Prescribed Behavior: Operating Under a Consent Decree

When regulatory officials impose a Consent Decree, biopharmaceutical companies often experience a litany of side effects along with it: tarnished reputations, lost sales, massive fines and remediation expenses, hostile working environments, diminished morale, legal disputes, employee retention problems and product shortages, to name several. No stakeholder or aspect of the business is left untouched. It takes a broad-based effort to effectively address the concerns of regulatory agencies while simultaneously managing a company's current and future business. This effort goes beyond simply developing and executing a remediation plan; executives are tasked with balancing a need to survive the remediation period with an equally important mandate to set the company on a trajectory for future success.

Overview of a Consent Decree Environment

A Consent Decree (CD) is a three to five year court-approved legal agreement between a company and a US regulatory agency, enforced by the US Department of Justice. By agreeing to the terms of a CD – which is often a result of one or more inspections or investigations by the regulatory agency – a company may be allowed to continue manufacturing and selling products, but with strings attached. Commercial activity is highly scrutinized, with significant limitations on how and when a product may be sold to customers. In some cases, production is halted entirely at the impacted sites until the remediation efforts are concluded.

CDs don't usually fall out of a clear blue sky. They're typically preceded first by signals like recalls and Warning Letters, and then by a major agency enforcement action like a product seizure or injunction. The volume of FDA's initial signals is trending up across the industry, suggesting serious and widespread compliance breakdowns. As a result, major enforcement actions leading to CDs are on the rise. A related increase in monetary fines imposed through civil and criminal penalties also suggests a more active and intense regulatory agenda at FDA.

On top of enforcement actions and financial penalties, CDs could lead to other adverse events. The recent manufacturing suspension of an oncology product made it difficult for patients to access adequate supplies of a life-saving drug. Even when the situation is less dire for patients, but popular products still fail to reach the consumer, brand loyalty is negatively impacted. Inside company walls, a CD could shake an organization's cultural foundation for years to come. A hostile environment can impact employee morale and push talent out the door. When a CD is imposed, dozens of contractors and/or new employees may join the organization. Roles and responsibilities rapidly change.

A prophylactic compliance structure to prevent the onset of a major regulatory action is a strong strategy. But when something does happen, it's equally important to minimize as much as possible the impact to the business. Many companies are reassessing their compliance practices, embracing Quality by Design, improving quality controls, adopting forward-looking compliance metrics and emphasizing a culture that respects and builds quality into everyday business operations. Addressing these areas proactively versus dealing with them after a regulatory action occurs is an important way to prevent the negative financial, cultural and social impacts of a CD. However, being able to continue operations when a major regulatory incident has occurred is equally as important.

Effectively Managing a Business through a Consent Decree

Whether currently under Consent Decree or on a path toward one, our client engagements have given us an opportunity to see how a wide variety of diverse manufacturers and executive management teams respond to this very difficult environment. Companies commonly use a point solution or functional response approach to addressing the situation. While regulatory and QA experts and leaders are a critical part of the response team, the magnitude of the problem requires a holistic response that coordinates the remediation effort with the ongoing business operations. Senior executives should be involved in the day-to-day decision-making and planning required to address a remediation order while maintaining viable, compliant business operations. While quality and regulatory executives are making time-sensitive, compliance-driven decisions, those decisions should concurrently be sustainable and viable for the business over the long term. Sustainability is a more likely outcome when there is an executive team that represents all aspects of the business dedicated to the remediation efforts, including the allocation of resources between remediation activities and the core business operations, and the development of a compliant and sustainable operating model.

To create a sustainable model, compliant behavior and actions should be the easy thing to do; complex and cumbersome processes have a high probability of failure. Instead of throwing resources at compliance problems, executives should identify and address root causes, and develop meaningful training and education for employees. Fostering a healthy tension between different stakeholders, business functions and perspectives—enabled by a formalized communication process—can bring about mutually acceptable, long-term outcomes. Employees should be able to raise their hands about potential compliance issues without fear of retribution.

You are in the Consent Decree business now

In the normal course of business, a company should recognize warning signs prior to being subject to a CD. Increasingly, some companies are leveraging and enhancing current risk management processes and procedures to monitor activities that are indicative of underlying quality or compliance problems, and raising them to senior management's attention. For example, complaints from employees or human resource activities regarding disagreements with superiors can have their origin in ethical issues associated with manufacturing processes and procedures. By turning a blind eye to the problem, a company makes itself vulnerable to metastasizing compliance and quality issues that could end with a major enforcement action. Identifying an issue is the first step toward corrective action, and should be followed by an assessment of potential safety impacts and an evaluation of different options. The impact of a CD is significant, and companies should keep in mind the collateral damage to the business.

