Pharmaceuticals and Life Sciences Frances Bruttin and Dr.

Doug Dean IBM Business Consulting Services Pharmaceutical Sector Aeschenplatz 2 CH-4002 Basel Switzerland +41-58-333-7687 (tel) +41-58-333-8117 (fax)

Managing the Cost of Compliance in Pharmaceutical Operations1

Introduction Recent studies have shown that the total cost of compliance with internal quality systems and external regulations for a typical medium to large dosage form manufacturing facility is as high as 25% of the total site operating budget (exclusive of raw material costs) [1]. For a medium-large production facility this amounts to 40 million per year. There is potential to reduce this element of cost by as much as 50%, but not by continuing with the current cause no problems attitude to manufacturing. To reduce compliance costs, it is both necessary to understand the cost components in some detail, and to appreciate why they occur. It is also necessary to balance compliance costs against the incremental reduction to business risk that they deliver. By understanding the nature of compliance-related risk, where it occurs, and how to manage it, significant improvement opportunities may be identified that systematically reduce gross risk and reduce the cost of managing residual risk. Market realities in the 21st Century require manufacturing operations to be externally supportive and to contribute directly to the competitive advantage of the pharmaceutical enterprise. A significant contribution to improvement of operational cost structures can be realised through a programme focused on reduction of operational compliance costs. This paper will explore how both quality and regulatory compliance costs can be identified and quantified. The risks eliminated by undertaking quality and compliance activities will be analysed in a similar manner. Finally, it will be shown that the risk cost trade-off can become an objective decision-making process contingent on the companys product portfolio and its preferred risk profile. The Pharmaceutical Context Manufacturing has been traditionally regarded as a Cinderella function in the R&Dbased pharmaceutical sector, and has been managed with an internally neutral cause
This article originally appeared as A Risk-Based Approach to Dramatic Cost of Compliance Reductions in Pharmaceutical Manufacturing,Pharmaceutical Technology Europe, vol. 11, no. 5, pp. 36-44.
1

April 2004

Page 1 of 9

Pharmaceuticals and Life Sciences

no problems mentality. This attitude has resulted in the growth of inefficiencies in several areas, resulting in todays unacceptably high costs of compliance. With dosage form facilities spending 20-25% of annual operating budgets to ensure that no compliance-related problems occur, this is an expensive insurance policy. With such an expensive policy premium, it could be assumed that senior management has clear visibility of the component costs and is able to state, based on objective criteria, whether the company is over or under insured. One would also assume that management should be in a position to state with confidence if incremental investment in their compliance infrastructure to reduce risk still further made economic sense. Evidence from the industry, however, indicates that this is seldom the case. Despite the significant spend on compliance the more frequently encountered situation is instead one where business people searching for operational cost reductions are informed by q.c. unit professionals that higher, not lower, levels of compliance are required with associated increases, not decreases, in costs. This often creates a sense of management dissatisfaction given the feeling that costs are high; interpretation of GMP regulations is a black art; and the level of compliance problems seems to remain constant anyhow, independent of the level of compliance-related spend. The Status Quo It is our opinion that this discussion is frequently played out because: Most pharmaceutical companies do not know what their total cost of compliance is, or what cost components contribute significantly to the total; Most pharmaceutical companies do not really understand what level of compliance they are attaining, or failing to attain, with existing infrastructures; Few pharmaceutical companies have visibility of the residual risks to which they are exposed at the given level of compliance with which they operate; Few pharmaceutical companies understand the capability of their compliance infrastructure to deliver marginal reductions in compliance risk; Few pharmaceutical companies understand the relationship between their level of compliance risk exposure and the associated costs.

