· 2012. 10. 2. · Title: Slide 1 Author: Falbo, Giuseppe Created Date: 10/2/2012 7:35:58 AM

International Experience on How Pharmaceutical Companies Handle Misconduct

Giuseppe FalboNovartis Business Practices Officer

(Asia, Middle East, Africa, Latin America)Sao Paulo, 3 October 2012

Content

1. Compliance Programs

2. Misconduct Handling

3. How Novartis handles misconduct

4. Help in ensuring Compliance

2 | Giuseppe Falbo - International Experience on How Pharmaceutical Companies Handle Misconduct

Compliance Programs

All companies have a strong Compliance program in place:

Tone from the Top

Policies, Guidelines, SOPs

Training, Communication and Educational Programs

Strong Internal Controls

Relatively easy access to the Compliance Officer

Anonymous reporting systems



2. Misconduct Handling




Different ways of handling misconduct

Pharmaceutical companies operating internationally have different approaches with regards to misconduct handling:

Clear Policies and/or SOP in place for misconduct handling

Consolidation of all allegations of misconduct at Corporate Level

Mandatory consultation between different functions

Guidelines on who and how to investigate depending on the matter reported

Vs.

Handling left to the judgment of the local management5 | Giuseppe Falbo - International Experience on How Pharmaceutical Companies Handle Misconduct

Some examples

All cases are reported to a dedicated office in Compliance. A staff of attorneys review the allegations and determine how to proceed.

Only cases related to Finance, Sales and Marketing must be reported to a dedicated Compliance Director. The latter discusses the case with a Legal Director and with the Head of Investigations (Security), they jointly determine the course of action, monitor the progress of the investigation (in FCPA and/or big cases), send the report to the relevant management and finally make sure that a remedial action plan is in place.


Some examples (cont.)

All misconduct, with the exception of Employee Relations matters, must be reported to a dedicated office in Compliance. If necessary they consult with other relevant functions to determine how to handle the case. Guidelines are in place to determine whom to assign the investigation to.

Whistleblowers can directly approach the Audit Committee, which determines how to handle their case. Investigations are generally assigned to Corporate Security. Written SOPs are in place on how to assign and how to conduct the investigation.



Misconduct is usually reported to Legal, Compliance or HR locally. They are responsible for rating the risk involved. If of low risk they would decide who would be best suited to investigate the allegations. If of higher risk and related to fraud or corruption, they would have an established timeframe in which to report it to Internal Audit. The latter would be responsible for the investigation and reporting to the Corporate Audit Committee.

Infringements of company policies are investigated by the local Compliance Officer and later reported to the Head Office and filed in a database. Serious cases are immediately reported and handled by Group Compliance.



All cases reported centrally, minor cases handled locally, investigation assigned only to employees outside the country or to consultants. If there is the suspicion of a systemic problem, the investigation is assigned to a law firm.

Serious breaches are reported to the relevant Regional management areas and, in the USA, a sanitized summary of these findings are posted on the internal website

All cases reported to the General Manager in the country are left to his/her discretion

Refer most of the cases to Security or to the local management with the aim of resolving the problem

| Giuseppe Falbo - International Experience on How Pharmaceutical Companies Handle Misconduct9

Centralized handling Vs. local

The local management is the best resource the company has to understand the issues on the field and can respond more quickly to them. However a central office responsible for handling misconduct, if appropriately staffed and well resourced can guarantee:

Independent assessment and investigation Vs. resistance to respond to and/or escalation of an issue

Professional approach Vs. inadequate skills and/or experience

Maintain confidentiality Vs. fear of retaliation


Centralized handling Vs. local (cont.)

Identify trends of misconduct and/or best practices across countries/divisions Vs. limited view

Ensure appropriate resolution Vs. potentially superficial approach

Maintain consistency in sanctions across all areas of the company



2. Misconduct handling




Novartis Business Practices Office (BPO)

Employees are required to report any instance of possible misconduct of which they become aware directly to the BPO or to their line manager, Compliance, HR, Legal Department, Corporate Security. Any of the above mentioned individuals receiving a report of possible misconduct, must report such information to the BPO without further disseminating the information

The process covers all employees and third parties acting on behalf of Novartis

The BPO, established in 2005, is part of Corporate Security and reports to the Chairman


Regional approach


Easily accessible

The BPO can be reached via:• Email• Phone• Fax• Mail• Novartis phone and web based Alertlines are available worldwide• In person


Assessment

Every allegation received is carefully reviewed, sometimes in conjunction with the other functions, to determine:• If there are reasonable reasons to believe that a law/ policy has been

violated• The credibility of the source• If there is enough information to start a meaningful investigation• The seriousness of the information received

A prompt response is provided to the reporters

In cases where immediate action is needed the Business is immediately informed

If necessary “Non-BPO” matters are shared with the appropriate management


Investigation

Preliminary enquiries might be necessary to determine that the report is not malicious and/or baseless

The BPO assigns the case to the most suitable investigator

Only the BPO can authorize an investigation into misconduct and assign investigative responsibility to the most competent function

Consult with Legal in case of alleged violations of anti corruption laws to determine the most appropriate methods of handling them

Special attention is dedicated to potential violations of US Securities laws


Resolution and Lessons Learned

Ensures that the relevant area of management receives the investigation report

Protects the identity of the reporter and other people involved in the investigation

Monitors and ensures consistency of remediation

Investigates cases of retaliation

Provides Compliance with material for “lessons learned” to understand why a breach has occurred and consequently work on preventing possible recurrence

When possible, feedback is provided to the complainant18 | Giuseppe Falbo - International Experience on How Pharmaceutical Companies Handle Misconduct

Documentation and Reporting

Accurate and consistent record-keeping is ensured for all the reported cases, the entire process is appropriately documented and filed in accordance with applicable laws

Regular updates to the Audit and Compliance Committee (quarterly), Finance Committee (monthly) and other senior management (ad hoc)

This simple process provides the required corporate oversight, transparency, consistency and accountability



2. Misconduct handling




BPO is an integral part of the Compliance framework


BPO & the new Code of Conduct


Important part of the Compliance framework

The culture of Compliance in organizations is also measured by how free employees are to speak upA “healthy misconduct reporting”, also of minor cases, helps in preventing serious issuesEarly identification of problems and professional investigations help in mitigating the consequences of wrongdoing, especially in the current more vigorous enforcement environmentThe BPO is part of the Group Misconduct Prevention Group, headed by the Chief Compliance OfficerEmployees are encouraged to contact the BPO


BPO Awareness Campaign

BPO FilmCEO VideoDetails of the BPO are provided at on-boarding of new staff, Town Hall meetings, Global Compliance/ HR/ Legal meetings, etc.Intranet siteEducational material (posters, cards, case studies, etc.)BPO Logo


BPO cases 2009 – 2012


Increase of cases

Assessed that growth is due to increased awareness/compliance and trust in the process

All associates have access to policy, rationale and multiple reporting methodologies

The majority of the cases are of low risk/low impact and mainly due to individual wrongdoing

The BPO process is widely accepted by associates as reliable, trusted and an effective program


DON’T WAIT FOR THE BIG PROBLEM TO HAPPEN ...

... IDENTIFY AND PROPERLY ACT ON IT ....

Thank you!

Giuseppe (Pino) Falbo


Documents

· 2012. 10. 2. · Title: Slide 1 Author: Falbo, Giuseppe Created Date: 10/2/2012 7:35:58 AM