Risk Management in Pharmaceutical Outsourcing

Business and technical risks exist in outsourcing, and strategies for mitigating and sharing those risks between a pharmaceutical company and contract manufacturing organization (CMO) are critical for a successful outsourced relationship. A recent program, held in January by the Drug,Chemical, and Associated Technologies Association (DCAT, Robbinsville, NJ, www.dcat.org) featured perspectives from CMOs, pharmaceutical companies, and regulatory experts on ways to mitigate and assign risk in the outsourced relationship. These perspectives include methods for optimizing the supply chain, factors to consider when outsourcing to suppliers in India and China, and insight from the US Food and Drug Administration (Rockville, MD, www.fda.gov) on the inspection process of contract facilities.

Types of risk: business and technical

Several risks exist in the outsourcing relationship, explains Robert Schiff, president of Schiff & Company (West Caldwell, NJ, www.schiffandcompany.com), a consultancy specializing in regulatory affairs and pharmaceutical manufacturing. Schiff spoke at the recent DCAT program. This risk applies to outsourcing the manufacturing of raw materials, active pharmaceutical ingredients (APIs), excipients, packaging materials, and the finished drug product.

"The pharmaceutical company outsourcing manufacturing faces a basic business risk: the potential of a CMO to fail to meet timelines and the resulting financial impact these delays would have on the pharmaceutical company's costs and profits for a given product," he said.

The ability of the CMO to deliver relates to certain factors: the quality of its management, staffing levels, the skill and experience of the staff, the availability and quality of the equipment used by the CMO, and the capacity utilization of the facility in which the project will be performed.

"The experience question is the most important question in the outsourced relationship," he says. "Will the CMO be learning on your dollar or does it have in place the manufacturing capability, in terms of management, staffing, equipment, and facilities, to be able to perform your project," he asks.

"The basic technical risk is in the manufacturing process itself: the loss of control by the pharmaceutical customer in assuring the quality of the process," says Schiff. Specific types of technical risk include a lack of planning in the technology transfer between the CMO and the pharmaceutical customer, incomplete process validation, and changing specifications when outsourcing a project.

To reduce these technical risks, a pharmaceutical company must perform due diligence on a prospective CMO, explains Schiff. This process includes: checking if a CMO has ever been issued a warning letter by FDA, reviewing the CMO's company history, obtaining third-party references, and examining specific illustrations of the CMO's experience with the particular type of product manufacture involved in the outsourced project. These steps, along with auditing a CMO's facility for compliance with 21 CFR 210 and 211 (1), which outline current good manufacturing practices (CGMPs), help to identify the technical risks in an outsourcing project.

A basic risk-management program involves risk assessment, risk evaluation, a process for making those risk assessments and evaluations, and the process of deciding whether to accept the risk or take steps to reduce the risk, explains Schiff.

"Risk assessment first begins with identifying all the events that can go wrong, then determining the likelihood and probability of occurrence of those events, and then evaluating the consequences of not acting on those possible risks," explains Schiff. "When evaluating the risk, one should compare the identified and analyzed risk to standardized criteria and then consider the evidence for what can go wrong, the likelihood that it will go wrong, and the consequences if the potential risk were to occur."

Risk management in the outsourced relationship

Given that some form of business or technical risk is inherent in the outsourced relationship, the next critical step is deciding how that risk should be incorporated into the outsourced relationship.

"The basic point here is that the contract should not be the principal risk-management tool," says Jim Miller, president of PharmSource Information Services, Inc. ( Springfield, VA, www.pharmsource.com) and contributing editor to Pharmaceutical Technology, who also spoke at the DCAT program. "Risk management is part of the sponsor's cost of doing business, and both the sponsor and the CMO have to have realistic expectations of the value and risk that each party assumes."

The risks of drug development (e.g., the potential failure of a drug moving through the drug-development process to commercial manufacture and the sales of that drug in the marketplace) are assumed by the sponsor or the pharmaceutical company.

"The pharmaceutical company cannot load that business risk on the CMO," explains Miller. "The CMO's business model is not designed to take on the risk of drug development; its margins cannot absorb high levels of risk," he says. "Not understanding that issue can lead to protracted negotiations and relationship problems between the CMO and sponsor."

In turn, a CMO should limit its risk exposure to its ability to meet value-added process, regulatory, schedule, and service-performance goals. "CMOs play a role and bear a certain share of the risk, but it is a small part of the overall process," says Miller.

It therefore becomes critical for the sponsor or pharmaceutical company to use the full range of risk-mitigation tactics as outlined in Table I. These tactics include avoidance, prevention, redundancy, separation, transfer, and retention, and may be used to reduce a sponsor's exposure to risk.

Table I: The full range of risk-management tactics.

Miller also emphasizes the need to perform due diligence on a prospective CMO. "Adverse business developments in the CMO are more likely to be catastrophic than compliance or technical problems," he says. Despite this tendency, a recent survey showed that only 17% of sponsors actually review their contracts financially on an annual basis (3).