The Problem As a consequence, management often has great difficulty objectively answering two critical questions: Is more investment in infrastructure warranted to reduce existing compliancerelated risk exposure? Does the level of compliance currently being delivered by the infrastructure represent good value given the cost required to achieve this level?
Page 2 of 9

April 2004

Pharmaceuticals and Life Sciences

These issues of excessive compliance costs and ineffective compliance infrastructures have been a topic of discussion in the industry for some time [2-4]. In our experience, an integrated risk management approach to these questions of quality and regulatory compliance is necessary to enable senior business management gain visibility of compliance costs, and to manage them effectively. Integrated Risk Management Risk management is fundamentally concerned with: Identifying gross risk Quantifying gross risk Deciding what to do about unacceptable risk Implementing the decisions to modify risk Managing the residual acceptable risk

Integrated risk management examines risk across functions and disciplines with the knowledge that risk exposure may not always occur at the organisational location of risk generation. Risk reduction efforts may lead to a zero sum improvement if efforts are not consolidated and co-ordinated in this manner. Applying a systematic and integrated framework to regulatory risk enables affiliate, regional, and global manufacturing managers to objectively assess their units compliance exposure and communicate the performance of the risk controls in place to mitigate that exposure. The Approach to Regulatory Risk Management Regulatory risk within pharmaceutical manufacturing is primarily concerned with cGMP compliance. This involves product fitness for use and compliance with regulatory controls. Product fitness for use is an attribute that most companies, irrespective of industry, need to assure. Although product fitness for use comprises more than product quality (safety and efficacy as well), we will identify this category of cost and risk as Quality. Compliance with regulatory controls, however, may be regarded as the incremental effort needed to satisfy the requirements of regulatory agencies. This is the incremental cost of doing business in strongly regulated industries such as health care product manufacturing and the aerospace sector. We shall identify this category of cost and risk as Regulatory Control. Compliance Risk = Quality Risk + Regulatory Control Risk
Figure 1. The components of Compliance Risk

April 2004

Page 3 of 9

Pharmaceuticals and Life Sciences

Risk Identification The first step of risk identification requires profiling the state of the Quality and Regulatory Control infrastructures as potential generators of compliance risk. Some examples of problem areas and potential risk generators are shown in Table 1. Quality Raw materials Equipment Personnel Processes and others Regulatory Control GMP documentation system Master instructions Computer-related systems Validation and others

Table 1. Examples of potential risk generators

Risk Quantification Risk quantification involves establishing the current levels of Quality and Regulatory Control compliance in terms of process inputs, processes, process outputs, and operational practices. A number of methods, some of which have only recently been developed, exist to measure these levels: Process capability indexing, and sigma profiling [5]; Regulatory compliance risk indexing [6]; Performance benchmarking against best practice maturity profiles.

Using the above quantification methods, managers gain insight into the current risk exposure of their Quality and Regulatory Controls compliance infrastructure. Visibility must be established of the cost to attain the current level of compliance, and where those costs occur. One must also understand the potential risk reduction resulting from an incremental investment in the compliance infrastructure. Identification of Poor Quality Costs Poor quality costs may be classified into four categories: Internal Failure Costs: Costs associated with defects found prior to the transfer of finished goods to the customer. External Failure Costs: Costs associated with defects found after shipment of finished goods to the customer. Appraisal Costs: Costs incurred in determining the degree of conformance to quality requirements before shipment of finished goods to the customer. Prevention Costs: Costs incurred in seeking to minimise failure and appraisal costs before and after shipment of finished goods to the customer.
Page 4 of 9

April 2004

Pharmaceuticals and Life Sciences

A detailed examination of these cost categories is beyond the scope of this paper, but some category examples are listed in Table 2. Internal Failure
Safety Stock Destruction Costs Over Fill Costs Material Yield Costs Efficiency Loss Downtime

External Failure
Distribution Service errors Product Insurance Litigation expenses Judgements Defective Product Replacement

Appraisal
Incoming material evaluation Inspections Evaluation of stock Calibration Services Product Inspection

Prevention
Quality System Maintenance Process Control QA Audits Supplier Quality evaluation Training Preventative Equipment Maintenance

Complaint Investigation Downgrading Table 2. Examples of the categories of poor quality cost

Identification of Regulatory Control Non-Compliance Costs Non-Compliance costs may be categorised in a manner similar to poor quality costs. These costs are related to the control element of compliance alignment of process, product and regulatory documentation [7]. Internal Failure Costs: Costs associated with control document errors found prior to finished goods release. External Failure Costs: Costs associated with report document errors found after shipment of finished goods to the customer. Appraisal Costs: Costs incurred in determining the degree of conformance to Regulatory Control requirements before shipment of finished goods to the customer. Prevention Costs: Costs incurred in keeping failure and appraisal costs to a minimum before and after shipment of finished goods to the customer.

