transactions with healthcare professionals and institutions (see Risks #2 and #3)
• Disclosure and publication of clinical trial results
• Treatment of benefits and risks information in promotional activities

Off-label use of medications is common in clinical practice and approximately one-fifth of all drugs are prescribed off-label. In the US, FDA regulations do not restrict healthcare practitioners from prescribing approved medications for uses other than those indications approved by the Agency. However, pharmaceutical companies are prohibited from advertising or promoting a drug for non-FDA approved indications. Over the last several years, the US government has stepped up its efforts to penalize companies that market their drugs illegally. Between 2003 and 2009, US federal prosecutors and state attorneys general brought numerous cases against drug makers for off-label marketing and obtained more than US$9 billion in criminal and civil settlements.¹

New compliance challenges for sales and marketing are also quickly emerging as online drug advertising becomes a viable promotion channel for the industry. According to a November 2008 study by Manhattan Research, more than 60 million US adult consumers reported using health blogs, online support groups and other health-related social media applications, double the number who reported using such websites in 2007.² The FDA is now moving to provide guidance, starting with a public hearing on 12 and 13 November to “discuss issues related to the promotion of FDA-regulated medical products … using the Internet and social media tools.” Companies can participate and/or comment through 28 February 2010. With the legal and regulatory environment of social media still unclear, companies are proceeding cautiously, especially with pharmaceutical products, to avoid scenarios that may be considered off-label promotion.

Risk #2: Foreign corrupt practices act

The life sciences industry’s forays into overseas markets are increasingly leaving companies vulnerable to another kind of compliance risk, that which is governed by the longstanding US Foreign Corrupt Practices Act (FCPA). The FCPA expressly prohibits companies from making corrupt payments to foreign officials for the purpose of obtaining or keeping business. In addition to the FCPA, 37 countries have ratified the Organization of Economic Cooperation and Development (OECD) Convention on Combating Bribery of Foreign Public Officials in International Business Transactions.³

For life sciences companies, the difficulty posed by these laws is that healthcare professionals (HCPs) or health fund administrators in many countries are often employees of the government or work at public institutions, which may cause them to be considered “public officials” under many bribery statutes. Given the frequency of interaction between life sciences sales and marketing representatives and those HCPs, companies are under increasing pressure to ensure that those interactions are structured to avoid the appearance of attempts to improperly influence HCPs.
The proliferation of contract suppliers and distributors is exposing companies to new risks in this realm as well. Under the FCPA and most OECD-related legislation, companies may be liable for potentially corrupt payments or other benefits provided to government officials by those third parties.

Risk #3: Aggregate spend

To increase transparency between life sciences companies and healthcare professionals, regulatory agencies increasingly are monitoring payments made by companies to healthcare officials or institutions for a range of ancillary services. So-called “aggregate spend” transactions can cover anything from speaking engagements to consulting on unmet medical needs to conducting clinical trials.

The question that typically arises in such transactions is whether the payment reflects the true value of the services performed, or whether the payments are artificially inflated in an attempt to curry favor with the physician or institution and unduly influence medical decisions. Medtech companies, in particular, are increasingly under the spotlight because, by necessity, they maintain very close product development relationships with surgeons, who are often paid consultants.

A small number of states and the District of Columbia have current statutory requirements regarding financial transactions between industry and healthcare officials or institutions, and each jurisdiction requires varying degrees of detail around what needs to be reported. In an effort to make such regulations uniform, Congressional leaders are considering a new federal law as part of healthcare reform efforts that would preempt state-based statutes in requiring life sciences companies to disclose gifts, payments, travel expenses and other financial donations to healthcare professionals.

Risk #4: Supply chain integrity

With scores of branded drugs set to lose patent protection over the next few years, and fewer candidates in the R&D pipeline to replace them, companies are increasingly looking to both reduce costs and reach new customers in emerging markets. As part of this shift in strategic focus, pharmaceutical organizations are increasingly relying on relationships with third-party business partners across the supply chain. These business collaborations now touch many areas that are critical to the company’s success, including R&D, manufacturing, distribution and marketing.

As companies continue to expand their “extraprise” of business partners to operate more efficiently and win new customers, they’re learning a valuable lesson: you can outsource processes, but you can’t outsource risk. In today’s corporate governance and regulatory environment, companies are being asked to prove the adequacy of their controls, particularly when it comes to ensuring the safety of their products. FDA scrutiny has increased in recent years, both during the approval process and after the product launch. The passage of the Food and Drug Administration Amendments Act in 2007 left companies to comply with a new post-marketing surveillance framework. While adhering to this framework is a difficult task for company-owned operations, it is made even more challenging by the emergence of remote third-party suppliers.

Pharmaceutical companies with overseas manufacturing operations must adhere to the FDA’s and local regulators’ good manufacturing practices (GMPs), which provide guidelines on issues such as plant cleanliness, how materials are handled, and how complaints are managed. Partner companies must be certified before they open a plant, but ongoing compliance is another issue. Safety lapses that do occur, unfortunately, always bring far more attention to the well-known pharmaceutical company who procured the defective product or service, rather than an unknown supplier of the defective product or service, as last year’s health scare involving a Chinese supplier of the blood thinner, heparin, demonstrates.

