Risk management processes play a key role in building the resilience a business needs to operate smoothly during disruption. This is particularly the case in pharmaceutical and MedTech businesses, in which supply chains are often complex and services are multi-layered.

Disruption can come in many forms, including challenges caused by the rapid growth to regulatory changes and rare but destabilising events such as the Covid-19 pandemic. A vigorous business continuity plan (BCP) enables businesses to weather these storms. They have also become a requirement in many commercial tendering processes, which puts companies that do not have one at a competitive disadvantage.

Here we explore how to successfully identify risks and prepare to mitigate them with a robust BCP.

Developing a business continuity plan

Although different parts of an organisation may understand the risks specific to their function, a holistic view of risk across a business is often lacking. Robust organisation-level BCPs will ensure there are structures in place to keep core services running in times of uncertainty and constraint.

The pharmaceutical sector is diverse and each BCP needs to be tailored to each organisation’s specific situation, but there are three overarching steps we would recommend you take when devising one:

1. Carry out an enterprise-wide risk assessment process to identify, assess and prioritise key risks – to make the most of this exercise, you will want to engage with a broad group of stakeholders, from board level to teams on the ground, ensuring you cover a range of perspectives. This will involve interviews and workshops designed to identify and prioritise risks, pinpoint what risk management initiatives are already in place and establish who, if anyone, is responsible for managing each scenario. This process is likely to reveal risks that may not have been considered previously, which makes this part of the process so crucial.
2. Examine if and how the risks that have been identified could impact the business and which functions need to be incorporated into business continuity planning – to understand the key priorities, we use our risk assessment matrix, which you can see below. This matrix helps create a risk register by plotting the likelihood of an event occurring against the extent of its impact on revenue and reputation.
3. Develop a contingency plan that responds to the information that has been gathered – it will set out the BCP structure and the core roles and responsibilities within it. This plan will also establish recovery strategies that will minimise the impact of any disruption and detail how they should be implemented.

This thorough three-step process will lead to a comprehensive plan that strengthens a business’s ability to respond effectively to change and disruption, as well as embrace the opportunities that often come with it.

A living document

When the facts change, plans need to change with them. The development of a BCP described above is not a one-off event, it is the start of an ongoing process.

From the beginning it should be established that roles and responsibilities outlined are continuous, and the risks posed to the organisation will be kept under regular review. In this way the BCP document can be amended and refined to reflect evolving circumstances.

Those responsible for certain risks can then playback renewed strategies with the business continuity management team, to meticulously test their logic and probable effectiveness.

Our planning in action

Akeso & Co put these principles into play when we developed a business continuity plan for a leading mid-sized pharma company with a range of licensed therapeutics.

As a growing business with a complex supply chain, the disruptions of the Covid-19 pandemic highlighted the need to review and update its continuity plans, including assessing the vital third parties it works with.

A new plan then had to be developed that ensures the organisation and its network of manufacturing and distribution partners is able to respond quickly to disruption in the future. Together with the Chief Operating Officer and a senior team, we followed our three-step approach to do this.

Alongside common risks such as IT failure and disaster, we identified specific issues unique to their business model. For example, certain raw materials where supply could become constrained, and weaknesses in distribution channels such as the Suez Canal. We also located potential single points of failure, where one employee had sole responsibility for a business-critical relationship.

The BCP we developed has provided the business with a flexible framework that will enable the senior leadership team to overcome disruptions to critical business functions. They also now have visibility of the key risks facing the business, supported by effective controls and a process to monitor and manage changes to their risk profile.

Building this kind of agility into a pharma or MedTech organisation enables it to adapt to change and provide a continuous service to its clients. To discuss how Akeso & Co can strengthen your business’s ability to thrive during uncertainty, get in touch.