Miller points to key parameters when evaluating the CMO's business strategy and its business risk. "See if the company is successful and has a track record of profitability and growth." he says. "See if the company can support its growth by looking to see if it has positive and increasing cash flow and what the company's debt capacity and obligations are. Also, see if the company remains dedicated to the contract business. Look for signs that may show the owners' intentions for selling or exiting the business."

Another important risk-mitigation tactic is to put contract conditions up front in the request-for-proposal (RFP) process. "Risk-management issues are often more contentious and expensive than price," says Miller. "Issues such as who takes responsibility for blown batches, order lock-ins, indemnification, and take-or-pay conditions are important in the RFP process. It is better to take the time to access these costs and to factor them in the RFP process than to attempt to switch vendors or contractors late during the project's execution, which may threaten the timelines for the project."

Outsourcing in India and China

Given the rising influence of India and China in the global pharmaceutical supply chain and these countries' demand potential as high-growth pharmaceutical markets, a basic question arises. Which is the greater risk: the risks associated with outsourcing or the risk in not participating in those markets?

To answer those questions, Stephen Hannon, director of marketing for Davos Chemical Corporation (Upper Saddle River, NJ, www.davos.com), a manufacturers' representative, provided insight into his company's perspective on conducting business in India and China.

"The common perception is the reason to outsource to India and China is price," says Hannon. "But price alone is not a reason to outsource to manufacturers in those countries. You outsource to people and companies that provide the service, quality, and price that you require. If you are not building relationships and meeting person-to-person, you are not outsourcing."

To illustrate the risks on deciding to outsource based on price alone, Hannon offers the following example. A US-based chemical manufacturer decided to source from China, communicated by e-mail, and received samples from the Chinese company in a timely manner. The samples were tested and were of excellent quality. Before proceeding to buy the product at a competitive price, however, the purchasing company visited the site. An on-site inspection revealed that the company did not have a system for labeling and assigning product- or lot-identification numbers. Moreover, an inspection of the facilities revealed many deficiencies, including open reactor vessels, open filtration systems and centrifuges, and poor ventilation.

"It is obvious that the cost savings achieved from the pricing of the product alone did not override the risk of bringing such product into the company's supply chain," says Hannon. "There is no substitute for building relationships when outsourcing a project or purchasing raw materials. E-mails are not a substitute, and telephone communication is good only for maintenance. It takes work, time, travel, and exposure to the CMO, no matter where it is based, to evaluate and mitigate the risks."

In offering practical advice about doing business in India and China, Hannon points to key differences among manufacturers in those countries. "In general, Indian manufacturers tend to be fully integrated. That is, manufacturers have their own research-and-development [R&D] capabilities," he says. "Chinese manufacturers tend to manufacture only, and their R&D expertise resides in academic or institute laboratories."

To adapt to those differences, Hannon advises that in India, the sponsor of the outsourced technology must partner with a manufacturer with demonstrated strength in both R&D and in manufacturing the core technology of the given project. "In China, the sponsor can outsource the R&D to a qualified development group and then transfer it to a qualified manufacturer. It is important that the sponsor retain the key technology control within the R&D group."

Hannon also points to practical concerns when importing product from India and China. Obtaining export licenses from India and China can be time-consuming and unpredictable, and the documentation process in customs is variable, both in terms of the quality of the paperwork and the time needed to process a shipment.

He also describes differences in business practices. On a practical basis, contracts and legal agreements are used more to specify the work requirements of a project rather than to establish a binding agreement enforceable in domestic judicial proceedings in India or China.

Also, the rapid pace of growth in the pharmaceutical markets in India and China, estimated at 15–25% per year, has created mobility in the labor pool in those countries. "The rapidly changing labor pool is an important consideration when outsourcing a project, since the sponsor of a project needs to know that the staffing levels and expertise, particularly with certain chemistries, can be maintained during the course of the project."

Views from emerging pharmaceutical companies

Risk management is a particularly critical issue for emerging pharmaceutical companies, which may rely more heavily on CMOs to meet demand for ingredients and finished-dosage manufacturing. Vito LaVopa, senior manager for supply chain at The Medicines Company (Parsippany, NJ, www.themedicinescompany.com), spoke at the DCAT program and offered insight into mitigating the risks in the pharmaceutical supply chain.

"In supply-chain risk assessment, identify potential risks, rank by considering the probability and impact, and focus on the risks that you can control," says LaVopa. "Assess the overall supply chain by mapping the process and identifying the weak link in the supply chain, taking into consideration the ingredients being delivered or service being outsourced, and other inputs such as equipment, staffing levels, and expertise of the CMO."

This process takes into consideration the need for independent supply chains and the use of multiple vendors to ensure the delivery and quality of the supply of a particular product, says LaVopa. "It is important not to overlook the actual delivery of the product and the factors that affect that process," he says.