Again, detailed examination of all possible categories of non-compliance costs is beyond the scope of this paper. Table 3 illustrates some examples of categories of these cost elements.

April 2004

Page 5 of 9

Pharmaceuticals and Life Sciences

Internal Failure
Re-processing semifinished goods due to batch record errors and omissions Scrap due to batch record errors and omissions Deviation Processing Change Control Batch record rework

External Failure
Recall processing

Appraisal
Document review & approval

Prevention
Supplier Certification

Citation and Warning letter processing NDA delay Shareholder Value Business Income Reputation

QC release certificate processing Batch Record processing

Validation

SOP development & maintenance

Investigation Reports

Complaint Processing

Table 3. Examples of non-compliance cost categories

Quantifying Costs Considering that costs are generated due to the consumption of either time or materials, it makes sense to categorise further the costs under headings of Activity and Material. Consolidating in this manner produces a Compliance Cost Matrix as illustrated in Table 4.
System Compliance Quality Activity Internal Failure External Failure Downtime Complaint investigation Rework Compliant investigation Appraisal Material Overfill Material yield Downgrading Scrap Defect product replacement Product insurance Litigation Regulatory Control Activity Rework (BR errors) Deviation processing Change Control BR rework Recall processing Citation & warning letter processing Material Scrap (BR errors)

NDA delay Shareholder value Reputation Business income

Prevention

Quality System Maintenance QA Audits Training

Inspections Incoming material evaluation Calibration services Evaluation of stock

Validation SOP development & maintenance Master Batch record development Document review and approval QC release certificate processing Batch record processing

Table 4. Compliance cost matrix.

April 2004

Page 6 of 9

Pharmaceuticals and Life Sciences

Using techniques such as Activity Based Costing (ABC) and Material Failure Cost Analysis, it is possible to populate the Compliance Cost Matrix in a manner which promotes transparency and inter-departmental responsibility. A detailed and complete discussion of ABC is outside the scope of this paper. Briefly, however, the technique assesses costs based on completion of an inventory of activities performed by each employee in a given time period. Further, each activity has a result, or output, and may consume additional resources that are also identified. Using ABC techniques, one can be certain of creating a comprehensive and very revealing map of costs. ABC cost maps tend to be much more indicative of where actual costs are being accrued. They provide a level of detail that is missing in a traditional roll-up of departmentally allocated costs. For example it becomes obvious that quality costs occur not only in the quality department, but also in production (rework) and customer relations (compliant investigation). Another advantage of such a matrix is that it highlights sources of potentially large financial risk related to Regulatory Control non-compliance for example loss of shareholder value and reputation. With a clear view of the cost structure, executives are now in a position to determine the performance level of Quality and Regulatory Control compliance infrastructures, and decide if they are under or over-exposed to regulatory risk. Performance Level Following Juran [8] it is possible to develop a total compliance curve summing the costs of appraisal and prevention with failure costs.
Total compliance costs Cost of Appraisal & Prevention

Cost of Compliance

Failure costs

Level of Compliance

Figure 2. Total cost of compliance as a function of compliance level.

Optimising the level of compliance in correspondence with the economic minimum is generally not a concept acceptable in the pharmaceutical industry. Companies need to know what their compliance cost curve actually is, and where on it they are currently operating, so as to their current compliance and quality gross risk exposure. Deciding what to do about that gross risk depends on the companys preferred risk profile, its capital structure, its future trading paradigm and its product portfolio. Some companies are risk seeking and are prepared to accept a level of risk higher that the industry average. Privately held companies may not be worried about shareholder value. Companies considering significant contract manufacturing in the future may
April 2004 Page 7 of 9

