A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical

Device and Allied Industries

Part 3 - Risk Management Examples

No Description Page

1. Example illustrating importance of Interdisciplinary Team Structure

2. Example illustrating Generation of the Risk Question / Problem

3. Example illustrating Possible Risk Control Outcomes

4. Example illustrating Risk Communication

5. Example illustrating Risk Review

6. Example illustrating the vulnerability of Companies who do not implement a

RM process

7. Example illustrating the importance of Risk Review

8. Example - distribution

9. Example illustrating the effect of global financial influences on risk

Page 1 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

Example 1
Example Illustrating Importance of Interdisciplinary Team Structure

Company A makes pharmaceutical active ingredients (APIs). A new process has a number of stages
involving chemical reaction, crude isolation, purification by re-crystallisation, isolation by filtration and
drying of the final API bulk powder.

Crude Reaction
Drying
Manifold

Pump Isolation

Purification
Pump

Isolation

This process utilises a number of different solvents at different stages. Delivery of solvents to the
purification vessel are controlled by an automated control system which is instructed what to do by
operator action through a computer terminal. The different solvents are piped through a single
manifold system before branching out for delivery to the various vessels.

Page 2 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

Solvent A Solvent B

Manifold

Hand
Automated
Automated valve
valve
valve

Purification

Company A assembles an interdisciplinary team to bring the new process into operation. The team
comprised of the following members.

• R&D Chemist – familiar with the chemistry of the process

• Process Engineer – familiar with the plant construction but especially the automated control
system
• Quality Assurance Specialist – familiar with Quality Management System and Quality
Control testing

At their meetings the group discussed potential issues (identifying the risks). Based on the QA
Specialists knowledge it was concluded the raw materials did not introduce anything foreign to the
process and once QC passed would deliver product of the correct quality. Based on the R&D
Chemists knowledge it was concluded that the process did not introduce any impurities by side
reactions or the natural chemistry of the process provided the purification step was performed in virgin
Solvent A. If any other solvent were present the batch would fail for impurities. Based on the
Engineers knowledge it is concluded that no mischarge of foreign solvent to the process could occur
as when instructed to do so the automated system would open the correct valve to charge the solvent
to the correct tank. Based on their assessment the most likely risk identified was quality of the raw
materials.

The new process was implemented and a few weeks into processing a number of batches began
failing for impurities and residual solvent foreign to the process. An investigation was conducted. The
interdisciplinary team could not determine why the batches were failing.

Page 3 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

At one of the meetings the QA Specialist asked the Production Operator to attend. The group
reviewed all the information previously reviewed in setting up the process. The Production Operator
being familiar with the plant in detail quickly noted that the valve on the solvent feed-line to the
purification vessel was hand actuated and not controlled by the automated system. It was discovered
by further investigation that the failed batches were all contaminated with Solvent B. This was
because the hand valve had been left in the open position when Solvent B was being charged to
adjacent processes and the foreign solvent was able to travel along the line into the purification
vessel.

This was a very costly oversight not just financially but also in terms of resources and time. Had the
interdisciplinary team had the right expertise in the first place i.e. a production operator involved, the
risk of the hand valve would most likely have been identified. Therefore we can learn from Company
A’s experience that having people with diverse levels of knowledge involved in the risk management
process is a key foundation stone to success.

Company A was a large company with abundant resources and finances, large departments and well-
defined and separated roles. However some companies are small organisations and may be to a
couple of people. It is not always necessary or practical to have a large interdisciplinary team. Often
one person will conduct the risk management process. The key concept here is that firstly the person
or person(s) has/have a suitable level of knowledge and secondly that that person or persons follows
a systematic approach to the process.

Lesson 1 Identifying the risk question/problem

Company A assembled a team to look at installing a new manufacturing process. In terms of this
project they did not define a risk question? i.e. what are the risks of installing this new process/what
are the risks to this new process? In omitting this step the team assembled did not take into account
the sensitivity of this new process to foreign solvents. The result was contaminated batches of product
that could not be used and were lost at a cost of $6 million each.

Lesson 2 Defining Assumptions

In defining the risk question or problem it is also fundamental to list any assumptions made. The team
Company A assembled did not account for their assumptions. For example their assumption that the
plant was completely automated and that the automated system could not be by-passed led to them
overlooking the biggest risk to the manufacturing process. Knowing your assumptions helps you
define the limits of your risk assessment and when you get an unexpected occurrence in your process
you can quickly identify if you need to expand your assumptions to look at other potential risks not
previously identified. Company A failed here because they did not know what restrictions they had
started with.

