1. Medical Device, Regulatory and Reimbursement Compliance Congress
Best Practices: Monitoring and Auditing
March 27, 2008
Presented by
Charles Bell| Pharmaceutical and Life Sciences- Advisory Services
Jean Sands| Pharmaceutical and Life Sciences- Advisory Services

2. Agenda Best Practices of Leading Companies
Why consider best practices?
Monitoring
Auditing
Commercial Activities for Monitoring
How Do You Start Monitoring?
Best Practice - example
Items for Consideration
A Look into what CIAs and DPAs are Requiring
Closing Statements

3. Best Practices of Leading Companies
Agenda Point 1
Best Practices of Leading Companies 1

4. Why consider best practices? - RISK
Within an environment of increased stakeholder scrutiny and expectations, leading companies constantly guard against any potential threats to business performance.
They create a framework within which all business units take responsibility for detecting obstacles to achieving performance objectives.
Aided by real-time automation, they continually monitor their internal and external environments within that framework to identify potential sources of risk early, assess those risks, and respond based on the organization’s risk tolerance.
Risk is a very real element for every company in every industry amid today’s increasingly exacting business landscape.
Companies that apply best practices excel at understanding how that risk can impede business performance. Aided by real-time automation, they continually monitor their internal and external environments to identify potential sources of risk.

5. Monitoring Best Practices of Leading Companies
The monitoring practices PwC is seeing in industry include the following actions:
Employing a disciplined approach to identifying and managing risk which seeks out innovative risk response techniques, which sometimes provide new opportunities for enhanced business performance.
Embedding risk and compliance monitoring in business processes enterprise wide to understand how various internal and external events enhance or impede the achievement of strategic objectives.
Protecting Shareholders by reporting potentially damaging information as soon as practicable after it is confirmed, companies increase their chances of circumventing the loss of credibility.

6. Monitoring Best Practices of Leading Companies Continued
The monitoring practices PwC is seeing in industry include the following actions:
Implementing sustainable remediation procedures that take disciplinary action against those who performed misconduct; recover and restore losses and other damage; and learn from an incident to improve controls and prevent recurrence.
Installing automated software to improve risk management and compliance monitoring of transactions, to apply controls in gaps between separate IT systems, and to gain access to data confined in stand-alone systems or blocked by proprietary software platforms that do not communicate well with others.

7. Auditing Best Practices of Leading Companies
At high-performing companies, the Audit function offers independent, objective analysis to evaluate and improve the effectiveness of risk management.
Based on its analytical knowledge of the business, the Audit function is positioned to partner with functional departments to consider how new company initiatives can affect the application of risk management and to take that information into account during its internal controls assessments.
Companies that position their Audit departments as strategically driven, build their audit plans on a risk-based audit schedule.
Risk-based audits use audit resources more efficiently, ensure that management and the board are sufficiently focused on key risks, and provide flexibility to adjust to shifting priorities.

8. Commercial Activities for Monitoring
Agenda Point 2
Commercial Activities for Monitoring 3

9. Commercial Activities for Monitoring
Typical compliance monitoring programs, include evaluating and enhancing monitoring processes, controls, and key performance indicators (KPIs) for the following commercial areas:
Engagement of physicians for consulting, speaking and other advisory arrangements,
Exchange of scientific information (off-label promotion),
Awarding or payment of educational, clinical, and/or investigator sponsored study research grants, and
Any component of the above-mentioned activities outsourced in whole/in part to a third party vendor.
Any relationship with healthcare professionals where value is exchanged.

10. How do you start monitoring?
Agenda Point 3
How do you start monitoring? 5

11. How do you start monitoring?
Conduct initial assessments in the selected areas, using interviews and process walkthroughs with key stakeholders to identify the current processes, risks, metrics and monitoring programs in place.
Consider identifying:
The future process, metrics and monitoring needs for each stakeholder group,
Assessing the existing infrastructure capacity (people, process, technology),
Assessing data availability and data quality,
Risk appetite and tolerance of the organization regarding the compliance risks associated with the selected activities, and
The capacity of the current incident management process to effectively manage the likely increase in the volume of issues to be resolved upon implementation of the monitoring program.

12. Best Practices – example Create a Priority Map
Review Areas (e.g. Educational Grants, Charitable Contributions) vs.
Current Monitoring & Current Auditing Activities
Potential Regulatory Exposure
IMPACT – low, medium, high
Priority Map - Obtain Overall Priority Review
Areas for Review (e.g. Educational Grants, Charitable Contributions) vs. Potential Regulatory Exposure, Frequency of Activity, Current Controls, Current Monitoring and Current Auditing
Controls = legal requirements, policies and training
Frequency of Activity
Current Controls
(e.g. Legal Requirements, Policies and Training)
PRIORITY – low, medium, high

13. Items for Consideration
Have the policies been formally drafted and communicated to the company?
Is your monitoring program fitting into global compliance effort and strategic planning?
Is cooperation among departments common?
Cross-departmental communication and coordination will be needed to reach objectives (Compliance, IT, Legal, Corporate, Commercial areas).
Data systems: isolated or connected?
Is documentation in a data accessible format for analysis of trends?

