Stress testing for the perfect compliance storm

Pharmaceutical companies are among the most heavily regulated in the world. Yet the industry often hits the headlines for all the wrong reasons, with regulators imposing multibillion dollar settlements for compliance failings including corruption and bribery.

From France to South Korea, governments and regulators around the globe have been imposing new legislation and strengthening their compliance regimes. However, EY’s Global Fraud Survey 2016 shows 11% of company executives across all industries still believe that it is common practice to use bribery to win contracts.

This figure increases to 15% in the life science sector, which is the highest across all 13 sectors surveyed. In addition, 38% of respondents in this sector could justify unethical behaviour to meet financial targets.

Addressing these issues is difficult and complex, but stress testing compliance programmes is quickly emerging as a key response to regulators’ shift to a more forensic, data-led approach.

Industry finds itself in a ‘perfect storm’ 
Pharmaceutical companies have invested heavily in sophisticated compliance systems, and many are now ahead of the curve compared to firms in other regulated industries. The sector also benefits from established self-regulation and vocal CEO-level support for ethics and compliance at individual firms. However, the economic and industry-specific factors that we describe below create a unique set of risks that make it easier to hide corrupt practices in the pharmaceutical and life science industry.

The business model of pharmaceutical and life science companies is inherently complicated - and faces a much higher ‘in-built-in’ degree of bribery and corruption risk relative to other sectors. As a result, the compliance risks around steps taken to manage the revenue impact of patent protection cliffs, or travel and hospitality legitimately offered to healthcare professionals, must be identified early and continually reviewed over the product lifecycle.

Additionally, the changing nature of relationships between pharmaceutical and life science firms and healthcare practitioners (HCPs) and healthcare organisations (HCOs) is posing fresh challenges for the sector.

In today’s challenging economic climate, many countries are struggling to manage the spiralling cost of health and social care with reduced income tax revenues, rising deficits and increasing public debt. As a result, many governments have been forced to make cuts to health programmes and related expenditures, for example, reducing or entirely removing coverage for specific medicines and conditions.

Some markets have introduced charges for access to state healthcare premises or compulsory licensing, and some HCOs are now seeking direct support either as financial donations or as medical education, patient assistance or research. Compliance programmes must be flexible enough to take these changes into account.

Pharmaceutical companies typically operate in multiple jurisdictions, and because of this there can be heavy reliance on third parties and cross-border transactions, where language and cultural differences can often be capitalised on by fraudsters.

The challenge is to make intelligent links between the right information sources at the right time

And there are a number of specific challenges posed by the changing scope of regulation in different jurisdictions. For example, in Europe, increased transparency requirements are making perceived and actual conflicts of interest more visible - placing a great emphasis on scrutinising value transfers and identifying trends and outliers early.

Stress testing in compliance is essential
Working with business areas to stress test compliance procedures is central to addressing the wider perception that corruption is relatively high, and proving to their regulators that these procedures work in practice.

Stress testing helps identify the extent to which a culture of compliance has been successfully embedded in the organisation. Typically, these can be broken down into four categories:

1. Unconscious incompetence. Although very unusual for pharmaceuticals and life science companies, organisations at this stage are unaware of relevant risks and take no steps to identify them.
2. Conscious incompetence. Most often seen at early stages of product development, at this stage there is an awareness of the risks, and some effort to address these through prevention, detection and remedial action.
3. Conscious competence. At this stage key areas of risk are known and addressed, and supported by ongoing compliance operating mechanisms. Pharmaceutical and life science companies most often fall within this bracket, where the key challenge is to ensure consistency in approach across global markets.
4. Unconscious competence. In addition to clear and comprehensive policy framework, organisations at this stage are characterised by commercial decision-makers that actively champion compliance across the business.

Interestingly, pharmaceutical and life science companies are increasingly employing the same forensic and analytics tools used by the regulators to perform these stress tests, and to integrate real-time behavioural analysis to identify and address red flags faster than ever before. In fact, a number of regulators have already indicated that they consider real-time monitoring to be a key measure of evidencing due diligence.

Embedding technology into a programme
An unexpected benefit of embedding technology into compliance programmes is that of driving greater collaboration between legal, compliance, IT, finance, audit and operational business units, as they all ‘own’ data sources or policies relevant to mitigating corruption risks. This is crucial to translating the ‘tone from the top’ of the organisation into action at the front line, and we expect to see this trend continue.

Some commentators are already predicting a future where compliance monitoring will largely be conducted using robotics. However, making this work in practice is a real challenge; few sectors compare to the pharmaceutical and life science industry in terms of the sheer volume, velocity and variety of business data.

From vendor payments, speaker programme documentation, travel and entertainment for healthcare professionals to social media, the challenge for pharmaceutical and life science companies is to make intelligent links between the right information sources at the right time.

Sailing out of the storm 
Real-time monitoring has the potential to allow these shocks to the system to be picked up early - but only if they are applied by compliance professionals that are able to dig behind the data to find the root causes or any wrongdoing. The key to keeping the pharmaceutical and life science industries in the headlines for all the right reasons lies in intelligent machine-led analysis overlaid with human judgement. It is time to step up the compliance and ethical values, and make the compliance programme a true business enabler.

The views reflected in this article are the views of the author and do not necessarily reflect the views of the global EY organisation or its member firms.