When a company enters into a CD, its business environment is dramatically changed, virtually overnight. A common reaction by senior executives is to try to manage the CD as a 'project' and keep the rest of the business operating as near to normal as possible. But business as usual isn't likely to work. Remediation efforts under a CD typically last three to five years, even if the "planned" remediation period is shorter. At the beginning of a CD period, it may be tempting to take advantage of opportunities to manufacture product whenever they arise. But leadership should embrace the fact that without meeting a CD's requirements, there may not be a business to run. Manufacturing in a relatively normal fashion may be possible, but selling products is an entirely different matter. The decision to manufacture product at risk is a business decision that involves business unit leaders, manufacturing personnel and QA/RA. Once the risk management aspects of production have been agreed upon, these decisions need to be communicated to employees and contractors in all departments of the company. Management should be clear about the manufacturing go-forward plan and how product disposition will be handled.

A new, compliant tomorrow

An enforcement action often signifies the need for real change in a company's culture and behaviors. Creating a culture that respects and demands compliance from all functions within the business is crucial to long-term survival. Successfully doing this may require:

» Establishing unquestionable direction and support for quality and compliance from the CEO level through written communications, sufficient resourcing, and decision-making from product development through distribution.

» Placing compliance officers and QA executives in senior positions in the company with direct access and reporting authority to the chief executive officer and the audit committee.

» Clearly defining what compliance means for every role in every function in the organization and communicating new expectations to employees.

» Holding the entire organization accountable for compliance and quality and reinforcing the desired, compliant behaviors through appropriate incentives.

» Changing the focus of operations from a product release mindset to a high quality, compliant product release mindset.

» Ensuring that employees at all levels understand the value of compliance and embrace this is as a core attribute of their culture and behavior.

» Evaluating the impact to compliance and quality when making business and operational decisions.

As we've noted, a comprehensive approach is needed to manage all aspects of the base business along with the remediation effort. At the core of this is a strong focus on governance that is measureable and accountable for results. The governance structure for the CD effort should bring together the right leaders with an appropriately defined scope of responsibilities. This focus and clarity, along with goals aligned with leadership at all levels of the organization, both at the facility under CD and the organization as a whole, can be crucial for success. Wedding remediation efforts with the base business to effectively steer a company toward calmer waters requires careful coordination; compliance efforts are only as strong as the weakest link in the chain of necessary components: planning; organization and people; communication; risk and sustainability. The integration process and interdependencies between components is often an area where companies fail to place enough emphasis.

Planning: Prepare for the long haul

When it comes to managing a company through a CD, a failure to plan is a plan to fail. The "new reality" of a CD requires planning and processes geared toward recognizing this inconvenient truth. Operating a manufacturing plant "full out" to meet production targets, for example, without an equally intensive focus on quality, can make matters worse. Production plans and targets —and the resulting sales and financial forecasts—should be adjusted to reflect this new environment.

Planning should extend to future quarters and years, not just the coming weeks and months. Extended horizons can lead to better resource planning and capital budget pre-allocations; it doesn't pay to pick up the pieces only after they fall. Anticipate unexpected expenses and build in allowances for the inevitable "gotcha" moments. Unfortunately, production planning and release rates are often the first casualties of the new operating environment. Long-term lower output and longer release cycles can be a difficult pill for executives to swallow, but other employees and stakeholders won't stomach unrealistic expectations.

Existing quality system processes and procedures, such as corrective and preventive actions (CAPA) or document review, often aren't equipped to deal with the volume and stress of a CD. An increase in traffic can lead to gridlock. Also, breakdowns in legacy quality systems may have played a role in the onset of an enforcement action. It's important to assess and modify these processes to accommodate the increased workload and more stringent requirements.

Organization & People: Focus on culture and resource management

The origin of corporate culture is leadership. Under a CD, appointed leaders should demonstrate an ability to drive change throughout the organization. But rather than assigning top talent to base business operations, consider deploying leaders on the more complicated and critical portions of CD commitment. An individual's penchant for problem-solving should be prioritized over a history of compliance or quality assessment experience to succeed in a complex, high-pressure and regulatory-constrained environment.

Once the best talent has been placed, and metrics have been assigned to assess and confirm these roles over time, it's just as important to clearly define responsibilities, interactions and hand-offs with existing governing bodies across the organization. In addition to structural changes—committees and managers who oversee the CD remediation effort should report directly into the C-suite—companies should focus on the importance of knowledge transfer. The volume of external contractors and the constant ebb and flow of project team resources require robust mechanisms for sharing information, resources and insight. Without a combination of clearly defined responsibilities and efficient knowledge transfer, resources are lost in the revolving wheel of project teams and contractors.

CD commitments can dominate many areas of the organization and dramatically impact the culture. Leadership should proactively monitor cultural changes stemming from the execution of CD commitments, while simultaneously defining and shaping a future-state organizational culture of quality and compliance.