14. Items for Consideration
Is the fiscal data able to be matched with supporting documentation of Healthcare Professional activity?
Is there a defined ‘yardstick’ for measuring activity?
Process to establish fair market value (FMV) uniformity.
Documentation of business rationale for activities.
What do I do with detected compliance issues?
Compliance Department’s Incident Management Systems need to be of a capacity to handle an increased volume of investigative activity.
Do you monitor your vendor relationships?
Routine vendor audits to ensure contractual obligations are met.

15. A Look into what CIAs and DPAs are Requiring
Agenda Point 4
A Look into what CIAs and DPAs are Requiring 5

16. A Look into what CIAs are Requiring
A review of processes, policies and procedures for:
Interactions with Healthcare Professionals and Healthcare Institutions
Medical Forums
Grants (e.g. administered by Medical Affairs Department)
Auditing of Control documents:
Includes documents or electronic records, submitted by sales reps or HQ personnel to request approval for certain activities, and
Business rationale or justification forms, written contracts, attendance rosters and receipts.
Determine whether control documents exist in appropriate files
Determine whether completed and filed according to procedure
Determine whether control documents show that the procedures were followed
Merck CIA and Zimmer DPA

17. A Look into what CIAs are Requiring
Commercial Activities Audited:
Interactions with Healthcare Professionals and Healthcare Institutions,
Ad boards, expert forums, market research and fee for service,
Peer discussion groups, lectures, symposia, e-medical forums, physician facilitated interaction activities,
In office and out of office facilitated meetings, business and other meetings over meals, display over meals, and external journal clubs, and
CE/ CME grants, patient advocacy grants, and professional society grants.
Criteria to identify and select HCPs
Tracking and monitoring services of the work actually performed
Policies and procedures relating to limitations of HCP engagement for consulting arrangements, speaking engagements, etc (define occasional)
Policies and procedures related to disclosure documents
Policies and procedures for ensuring the HCP work product is actually used by the company
FMV policies
Criteria for reimbursement of meals, travel, lodging and gifts
Policies and procedures on tracking or monitoring prescribing habits (use of product) by HCP
Policies and procedures relating to the content and nature of programs (independence of programs)
The budget source of all HCP payments

18. A Look into what DPAs are Requiring
The Needs Assessment requires:
Overall assessment of company’s consulting services needs for medical, clinical, training, educational, research and development needs,
Pre-planning and robust processes for the hiring of all HCPs (Commercial and R&D),
All consulting agreements must be arranged and agreed upon by someone who does not have a sales and marketing background, and
Compliance Department must approve budget and requests for all HCP payments.

19. A Look into what DPAs are Requiring
The Needs Assessment covers:
All payments to consultants including; honoraria, fellowships, gifts, donations, charitable contributions, etc.
Companies must establish FMV processes, policies and procedures
Government reporting requirements include:
All services made available by payment, per consultant, by region and by total payments with a list of services yet to be rendered (HCP Payment tracking)
Consulting payments must not exceed $500 per hour.
If they do, an independent organization must conduct a value analysis

20. Agenda Point 5
Closing Statements 5

21. Best Practices - Overview
Employ a disciplined approach to identifying and managing risk within your organization.
Goal of managing risk vs. eliminating risk is appropriate
Embed risk and compliance monitoring throughout your organization.
Independent audit function and partner that complements business needs and shifting compliance priorities
Implement sustainable remediation procedures.
Highly ethical companies always document and act on deficiencies, no matter how seemingly insignificant
Look beyond mitigating a single incident, focus on integrating governance, risk and compliance throughout organization
Use technology to improve risk management and compliance capabilities.
The Dow Chemical Company’s Investigative Services investigates over 100 allegations a year. For every dollar spent in investigating and misconduct, the Investigative Services was reported to recover $4. SOURCE - Finance Magazine April 2003
An integrated approach to governance, risk and compliance allows a company to increase accountability, eliminate redundant activities, leverage technology, and enhance monitoring, testing and reporting capabilities.

22. Presenters/Team Members
Appendix 1
Presenters/Team Members 9

23. PwC Team Presenters Team Members Name Name
Charles Bell, Pharmaceutical and Life Sciences
Manager T: E:
Jean Sands, Pharmaceutical and Life Sciences
Senior Associate T: E:
Team Members
Name
Peter Claude, Pharmaceutical and Life Sciences
Partner T: E:
Jonathon Kellerman, Pharmaceutical and Life Sciences Partner T: E:
Brian Riewerts, Pharmaceutical and Life Sciences Global Risk & Compliance, Partner T: E: 18