Pharmaceuticals and Life Sciences

need to greatly reduce their gross risk. Factors such as dosage forms, technology and complexity of processes, influence where a company can sensibly operate on its' compliance curve. Whatever the assumptions and limitations involved, senior management, knowing with clarity their operating position, are now able to compare options which will allow them to eliminate, transfer, or modify, gross compliance risk. Implementing the options will additionally allow containment of the cost of managing the residual compliance risks. Reducing Gross Risk and Improving Compliance Effectiveness Best-in-class companies that have systematically reduced their compliance risk, have noticed that, surprisingly, as the level of compliance improved, the cost of compliance actually decreased. Although it is completely counter intuitive given the current mentality and track record of quality and compliance professionals in the pharma sector, this phenomenon that has been observed in other industries.
16

14

12

10

Cost

Cost Saving

40-50%

X
60% 70% 80% 90% 100%

0 0%

0%

10%

20%

30%

Degree of Compliance

40%

50%

100%

Figure 3. Reducing the cost of compliance

This approach has been shown to allow recovery of 40-50% of existing compliance costs. Alternatively, operation at significantly increased levels of compliance with concomitant reduction in risk is also an option to executive management. Compliance cost and risk reduction methods are individually effective, and each is certainly of stand-alone benefit. However, such methods combined to form an overall program they can move the compliance capabilities of manufacturing from being at best internally neutral, to becoming externally supportive, and hence a source of competitive advantage. Conclusions An integrated risk management approach to management of compliance within the pharmaceutical sector should look at Quality and Regulatory Controls in terms of
April 2004 Page 8 of 9

Pharmaceuticals and Life Sciences

their compliance infrastructures. Identifying and quantifying the level and cost of these infrastructures makes the sources and consequences of regulatory risk visible. Obtaining transparency of the aggregate compliance level and associated costs allows management to make knowledge-based, rather than subjective, decisions on the optimal degree of compliance. The steps taken to modify the cost-risk profile will be contingent on a companys target risk profile and product portfolio. Innovative methods to reduce gross risk have led to a fundamental change in the compliance curve enabling leading companies to benefit from cost savings of 40-50%. A focused program to reduce gross risk and contain the cost of managing residual risk may move manufacturing from being internally neutral, to being externally supportive, thereby contributing to competitive advantage. References
1. 2. Dean, D., and Bruttin, F., Profiling Costs in the Hidden Factory of Pharmaceutical Production, PricewaterhouseCoopers, Pharma Sector Study and Report, Uxbridge, UK, 1998. Anisfeld, M.H., Validation How Much Can the World Afford? Are We Getting Value for Money?, PDA Journal of Pharmaceutical Science & Technology, Vol. 48, No. 1, pp. 45-48, Jan.Feb. 1994. Bruttin, F., and Dean, D., Exposing a Cost Black Hole While Improving Quality and Compliance Through Integrated Risk Management, Proceedings, WorldPharm98, Philadelphia, USA, 22-24 September, 1998. Kieffer, R.G., Global Trends, Needs, Issues, PDA Journal of Pharmaceutical Science & Technology, Vol. 52, No. 4, pp. 151-153, Jul.-Aug. 1998. Dean, D., Bruttin, F., and McCracken, P., Applying Best Practices in Production of Large and Small Volume Parenterals to Achieve a 2:1 Cost and Performance Advantage, Proceedings, PDA 1998 International Congress - Advances in Pharmaceutical Manufacturing, pp. 253-258, Basel, 23-25 February, 1998 Chapman, K.G., Bruttin, F., and Dean, D., Gaining Management Visibility of Potential Compliance Risks by Regulatory Compliance Indexing, PricewaterhouseCoopers, Pharma Sector Study and Report, Uxbridge, UK, 1998. Tetzlaf, R.F., GMP Documentation Requirements for Automated Systems: Parts I, II, and III, Pharmaceutical Technology, Vol. 16, No. 3, pp 112-124, 1992, Vol. 16, No. 4, pp. 60-72, 1992, Vol. 16, No. 5, pp. 70-83, 1992 Juran, J.M, and Gryna, F., Quality Planning and Analysis, 3rd edition, McGraw-Hill, New York, 1993, pp15-39.

3.

4. 5.

6.

7.

8.

April 2004

Page 9 of 9