Managing the risks in outsourcing

OUTSOURCING Outlook

Lacking the expertise to conduct proper diligence can be a point of vulnerability for clients

Managing risk is a fundamental element of biopharmaceutical management. Exposure to financial loss from clinical and market failure, product liability, regulatory noncompliance, and theft of intellectual property is inherent to the industry, along with common business risks such as fire, computer crashes, and injuries to employees.

Outsourcing adds some complicating aspects to the risk-management equation, but does not fundamentally alter it. Outsourcing heightens awareness of risk in much the same way it spotlights the real costs of drug development. Research and development managers who may have given little thought to the risk and implications of events such as fire, blown batches, or computer crashes for activities conducted inhouse become acutely aware of such issues when they place a project with a contractor.

This awareness, in part, reflects the fact that the outsourcing business relationship exposes one party to the loss-causing actions of the other parties. If a patient dies during a clinical trial as a result of the drug's toxicity, not only is the sponsor likely to be involved in litigation, but also the contract research organization (CRO) managing the trial, the preclinical CRO, and the contract manufacturer - no matter where the initial fault may lie. Despite contractual provisions to protect the parties from each other's negligence, all will pay in the form of delayed development, staff time, legal fees, and damaged reputations. Further, if the problem arose because of the CRO's actions, the sponsor might sue that CRO to recover its losses from a delayed or aborted filing.

Protection

"There are two things that the client is thinking about when contracting with a CRO," said Lynn Rosanno, a former insurance executive who developed some of the first coverage programs for CROs. "One is: Are these people going to make some sort of mistake that leads to this product causing an injury to somebody? The second is: Are they going to make a mistake that I'm not going to pick up on, and, as a result, we won't get FDA approval?"

The first line of defense for all parties in these situations is continuous diligence, just as it is for in-house operations. For the sponsor, this means assessing the CRO's or contract manufacturer's competence and compliance before proceeding to contract, as well as maintaining regular oversight through audits, clinical monitoring, and "man-in-the-plant" arrangements. Contractors must take steps such as reviewing preclinical studies and analytical methods packages to ensure that the product has been well tested and properly handled.

Lacking the expertise to conduct proper diligence can be a point of vulnerability for clients, especially young companies. Sponsors rely on their clinical research and product development staff to manage outside vendors and know what to look for. Is the CRO handling the data properly? In many cases, clients may not have the experience to judge.

Strict compliance with FDA and HHS regulations, including good manufacturing practices, good clinical practices, informed consent, and product labeling, is another line of defense because those regulations are intended to protect research subjects and patients. Such compliance is necessary, but may not be sufficient, risk-management experts warn. A company that uses the defense, "I did everything FDA wanted me to," may not have been doing enough.

Indemnification provisions. In contracts, all parties will insist on protection through indemnification provisions, which specify the risks each party will protect the other from in the event of litigation. CROs want tc ensure that "hold-harmless" or indemnification provisions reach back to the sponsor to ensure that it has protection in place, for instance, in the event that the product isn't safe. Indemnification can become a sticking point in contract negotiations if each party tries to foist risk exposure onto each other. David Shuey, president and chief operating officer of Willis Group (www.willis.com), an insurance brokerage, says that both parties should try to achieve a "mutual hold-- harmless" agreement by which they agree to protect each from the other's negligence.

Nevertheless, warns Philip Fiscus, vice president of insurance underwriter Chubb and Son (www.chubb.com), there are limits to what can be done contractually. "Any entity can try to transfer certain contractual responsibilities, but they can't transfer their own negligence, and that's what many of these companies forget or don't realize. Even though they may contractually attempt to do some traffic control concerning risk, in the event they do something negligent, that would fall outside of that contract and they would still be responsible."

Insurance. The last source of protection is insurance. All parties will carry product liability insurance, and sponsors generally require their contractors to carry professional liability coverage, also known as errors and omissions insurance. The latter coverage deals with a contractor's exposure in the event that it makes mistakes that cause its client financial damage (such as FDA turning down a new drug application [NDA] because the contractor failed to comply with GCPs).

Unforeseen Risk

Another problem area in outsourcing relationships is that risks may be allowed to fall through the cracks between sponsors and contractors. That is, activities and functions that create loss exposure may be overlooked in contracts to the extent that when a loss does occur, neither party will take responsibility for it. Examples include product loss during shipping on a commercial carrier between the manufacturer and sponsor or clinic (generally not covered by conventional property insurance), blown batches, or intellectual property agreements that don't cover all involved at a clinical site.

Risk assessment. "The critical step is to identify the risk," said Shuey, who has conducted risk assessments for a number of CROs and biopharmaceutical companies. "You need to 'free associate,' and ask the right questions: If the key vendor had a fire, what would we do? What measures does the contractor have in place in case a hurricane, disrupts all public utilities?"

Contracts are where a lot of risk-- management concerns get sorted out. Rosanno advises sponsors and CROs to "make sure that the contract is clear about which liabilities are whose under what circumstances, because the contract could get contested in court." In addition, CRO executives must review contracts to ensure that the terms clients are asking for are terms they can deliver.

The Risk Management Gap

A major risk management difficulty in contract drug development is that most parties involved in relationships lack the expertise to evaluate each other's exposure and to set up adequate provisions for managing it. Although the largest pharmaceutical companies have sophisticated risk-management operations, most sponsors and contractors are not large enough to have in-house expertise and may not appreciate the issues.

Most companies with revenues under $100 million put risk management under a financial, human resources, or administrative executive, but these people largely confine their efforts to buying insurance. According to Rosanno, risk managers must be proactive about identifying business activities and contract provisions that may leave the company exposed to risk. "Risk managers have to be 'control freaks'; the onus is on them to put into place the appropriate procedures and be diligent about them. Nobody is going to contact them to do it." The danger, she notes, is that in their desire to make the sale, "The CRO is going to agree to either do things or hold on to certain kinds of liability that do not necessarily belong in their pocket."

Loss prevention. Of course, because it kicks in only after the damage has occurred, insurance should not be the only focus of any company's risk-management efforts. Insurance is a funding mechanism to pay for losses. CROs and sponsors want to prevent those losses. Loss prevention and loss control are key issues in risk management. Table 1 highlights types of risks a biopharmaceutical or contract service provider may be exposed to.

Regardless of how loss exposure is distributed, it is ultimately in the sponsor's best interest to make sure that the possibility of loss is minimized. You can transfer risk, but the ultimate responsibility is with the party that owns the product. At the end of the day, it's not the vendor's name that is on the biological license application or product marketing application - it's the sponsor's name.

[Author Affiliation]

Contributing editor Jim Miller is publisher of Bio/Pharmaceutical Outsourcing Report, (B/POR). PO Box 8163, Springfield, VA 22151-8153, 703.322.4971, fax 703.503.4506, info@pharmsource.com, www.pharmsource.com.