Communication: Under-commit and over-deliver

Dialoguing with regulatory officials and internal stakeholders about the requirements and outcome of an enforcement action can be a ticklish (and tendentious) affair, but there are good and bad ways to negotiate and then execute the terms of a settlement. Fines and other penalties related to delays can compound an already undesirable position, sending share prices down and damaging a company's credibility with the FDA. Minor delays will inevitably occur, but a well-considered strategy and communication plan can mitigate and sometimes prevent the more costly infractions associated with remediation.

One of the biggest mistakes that clients make is the submission of a plan with a compressed and aggressive timeline that is unlikely to be met. There is little to no advantage in giving regulatory authorities project timelines that are overly optimistic and that place an unnecessary strain on project teams. In their anxiety around the future and the haste to appear responsive to regulatory agencies, many senior executives task the development of commitment plans and timelines to the regulatory and quality team. While this may appear prudent on the surface, these individuals – though very knowledgeable and skilled in regulatory compliance and quality principles – may not have the operational knowledge or experience when it comes to execution. The right mix of regulatory, quality and operational experience is necessary to develop pragmatic timeframes that recognize the realities of day-to-day operations. We aren't suggesting that senior executives knowingly marginalize the importance of the CD, but many simply don't realize the magnitude of the impact to the base business and the critical need to manage both in an integrated fashion.

A communication plan for internal stakeholders is also important, since the execution of CD commitments is a long-term journey requiring the participation of all employees. Understanding the specific needs of different stakeholder audiences is key to delivering the appropriate messages—in the right place and at the right time—to keep employees informed and committed.

Risk & Sustainability: Quality and the core business

Companies sometimes overcompensate for compliance shortcomings at the beginning of a CD: a non-compliant, production-focused operation that over the years swung the pendulum further away from quality and compliance suddenly overnight swings in the direct opposite direction, focusing on quality and compliance while neglecting production. While this may be necessary to deal with short-term issues, over-restrictive procedures leaning heavily on oversight and reactive methodologies can be unsustainable over the long haul. Once these restrictive processes are in place, they can be very difficult to back away from.

To avoid a quality and compliance function that compromises core business objectives, sustainability should be built into revised standards, procedures and associated documentation. Using a post-facto "inspect quality" mindset across the board can hamper recovery; processes should reside in a system that is both compliant and viable from a business standpoint. Building sustainable processes and systems may take a little longer, but is well worth the wait over the longer term.

The importance of balancing risk and creating a sustainable model that can outlast the terms of a CD can make or break a company. Organizations that identify and then walk the middle line, which minimizes shortcomings on both the quality/compliance and business objective sides of the equation, position themselves for a successful outcome.

Down, but not out

For Life Sciences companies facing a major regulatory action such as a warning letter, or full Consent Decree, business as usual is about to change significantly. The most visible impact of a CD can be seen on a company's bottom line, and the financial costs span the entire value chain. Adding together the most common financial costs such as surrender of profits, independent oversight fees, recalled/destroyed product, facility and labor overhead due to suspended operations, and lost sales, the price of a CD can easily exceed $1B for larger companies.

In addition to direct financial impact, other areas of the business may be affected just as significantly, but in less immediate ways. The black cloud of a CD hangs heavily, and can push decision-making toward conservatism, risk avoidance, bureaucracy and micromanagement. Company morale, retention and recruitment can suffer as a result of a CD, leaching talent to competitors.

It's always challenging to manage a company during a time of extraordinary change and upheaval. But companies that create and follow a strategic plan that anticipates a day when the storm clouds lift have a better chance of getting there. In summary, and in our experience, companies are most successful when they:

» Create a "Consent Decree First" culture and environment

» Are thoughtful and deliberate, because the Consent Decree is a marathon, not a sprint; the company is in the Consent Decree business for the long haul and should be managed with that reality in mind

» Manage regulatory bodies effectively with realistic project plans that can be exceeded without major additional effort; project plans should not be reviewed and approved solely by business owners and compliance experts, but by the most senior leaders in the company ( i.e., they should not be developed in a vacuum by regulatory or quality executives)

» Select effective leadership and organizational structure and align with the "Consent Decree First" culture

» Develop planning capabilities, processes and tools tailored towards the new reality

» Evaluate the impact to the core business, including the repercussions for customers and patients, and develop a clear strategy to mitigate negative outcomes through realistic timelines and ramp-up production schedules

By addressing these needs your company can mitigate the near-term disruptions caused by a CD and eventually emerge as a stronger, more compliant and quality conscious company well positioned for long-term success. The key is to develop realistic plans and commitments, accept the situation for what it is and make the best of a very challenging environment.

Joe Slota, Director, jslota@deloitte.com, Marcos Buelvas, Senior manager, mbuelvas@deloitte.com; Sanjay Behl, Principal, sxbehl@deloitte.com; Greg Page, Specialist leader, gregpage@deloitte.com; Chris Larsen, Senior manager, chrlarsen@deloitte.com, all of Deloitte Consulting LLP.

This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services.