0

Best Practices, LLC Strategic Benchmarking Research

REPORT SUMMARY

Best Practices in Crisis Management & Business

Continuity for BioPharma Manufacturing and

Supply Chain Operations

1

TABLE OF CONTENTS

I. Universe of Learning, p. 4-7

Participating Companies, p. 5

Participating Companies by Segment, p. 6

Job Titles of Participants, p.7

II. Key Insights and Findings, p.8-19

III. Structure and Leadership, p. 20-27

IV. Emergency Response: Building Capabilities To Respond

Quickly & Effectively Throughout Your “Ecosystem,” p. 28-38

V. Assessing Risks & Prioritizing Response , p. 39-50

VI. Assembling The Tools and Techniques to Build an Integrated

Business Continuity Plan, p. 51-60

VII. Developing A Prevention Mindset and Fast Response, p. 61-66

VIII. Using Backups & Redundancy Management, p. 67-72

IX. Importance of Communication During Crisis, p. 73-79

2

TABLE OF CONTENTS

XI. Securing Your Supply Chain To Safeguard Customers

and the Company, p. 80-86

XII. Working With Sole-Source or Strategic Suppliers, p. 87-

94

XIII. Performance Metrics, p. 95-97

XIV. Creating A Business Resiliency Framework: The Next

Generation, p. 98-103

XV. Current Trends and Future Directions For Contingency

Planning, p. 104-106

XVI. Lessons Learned: Key Opportunities To Support

Continuous Business Continuity Improvement, p. 107-

110

XVII.About Best Practices, LLC, p. 111

3

List of Participating Companies

In total, 33 Business Continuity (BC) leaders from 29 national and global health care organizations

participated in this research. All study participants answered all or relevant parts of a comprehensive BC

performance benchmark assessment. In addition, selected executives provided qualitative insights

through deep-dive interviews and “lessons learned” observations.

4

Job Titles and Functions of Study Participants

•SVP Global Operations

•VP Product Supply and Facility

•Head of Engineering, Facilities & EH&S

•Executive Director

•Director, Global Commercial Development

•Director of Operations (2)

•Director, Supply Chain (3)

•Director Material Management (2)

•Deputy Director of Pharmacy

•Director of SC & CS Excellence

•Associate Director - Business Improvement - Center Of Expertise

Manufacturing Bulk

•Associate Director, EHS & Business Continuity

•Associate Director, Compliance & Risk Management

•Associate Director, Global Artwork Management

•Team lead

•Sr. Manufacturing Manager

•Global HSE Consultant - BCP

•Manager, Supply Chain

•Manager, US Distribution

•Logistics Manager

•Distribution Manager

•Distribution Manager

•Project Manager (2)

•Project Manager- Manufacturing

•Business Process Owner (2)

•Automation Specialist

•Pack. Operator

•Energy Engineer

This research accessed Business Continuity leaders across the enterprise. More than 54% of benchmark partners hold roles at the Director or Vice President levels. Interestingly, nine out of 10 BC managers seem to hold generalist responsibilities, with Business Continuity being just one of their job responsibilities.

Managers ,

46%

Directors or

Above, 54%

Business Continuity and Emergency Management Leadership- Skill Sets

5

Framework for Study Insights, Best Practices, & Pitfalls

The performance benchmark and field research have harvested scores of insights and

observations. They have been organized into the following executive summary framework

for discussion and planning purposes.

Insights,

Best Practices,

Pitfalls 3. Train & Drill For

Fast Emergency

Response

4. Planning Paradox:

Plans Are Useless;

Planning Is Priceless

5. Develop Risk Assessment Capabilities For the Enterprise

6. Cultivate A

Prevention Mindset

& Capabilities

2. Balance Centralization &

Fast Field Response

7. Secure The Value Chain:

Supply, Develop, Distribute

1. BCP Is A Young Function 8. Business Resilience Is

Next Frontier of BCP

6

Emergency Response Training Is Essential for Fast Response

– But Training Occurs Sporadically:

More than 60% of companies conduct emergency response training

only once or twice a year – or not at all.

Training frequency goes hand and hand with response effectiveness.

This seems an Achilles’ heel for many companies.

Less than 1/3 of companies train monthly or quarterly.

Business Continuity Mastery Comes through Practice Drilling:

Frequent training drills are one proven way to prepare for “high-impact,

low-frequency events.” Conduct regular practice drills to prepare the

organization for the unlikely.

The act of training ultimately becomes more important than the type of

crisis for which one prepares.

SAMPLE KEY INSIGHTS: “Train & Drill for Fast Emergency Response”

7

SAMPLE DATA SLIDE: “Majority of Companies Give Themselves Mediocre Scores for Fast Emergency Response”

Q29 Based on practice drills and/or actual emergency events, what is your

current level of performance for the following response types?

47%

47%

47%

27%

40%

40%

47%

47%

Fire response

Evacuation response (of employees,

contractors, vendors, customers)

Return-to-full-production response

Communication response (internal, external)

Exemplary response time (performance exceeds response time goals)

Mediocre response time (performance meets response time goals)

(N=15)

General response time assessments are poor when companies are asked to grade themselves. More than half of all companies score themselves as “mediocre” for fire, evacuation, return-to-production, and communication response times.

8

SAMPLE DATA SLIDE: “Emergency Response Training Occurs Only Sporadically”

Q7 How frequently do you conduct emergency response training - as

contrasted with actual drills - throughout for your key operations groups?

16%

36%

24%

4%

16%

4%

0% 20% 40%

We do not conduct any

training exercises

Other

Semi-annually

Annually

Quarterly

Monthly

Data Trends

2/3 of partici-

pants from LHC

conduct

emergency

response training

less than 2 times

a year, or not at

all. The number

jumps to 80%

when looking at

SHC.