Lesson 3 Assemble Data & Information

The team Company A assembled did not gather sufficient data or information about all potential risks
in implementing their new process. All three of the initial team members limited their decision making
to data they were readily familiar with and did not expand outside of their own focused role related
knowledge. The wider picture was not looked at, at this early stage. Much of the information they
relied on was “gut feel” rather than unbiased scientific data. In order to assess a risk you must gather
data and information about it to determine its true potential to occur and with what severity it may
occur. This defines for us another important step in the initiation stage of the risk management
process.

Lesson 4 Identify Leaders and Resources

The team Company A assembled did not have a defined leader. It is important in any risk
management process that a leader is identified who will co-ordinate the effort and ensure the
systematic process is adhered to. In the case of Company A’s team the Chemical Engineer was a

Page 4 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

character with a very strong personality. He had a tendency to be argumentative which de-motivated
the remainder of the team in questioning anything he said. Had there been a team leader to ensure
the all opinions were fairly heard and the process adhered to properly then his lack of knowledge of
the design of the plant may have become apparent at an earlier stage and would possibly have
prevented the issues Company A later encountered. Also it was not until a later stage that adequate
resources were assigned to the task i.e. when the production operative was included in the team. Risk
management requires input in order to generate useful and meaningful output, It is important to the
success of any risk management process that it receives adequate resources.

Lesson 5 Specify Timelines and Deliverables

The team at Company A were given no timelines to work to and no deliverables of their project were
initially defined. This meant that meetings occurred infrequently. The issues continued as more and
more batches were manufactured. Timelines give the risk management process focus as well as
helping to manage larger processes in bite size pieces. A clear deliverable again helps focus the risk
management process towards a final output. Company A’s team largely had to revisit all their initial
work when issues started to arise with the new process. This was because the project never defined a
deliverable such as a risk assessment report which could have documented much of their previous
work and offset the need to repeat the majority of it.

Message
The are a number of key points to consider when initiating a RM process

Page 5 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

Example 2
Example Illustrating Generation of the Risk Question/Problem

Company B is a supplier of salt (sodium chloride) to various types of industry. 60% of Company B’s
business is supplying salt to local county councils for gritting roads in cold weather. The remaining
40% of Company B’s business is supplying salt to the pharmaceutical industry for use in sterile
injections.

Company B decides to conduct a risk management process on its business to identify potential risks
to satisfying its customers and to identify maximum business potentials.

Company B is a one man operation where the owner of the business purchases salt in bulk from a
manufacturer and repacks it into 25 Kg bags for his customers. The owner of Company B sits down
with a blank sheet of paper to initiate his risk management process. He decides to conduct some
brain storming to decide what his risk problem /question is.

He starts to make some notes in relation to his business. The first major note is 60% to 40% split in
business. If he was to stop here then he may well end up with a risk question or problem which says.

“What are the risks with supplying road gritting salt?”

But let’s see what happens when he progresses brainstorming. He next notes that the 60%:40% split
in business is based on quantities only and doesn’t reflect much about his income from his business.
The county councils only need salt for 3 months of the year. The pharmaceutical customers take salt
from Company B all year round. For supplying the pharmaceutical industry Company B can charge
£25 per bag. For supplying the county councils he can only charge £15 per bag. If Company B only
sells 100 bags this year he will make £1000 from his pharmaceutical customers and £900 from his
county council customers.

The owner of Company B talks to the buyers from the councils and pharmaceutical customers. He
attempts to understand how important his supply of salt is to them both. It rapidly becomes clear that
the councils have no real requirements and that provided the salt is salt and melts ice they will accept
anything he can supply. His pharmaceutical customers however explain the seriousness of
contamination of sterile products to him i.e. how any unknowns that may go undetected in the salt
could potentially end up killing the end user of the injection they manufacture from his raw material.

In going this far with his brainstorming session the owner of Company B has a different perspective
arrives at his risk problem/question?