Risk #5: IFRS adoption

More than 100 countries now require or permit the use of International Financial Reporting Standards (IFRS) in the preparation of financial statements, and some economic powerhouses are set to join the fray.⁴ Canada, India and Korea, for instance, will adopt IFRS by 2011. Recognizing the growing popularity and acceptance of IFRS around the world, the Securities and Exchange Commission (SEC) has wisely opened the doors to greater use of these international standards in the US.

While the agency is still exploring whether US issuers should have the option to file their financial statements in accordance with IFRS, the increasing use of such standards in other countries has prompted life sciences companies to acquaint themselves with the differences between IFRS and US Generally Accepted Accounting Principles (GAAP). At present, five of the world’s top 10 leading pharmaceutical companies by revenue are foreign private issuers who use IFRS. While the other five are US domiciled, their reach is global, with many of their subsidiaries already preparing their financial statements using IFRS for statutory purposes.

While IFRS adoption does not typically come to mind when considering compliance challenges, reconciling IFRS to US GAAP is complex and the adoption of IFRS in the US would have wide-ranging ramifications for life sciences companies. In a 2006 global survey Ernst & Young conducted of publicly available IFRS to US GAAP reconciliations filed with the SEC, the respondents identified 71 unique differences. It is important for life science companies to understand these potential differences due to the nature and the number of cross-border transactions, such as R&D arrangements, contract manufacturing arrangements and joint ventures.

***

As the focus areas above clearly illustrate, the risk environment in the life sciences arena is constantly changing. Cost pressures are driving companies into new strategic alliances, either at home or abroad, and expanding the risk environment to a network of third-party suppliers. Headline-grabbing lapses have brought new attention and regulatory scrutiny to the industry, particularly to the relationships companies are forging and strengthening with healthcare professionals. And pending healthcare reform measures may completely upset the apple cart, forcing companies to adopt new business models or pursue new avenues for growth.

The good news is that few industries are as well-positioned to identify and manage these emerging risks. Life sciences companies are regulated like few others, and they have been for some time. Drug and device companies’ business models are predicated on risk-taking; if they didn’t take risks, they wouldn’t be able to bring products to market. As such, they have been on the leading edge of change when it comes to risk-management practices and procedures.

As the economic recovery begins to take shape, now is an opportune time for life sciences companies to cast a critical eye on their ability to identify and mitigate emerging threats. Protocols that helped identify risks in the past may not be up to the task now. Certain risks may be managed by five different people or groups, while other important risks aren’t being managed at all. At a time when companies are reducing staff and cutting costs, keeping up with the evolving risk environment can be especially challenging.

Meeting these demands will call for creativity, discipline and focus. Companies will need comprehensive, proactive approaches to identify, measure, report and manage risk in its broadest sense. Companies that fail to adapt to the changing risk environment are sure to pay the price, whether it be in the form of penalties, legal judgments or reputational harm. But for those that effectively navigate these risks, the rewards will be well worth the trouble.

The views expressed herein are those of the author and do not necessarily reflect the views of Ernst & Young LLP.

**********

About the Authors

Scott Bruns will be an audit partner with thirteen years of experience at the firm serving global public and private clients in various industries, including pharmaceutical, biotechnology, automotive and construction.  His background includes experiences serving as the senior audit coordinator for companies with international operations and for companies reporting on internal controls over financial reporting.

He has also served as the Global Pharmaceutical Sector Resident in New York working with pharmaceutical and biotechnology client service teams on current industry issues.  In this role he also prepared various thought leadership pieces, developed training courses for EY and has spoken at various industry events.

Kathleen Meriwether is a principal with the Health Sciences team of Ernst & Young’s Fraud Investigation & Dispute Services practice.  Kathleen specializes in assisting health sciences companies with global risk and compliance assessments and regulatory compliance analyses.

Kathleen works closely with management teams and counsel to identify enforcement risks, determine potential vulnerabilities and recommend solutions from business and operational perspectives.  Kathleen also assists counsel, both outside and in-house, in fraud investigations, compliance inquiries and in strategizing responses to governmental subpoenas and other inquiries.

Sources:
¹ – Chris Adams (1 February 2009). “Late move on drugs by Bush FDA could be dangerous”. McClatchy Newspapers. http://www.mcclatchydc.com/227/story/61113.html.
² – Francesca Lunzer Kritz, “Drug firms jockey for space online,” The Washington Post, 16 June 2009, via Dow Jones Factiva.
³ – From Ernst & Young report, “Managing bribery and corruption risk in life sciences,” p. 1
⁴ – The statistics used in the IFRS section came from collateral Ernst & Young reports assembled in preparation of last year’s Progressions article by Cynthia Orr on IFRS adoption (p. 28).

Tags: compliance risks, Ernst & Young, fcpa, FDA, foreign corrupt practices act, health care, healthcare, IFRS, kathleen meriwether, life sciences, life sciences compliance, life sciences industry, off-label promotion, Pharma Compliance, scott bruns