More than 60% of all participants reported conducting emergency response training once or twice a year –

or not at all. Training frequency often goes hand and hand with response effectiveness. It appears this

may be an Achilles’ heel for many companies. In contrast, less than 1/3 of companies train monthly or

quarterly.

(N=25)

9

SAMPLE DATA SLIDE: “Fire Drills Most Frequently Rehearsed Emergency Response”

Q9 Please indicate how frequently you conduct the following emergency response

drills for ensuring successful emergency management and business continuity

Aside from fire drills, most emergency responses are practiced once or twice each year – or

not at all. Hazardous waste, safety and accident response drills are the most frequently

practiced drills after fire.

(N=21)

10

Q45 What percentage of your critical supplies, parts and raw materials are

single-sourced?

Almost one third of benchmark organizations single-source more than 60% of their critical supplies or raw materials. This procurement approach enables companies to negotiate low supply prices – but it places significant risk on the overall enterprise in the event of supply disruption.

SAMPLE DATA SLIDE: “Single Sourcing Is Capital-Efficient but High-Risk”

(N=14)

% of Supplies Sole-Sourced

% o

f C

om

pan

ies

So

le-

So

urc

ing

At

Giv

en L

evel

s

11

A supply chain is only as strong as its weakest links. One business continuity best

practice is to risk rank all vendors to spotlight supply chain weaknesses that

otherwise may not be obvious.

SAMPLE BEST PRACTICE: “Risk Rank Vendors to Spotlight

Supply Chain Weak Links”

BUSINESS CONTINUITY

INSIGHT:

• Risk rank your suppliers.

•Assess supply history for

past disruptions.

• Are they a sole-source

supplier?

• Do they provide a strategic

part or material?

• Do they possess patents or

proprietary processes?

“We have several parallel paths, one of

which is vendor management … which I

call the Achilles’ heel of our business

continuity our reliance on IT and our

suppliers. So we’re working with strategic

sourcing to risk-rank our suppliers . . . and

based on that we’re going to look at what

are our options? Do we get another vendor

in place? If they’re our single-source, do

we stockpile additional material, and if so,

where -- our warehouse? Their warehouse?

-- Business Continuity Director

Lessons Learned Observation

12

All locations have some level of risk associated with their geography and frequency of storms, brownouts, or other natural disasters. Savvy business continuity groups assess geographic risk for every facility and major supplier.

SAMPLE INSIGHT:

“Geographic Risk Is Key Dimension of Facility/Vendor Rankings”

BUSINESS CONTINUITY

INSIGHT:

• Physical location is a part

of risk ranking for vendors

and your own facilities.

• Natural disasters common

to a geography create risk

for your supply chain.

• Avoid sole-source

suppliers in locations with

special natural risks.

“Location is part of risk analysis. For example, we’re

required by law to test (our medicines) on animals prior to

providing the drugs to the human population. Some of the

areas or farms where we get these animals are in locations

that are very desirable. If you look into the future, say five

years, then there’s a good chance that that farm will be sold

to a developer which would obviously impact our supply.

That is part of the risk ranking. So that led to us looking to

find an alternate supplier because we’re foreseeing (the

farm supplier) in the next three, four, five years going away.

“Another example is we have some sole-suppliers in the

L.A. basin, which based on the threats of brownout,

blackout, wildfires and earthquakes, we’re not good with

those as sole suppliers.. . .Because of all the natural

disasters of the world, the physical location of the facilities

is a part of that risk ranking.”

-- Associate Director of EHS & Business Continuity

Lessons Learned Observation

13

Q20 To what extent is your IT group a part of your business continuity

planning?

(N=17)

Completely siloed

and segregated

from business

continuity plan 18%

Integrated when and

where necessary (or

likely to be involved)

29%

53%

Fully integrated

into business

continuity plan

SAMPLE DATA SLIDE: “IT Integration Empowers Overall Business Continuity” The majority of participating companies reported having IT fully or partially involved in their

Business Continuity planning. Nearly 20% of companies evidence some vulnerability from non-

integrated siloes. Also, general lack of preparation to prevent cyber threats suggest additional

improvement opportunities across the IT frontier.

14

SAMPLE DATA SLIDE: “Capital Funding a Key Barometer of the Importance Placed on Business Continuity”

Q6 What percentage of your capital expense plan spend is devoted to business

continuity projects and investments?

Data Trends

More than 3/4 of

participants from Large

and Small Healthcare

companies reported

dedicating less than

10% of their capital

expense plan to

business continuity

projects and

investments

Nearly 90% of companies dedicate less than 10% of their overall capital expense plan

budget on business continuity programs to sustain the enterprise. On average, study

participants dedicate 4.6 percent of their capital expense plan for Business Continuity.

(N=20)

15

Q34 Please rate the current or predicted level of impact each of the following new

technologies will have in helping to improve reliability:

SAMPLE DATA SLIDE: “New Technologies Offer Promise for Managing Risk” A plethora of cutting edge technologies and trends are proving critical to improving

business reliability, including risk management systems and improved bandwidth.

Companies in the LHC segment are highly active in using each of these technologies.

(N=14)

(not used)

16

Our company is an internationally recognized thought leader in the field of best practice benchmarking®. We

conduct research and consulting based on the simple yet profound principle that organizations can chart a

course to superior economic performance by leveraging the best business practices, operating tactics and

winning strategies of world-class companies.

Best Practices, LLC

6350 Quadrangle Drive, Suite 200, Chapel Hill, NC 27517

919-403-0251

best@best-in-class.com

www.best-in-class.com

Learn More About Our Company