Development

1
Development Deployment of a Risk Based
Compliance Turnaround Strategy John R. Pinion
IIGenentech, Inc.
The FDA Regulatory and Compliance
Symposium August 24 26, 2005
2
Agenda

1. Objectives
2. Keys to Success
3. Risk Triggers
4. Getting Started / Expectations
5. Business Assessment
6. Risk Assessment
7. Risk Control / Mitigation
8. Communication and Timing
9. Execution
10. Measurement / Effectiveness Review
11. Questions

3
Objectives

• Reduce Overall Patient Risk
• Reduce Compliance Risk
• Improve Overall Business Performance
• Focus Resources
• Improve Customer Satisfaction
• Improve Operating Mechanisms Management
  Visibility
• Reset Performance Expectations

4
Keys to Success

1. Senior Management Recognition/Understanding of
   Issues
2. Comprehensive Evaluation / Assessment of Business
3. Effective Analysis of the Results of the Business
   Evaluation (risk / gaps)
4. Review of Organization and Talent
5. Development of a Risk Analysis / Risk Management
6. Creation of a Progress Measurement Approach
7. Senior Management Acceptance of Approach
8. Broad Communication of Need for Change and Action
   Plan
9. Adequate Resources to Execute Strategy
10. Implementation of Routine Senior Management
    Review Process
11. Effectiveness Review of Mitigation Actions

5
Risk Triggers

• Change in CEO Other Senior Management Changes
• Restructuring / Mergers
• Products
• New Area
• New Molecular Entity
• RIF
• Process Support Staff
• Regulatory Agency Quality Indicators
• FCAs
• Complaint Trends or Product Field Performance
• Lack of Procedure Maintenance to Current cGMP's

6
Getting Started / Expectations

• Define
• Inputs to Be Included in the Business Assessment
• Risk Analysis / Management Model (ISO 14971)
• Cross Functional Risk Management Team
• Outputs of Process
• Develop and Deploy Measurement System
• Identify
• Risks
• Mitigation Actions
• Verify Effectiveness of Mitigations
• Establish / Initiate Communication with
  Appropriate Agencies

7
Getting Started / Expectations
Inputs
Outputs

• Product Decisions
• Process Improvement Review
• Quality System Performance
• Business Process Performance
• Facility / Capital Decisions
• Organization / Talent Review Results / Decisions
• Legacy Issue CA/PA
• Operating Mechanism Decisions
• Progress (Score Card) Measurement
• Results of Effectiveness Review

• Product Performance
• FCAs
• CAPAs
• Complaints
• Process Performance
• Quality Systems
• 8 Key Systems
• Business Processes
• Facility Design / Performance
• Infrastructure
• Talent / Organization
• Culture
• Resources
• Personnel
• Capital

Risk Analysis Process
8
Getting Started/ ExpectationsOverview Risk
ManagementProcess
Development Deployment of a Risk Based
Compliance Turnaround Strategy
9
Getting Started / ExpectationsResource Commitment
10
Business AssessmentElements to Consider

• Compliance History / Regulatory Commitments
• License Status
• Product Performance
• Facility Condition / Performance (Manufacturing)
• Business Infrastructure
• Quality Systems
• Capital / Resource Commitment
• Leadership / Management Responsibility
• Organization Structure
• Talent
• Internal Improvement Processes
• Documentation Status

11
Risk AssessmentRisk Assessment Matrix (example)
Product, Process, System, etc. Gap Identified Impact of Gap Impact On Severity of Impact Probability of Occurrence Overall Risk Mitigation or Decision Mitigation Verification Overall Risk Post Mitigation



Define Rating / Scoring Criteria to Help
Prioritize Mitigation Actions
12
Risk Control / MitigationsDecisions / Actions to
be Considered

• System Redesign
• Management Changes
• Organization Changes
• FCAs
• Process Improvements
• Facility Capital Improvements
• Retirement of Product
• Facility Closure / Simplification

• Validation
• Improved Documentation
• Improved Operating Mechanisms
• Employee Education
• CAPA
• Labeling Enhancements
• Product Improvements
• Regulatory Submission Updates

13
Communication / Timing
Audience Frequency Objective
Senior Management Monthly Review / Discuss Overall Level of Risk, Key Decisions
Risk Management Team Weekly Process / Progress / Issue Review
Quality Organization Weekly Process / Progress / Issue Review
Broad Organization Monthly Awareness
Regulatory Agencies Establish in Conjunction With Agency Update on Progress, Gain Feedback
Customers / Patients As Necessary Based on Decisions Ensure Patient Safety
Business Stakeholders As Necessary (Material Decisions) Meet Fiscal Requirements
14
Communication / Timing
Development Deployment of a Risk Based
Compliance Turnaround Strategy
Conduct / Complete Initial Business Assessment
Define Inputs to Be Included As a Part of the
Business Assessment
Develop Measurement System
Complete Risk Analysis
Implement Actions
Verify Effectiveness
Reassessment
Prioritize Mitigation Actions
730
Start
30
90
180
(Dependant of Gaps and Mitigations Needed)
Communication
Time (days - example)
15
ExecutionKey Considerations

• Well Developed Plan
• Communication / Alignment of Organization
• Objective / Fact Based Measurement
• Employee Training Development
• Prioritization
• Visible Management Commitment
• Dedicated Resources
• Third Party Review of Approach / Progress
• Forecast of Activity
• Commitment to Make the Difficult Decisions
• Verification of Effectiveness

16
Measurement
Measurement Approach Objective
Risk Reduction Tracking Risk Analysis Document Verify Reduction of Risk
Mitigation Action Progress Tracking Score Card Ensure Timely Implementation of Mitigation Actions
Product / Process Trend Data Management Review Confirm Effectiveness of Mitigation Actions
Internal Assessment Trends Management Review Confirm Effectiveness of Mitigation Actions
Third Party Assessment Results AD Hoc Review Confirm Effectiveness of Mitigation Actions
17
MeasurementMitigation Action Score Card
Mitigation Person Responsible Initial Status Current Status Verification of Effectiveness Forecast
Mitigation 1 Action 1 Action 2 Action 3
Mitigation 1 Action 1 Action 2 Action 3
Mitigation 1 Action 1 Action 2 Action 3
Mitigation 2 Action 1 Action 2 Action 3
Mitigation 2 Action 1 Action 2 Action 3
Mitigation 2 Action 1 Action 2 Action 3

18
Strategy

• Business Assessment
• Risk Analysis
• Mitigation Plan
• Effectiveness Review

Deployment
Adjustment

• Business Decisions
• Measurement Feedback
• 3rd Party Feedback
• Prioritization
• Compliance Events

• Risk Management Team
• Dedicated Resources
• Communication
• Execution and Review

Measurement

• Risk Reduction Tracking
• Mitigation Score Card
• Management Review (Trend Data)
• Assessment Trends
• Third Party Assessment Review

19
Questions??