Issues to consider in this process are the transportation mode and costs, inventory management at the CMO (which can include the length of time a product is stored and the product's storage conditions), and the replacement value (full or partial) of product that potentially could be lost in the shipping cycle.

A common question that arises in the supply chain is whether it is less risky to split shipments, which is particularly important during product launch and for products with lengthy lead times for replacement. "It all depends on the particular product and the shipping conditions under which that product is being shipped, which could even include weather conditions and the actual route being taken to deliver the product," says LaVopa.

"Also, when importing product offshore, it is also important to fully understand the customs procedures and practices to ensure security in the supply chain," he says. He points to the importance of knowing who has access to material, when this access is available, and at what points in the supply chain. This may involve, for example, verifying the procedures for on-site sampling of the product by customs, the process for sealing a drum, and the associated labeling and identification process when the drum is sealed, such as using serialized tags.

Jean Poulos, vice-president of quality and regulatory operations at Luitpold Pharmaceuticals, Inc. (Shirley, NY, www.luitpold.com), points to risk-management issues for the finished-good manufacturer.

"Risk increases on marketed finished products, and the continued product performance is influenced by ingredient quality," she says. "Any change, therefore, in the ingredient may cause a negative effect on the finished product." Changes in ingredients may involve starting materials, intermediates, process optimization, equipment, facilities, and containers. And, an unknown change in an ingredient can cause it to be used in the finished product without adequate evaluation.

"To minimize that risk, ingredient manufacturers must have a vigorous change-notification process," says Poulos. "It is better for the sponsor or the pharmaceutical company to be overinformed than underinformed. There must be open communication regarding changes," she says. "The finished-product manufacturer needs to identify significant conditions of approval concerning the API or excipient and be able to communicate those to the ingredient supplier. The supplier needs to have a strong technical understanding of the impact of changes that the API or excipient will have on the finished product, and be able to communicate that back to the client."

She also emphasizes the need for ingredient suppliers to have an open door to client audits and having the ability to provide long-term reserves of material if preapproval is needed.

To illustrate the importance of those issues, Luitpold offered some examples of ingredient changes. An API manufacturer changed the site of manufacture, which was allowed within the drug master file, and validation was completed. This change was not reported to the client. Although the process did not change, the move to a new manufacturing location caused a slight change in pH. Since there was no specification for pH, this change went undetected until the ingredient was used in the finished product, causing it to fail. Corrective actions were put in place to add pH as part of the specifications of the API process and to add the manufacturer's site address as part of the reporting requirements.

Regulatory compliance for contracting

The relationship between the CMO and sponsor is critical not only in meeting the commercial goal of a given project, but also in meeting the regulatory requirements of the manufacturing process. The sponsor or pharmaceutical company is ultimately responsible for the manufacturing process, whether externally or internally provided.

"All facilities involved in the manufacturing or testing of drug substance or a drug product are required to adhere to the portion of the CGMPs that apply to their operations," explains Nancy Rolli, preapproval manager and investigator for FDA, who also spoke at the DCAT conference. "FDA considers contract facilities as an extension of the manufacturer's own facility."

Rolli further explains that it is important to FDA that a written and approved contract or formal agreement exists between a company and its contractors that defines in detail the CGMP responsibilities, including the quality measures of each party. Moreover, a contract should permit a sponsor to audit its contractor's facilities for compliance with CGMPs. Additionally, it should be clear in the outsourced relationship how technology is transferred.

To meet these CGMP requirements, Rolli explains that when qualifying a prospective contractor, the sponsor or pharmaceutical company should know what other ingredients or chemicals are made, processed, or tested in the facility; the potential for cross-contamination in the facility; the controls in place to prevent product mixups; and the qualification and expertise of the operators or analysts in the production process.

When using a contract facility, Rolli advises that the pharmaceutical company or sponsor ask to be notified by the CMO when FDA visits the contract facility. The company or sponsor also should ask for copies of all warning letters (483s) that FDA issues to the CMO.

Rolli adds that a pharmaceutical company should ask to be notified by the CMO if a test result was obtained by a retest and should ask to be notified of all deviations that occurred during the processing or testing of the product. Also, a pharmaceutical company should request the CMO to notify it of all changes that could affect the processing of its products, including new equipment, changes in key personnel, change in test methods, and changes in standard operating procedures.

References

1. US Food and Drug Administration, 21 CFR Part 210 , Current Good Manufacturing Practices in Manufacturing Processing, Packing, or Holding of Drugs General (FDA, Rockville, MD, 2005), www.fda.gov/cder/dmpq/cgmpregs.htm, accessed Feb. 1, 2007.

2. FDA, 21 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals, (FDA, Rockville, MD, 2005), www.fda.gov/cder/dmpq/cgmpregs.htm, accessed Feb. 1, 2007.

3. J. Miller, "Survey Finds Outsourcing Practices Continuing to Mature," Pharm. Technol. 27 Outsourcing Resources supplement, 16–22 (2003).