“What are the risks in my manufacturing process to ensuring pharmaceutical grade salt is supplied to
my pharmaceutical customers and to ensure I retain this more profitable business?“

Message

The RM helps clarify the links between quality products and services and business continuity

Page 6 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

Example 3
Example Illustrating Possible Risk Control Outcomes

Company C makes cosmetic and pharmaceutical products. They are supplied pumps for the top of
product containers from Supplier A. The same pump is used on a cosmetic product and on a topical
pharmaceutical product. Supplier A is attempting to reduce his costs so sub contracts the
manufacturing of pumps to another supplier, Supplier B. Supplier A informs Company C about this
change and points out that there is a slight difference in the pumps contracted from Supplier B. This
slight difference in the manufacturing process means that the pumps supplied by Supplier B deliver a
larger volume when actuated by the end user. Company C conduct a risk assessment and evaluate
that there is a significant risk of the new pumps delivering a larger volume of product and that this will
occur 99% of the time the pumps are actuated by the end user and this increased volume may be 1.5
times as much as with the older pump.

At the Risk Control stage of the Risk Management project Company C can make one of two
decisions. Accept this risk with the pumps or reduce this risk with the pumps. In terms of the
cosmetic product an increase in the volume of dispensed product is low risk. It will not have any
adverse effect on the end user apart from the product getting used up faster. There is slight risk that
some customers may complain that the pump dispenses too much material but given the nature of the
product this is relatively unlikely and will not be a significant proportion of sales. In terms of the
cosmetics product Company C therefore decides the level of risk for that product is acceptable and
agrees to accept the new supply of pumps and use them.

However in terms of the pharmaceutical product Company C does not see the level of risk as
acceptable. The new pumps provide a very high risk of the patient being exposed to very high dose of
the active pharmaceutical. At the dose the new pumps are likely to dispense the patient would be
exposed to a relatively high risk of safety or toxic effects from the product. Therefore Company C’s
decision is that the level of risk must be reduced. In order to reduce risk Company C source another
pump from Supplier C. This pump will deliver the same volume of product as the original pumps
Supplier A used to supply.

Risk control involving reduction of risk usually involves some form of change. Whenever change
occurs the risk assessment process should be revisited to ensure that no new previously unidentified
risks are introduced as a result of the change taking place. Are Company C’s problems now over? Not
really because in changing from Supplier A to Supplier C they have introduced a pump which delivers
the same dose and therefore protects the patient form high dose exposure and the safety and toxic
effects that can bring. However they failed to assess the new pump from Supplier C in terms of the
product itself. They did not take account of the fact that the new pump contains a synthetic sealing
gasket that interacts with the pharmaceutical product reducing its shelf life and making the product
unstable.

A key message here is the need for balance. Risk control must balance the benefits of risk reduction
and its cost with the significance of the risk. In the case of Company C above risk with the cosmetic
was relatively low. The cost of making changes to reduce risk here would be unnecessary as the risk
with the cosmetic was not significant enough to warrant it. However the risk with the pharmaceutical
product is much higher. Risk reduction here is a prudent step, is warranted and brings a number of
benefits that outweigh the cost of risk reduction.

A Lesson on the Value of Good Communication

Imagine the situation where Supplier A did not inform Company C of the changes it was making to
pumps. The potential impact to Company A could be as follows

• Product failing to meet specification

• Rework costs

Page 7 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

• Rejected product incurring manufacturing and destruction costs.

• Loss of time, raw materials, resources
• Cost of processing customer complaints and returned stocks
• Recall of product
• Damaged reputation of product and company
• Loss of market or market share
• Legal implications of putting end-user of product at risk, causing them harm of fatally injuring
them.

Potential impact to Supplier A could be;

• Loss of business
• Loss of revenue
• Legal action
• Incurring partial or full cost of recall
• Damage to reputation or company

Message
Good communication is invaluable

Page 8 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

Example 4
Example Illustrating the Importance of Risk Communication

Company A has purchased a chemical excipient from supplier A for many years. The material is used
in an oral dosage form and there have been no reported quality issues associated with this material.
This material is not purchased as a pharmaceutical grade and there is limited communication
between the two companies.

Company A analysed a recent delivery and found an Out of Specification (OOS) result for one of the
tests. This was reported to Supplier A as a complaint, for investigation and root cause identification.
During this investigation, it was identified that the supplier’s results for this particular test were
consistently lower than those obtained by Company A. Further reviews indicated that due to a trend in
analytical differences, that there was the potential for high results, within the acceptable limits for
Supplier A, but for Company A to be high but outside the limits and unacceptable.

This created a stalemate situation where both parties confirmed their relevant results. It also meant a
delay in the availability of material for use in production, whilst investigations were ongoing. Supplier
A is the only source of this material so it was important to Company A that the situation was resolved
quickly.

Discussions were held to assess the risks associated with the manufacture and supply of this
material. As part of the risk mitigation strategy, it was agreed that Supplier A would provide a pre-
shipment sample for any future deliveries that could be analysed and approved before shipment was
made. This would avoid any material rejections and maintain the supply chain to Company A. It is so
important to assess the potential analytical differences between testing laboratories and to perform
trend analysis.

Message
Open communication channels must be maintained throughout the RM process

Page 9 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

Example 5
Example Illustrating the Importance of using Factual Information / Data in the RM Process

Supplier B has manufactured a component for the medical devices industry for many years. Company
B purchases the product (small plastic tubes) from Supplier B for use with its device and has had no
issues with the supply chain or quality.

The relationship between the two companies is managed from a distance with little or no contact.
Suddenly, Company B receives a phone call from Supplier B to say that they have gone into
administration and sold their plastic tubes business to another company with immediate effect!
Company B has no knowledge or experience of this other supplier C and has no choice in the transfer
to Supplier C. The tubes supplied are classed as primary packaging as the inner surface of the tube
is in direct contact with the product. It is therefore important to establish that the specification for the
tube is identical as before and that they are manufactured under cGMP.

An audit of Supplier C’s facility has to be quickly organised as this needs to be conducted before the
next delivery which will be manufactured by Supplier C. In addition, confirmation is required that the
specification is exactly the same as before. To meet legislative requirements, product manufactured
using the new tubes will have to be put on stability to verify that there is no affect on the product.

This change without prior notification by Supplier B, has forced Company B to initiate a number of
priority activities and caused delays in the production of this topical product. Customer service has
been dramatically affected. It was unfortunate that the assumption was made by Company B that
everything was alright with Supplier B.

Message

Constantly assess the financial stability of your suppliers and the affects on the supply chain as part
as regular risk management

Page 10 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

Example 6
Example Illustrating the Importance of Implementing a RM Process

The manufacturer of a life saving medicine that is administered as an intravenous injection needs
chemical A to extract the active ingredient during the manufacturing process. A batch of chemical A
was noted by one of the operators during manufacture to be contaminated with red particles. The red
particles were not found during the initial sampling, testing and visual inspection of the chemical
before the batch was released to be used in the production of the medicine.
The batch of product that was about to be manufactured using the contaminated Chemical A was
aborted (£250,000). Another batch of Chemical A was ordered from Supplier A as a second supplier
had not been approved and Chemical A is a critical chemical required for business continuity.There
was an unforeseen delay in lead time for the supply of another batch of Chemical A and the
manufacture of further batches of medicines were delayed by 3 weeks (£750,000).
A second batch of Chemical A was delivered from Supplier A but was also found to be contaminated
with the red particles. A further delay of 2 weeks was incurred (£500,000). A second supplier (B) was
urgently sourced and approved via supplier questionnaire and audit but there was a further delay of
two weeks (£500,000). Supplier B duly supplied Chemical A within days following the pre-approval
audit. Upon receipt, inspection and testing of Chemical A from Supplier B, Chemical A was found to
be contaminated with blue particles!

A third supplier (C) was sought and approved via supplier questionnaire and audit. A further delay in
manufacturing of one week (£250,000). The manufacturer received a batch of good quality Chemical
A from Supplier C that was used successfully to manufacture new batches of medicine.

Supplier B performed a thorough investigation and implemented an effective corrective and

preventative action plan. Supplier B, however, is still not approved as a secondary supplier and
communication has ceased between the manufacturer and Supplier B as it did with Supplier A.
Supplier C has supplied good quality Chemical A for a number of years but the manufacturer still only
has Supplier C as a formally approved supplier for Chemical A.

Message

Organisations can become extremely vulnerable if a RM process is not embedded into Company
culture as a routine discipline

Page 11 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

Example 7
Example Illustrating the Importance of Risk Review

Contract Manufacturer X has manufactured Cough Syrup for the pharmaceutical industry for many
years, there was one formulation not in high demand and made infrequently for a specific European
market where a client company sold the product mainly in children hospitals. Company X purchases
all the materials from approved suppliers and for this product all materials are Pharmacopoeial grade
materials with the exception that a flavouring purchased from company A as a non-Pharmacopoeial
grade but a has an old codex specification. Previously there has had no issues with the supply chain
or quality but the material had not been required to be purchased in several years.

The relationship between the two companies was managed from a distance with little or no contact for
several years. Suddenly, Company X receives an order from its client as it will be out of stock in 8
weeks and the flavour is required to be purchased. Company A supply the flavour to its current
specification which has different limits to the previous specification purchased. On investigation this is
the only material available as the flavour is a naturally sourced product subject to seasonal variations.
Company A upgraded its technical specification in the previous year to reflect the product changes
and communicated the change to its regular food grade customers. Company X was not informed as
a low order user and assumed discontinued as no contact. Company X assumed no changes as no
communication received.

As the cough syrup was a licenced pharmaceutical product all ingredients were listed as BP except
the flavour which had the previous technical specification registered in the Marketing authorisation.
Thus to meet legislative requirements, the cough syrup could not be manufactured without a licence
variation which was a expensive and lengthy type II application in the market concerned as it was a
widening of some test limits.
The variation was approved 12 months after the client applied for the changes which resulted in the
product being unavailable for a year. Thus if the product was to be manufactured and sold a re-launch
of the product was required.
The result was the paediatric product was not practical to put back on the market and died even
though there was a need for it. Fortunately this occurred before the sunset clause came into
European law which has legal consequences for interruptions in supply of pharmaceuticals as well as
consequences for patients established on a specific product or a product established for patients will
a restricted range of options.

Just because you have no issues and little contact with a supplier, don’t assume that something
hasn’t changed or a minor ingredient deviation can’t remove a product from the market.
It is important that
1) Manage your suppliers and customers especially if unusual requirements are needed for low order
time periods of materials only used in small quantities with a long shelf life.
2) check and manage technical specifications of all suppliers regularly for changes and compliance
with applicable standards or registrations.
3) Know your supplier’s market and that of your customer requirements.
4) Communication of change to customers and they to their clients is key. Do not make assumptions
but check regularly.

Message
Never forget the importance of risk review

Page 12 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical
Device and Allied Industries

Example 8 – Distribution

Company A does not have its own transportation so it relies on a local haulage company to collect
and deliver its products.

A customer had recently complained to Company A about the receipt of a damaged pallet of goods.
The customer provided photographic evidence of the issue which identified that the damage was not
just superficial but severe. The pallet had apparently been re wrapped by the haulier.

Company A contacted the haulage company to investigate the complaint. This investigation identified
the fact there was formal contract between the two companies that clearly defined the roles and
responsibilities of each party, that the haulier did not fully understand the importance of his role in the
supply chain and the impact / consequences of his actions. Therefore he had not reported the issue
where a forklift truck had damaged the pallet and thought he was doing the right thing by re-wrapping
the pallet.

There was no transport “specification” defined that included the details of such areas as:

• Transportation routes
• Storage conditions
• Handling methods
• Documentation
• Reporting process for issues
• Key contact information at both companies

The pallet was returned to Company A and the product had to be rejected at a cost to Company A as
the level of company insurance was not adequate to cover the cost of this product.

Message: it is important to ensure that all your suppliers fully understand what your requirements are
and what their role / responsibility is in your supply chain.

What should have happened?

• Generation of a formal service contract between the 2 companies at the start of the contract.
• Clear definition or roles & responsibilities.
• Specify any specific storage, handling or documentation requirements.
• Ensure insurance coverage is adequate.
• List of key contacts at both companies.
• Agree process for reporting of issues and ensure that the communication channels are set up.

Page 13 of 14
 A Guide to Supply Chain Risk Management for Suppliers to the Pharmaceutical, Medical Device and Allied Industries

Example 9 Example illustrating the potential effect of global financial influences on risk

Plastic Car Part Factory Plastic Car Parts

Car Factory

By Knock On
Economic
Product Effect
Downturn
R d d =

Risk Factors
• Economic slowdown
Acetonitrile • Reduced sales in unrelated
Car Industry
Example: Post down turn • Supply shortages for
Acetonitrile producers
Knock On analysis costs
• Supply shortages for
Effect 30 litres a Month £75 per litre Consumers

Use Acetonitrile as Example: Pre down turn Example Business

Raw Material / in analysis costs Effect
intermediate or £23,400 per annum
finished product / 30 litres a Month £10 per litre Cost Rise
Reagent

Page 14 of 14