Prioritizing Risk: Sustaining Life Science Compliance Programs During the COVID-19 Crisis

The spread of COVID-19 has disrupted business operations at companies of all sizes (and most industry sectors), with life science corporations experiencing among the more severe impacts. As the COVID-19 pandemic continues on its path of havoc, and businesses confront increased uncertainty (for example, in workforce and fiscal concerns), legal and compliance officers at life sciences companies are grappling with myriad compliance issues and unique program monitoring challenges. Maintaining functionality, corporate integrity and compliance program oversight, while continuing to meet regulatory expectations, are issues compliance professionals are now dealing with daily.

Sustaining compliance program functionality, for example, in the throes of a widespread global pandemic, presents unique challenges for life science entities, many of which are highly regulated and beholden to a litany of government requirements. While it is impossible to predict the various obstacles that will make compliance program oversight increasingly difficult, the key is to focus on risk management. By monitoring risk and bringing consistent attention to the core principles of compliance, life science companies can preserve adequate program robustness and uphold regulatory responsibilities and reporting requirements.

The Challenge

With many employees working remotely during the pandemic, it is more difficult to monitor their actions, including those activities that could present severe compliance risk to life science companies. Even with modern oversight, monitoring, and auditing technology, this workforce separation creates gaps in communication and invites greater potential for aberrant (and even illegal) activities. Legal and compliance officers and their teams may not have opportunities for typical in-person communications and regular updates from various group leaders. Moreover, with so much new information surfacing daily as a result of COVID-19, it can be exasperating to decide where to focus compliance resources and attention.

A Proactive Approach

Despite these hurdles, preserving compliance program stoutness and mitigating the possibility of issues with (or negative attention from) relevant agencies and regulators is possible in the COVID-19 environment. It requires a proactive, communicative, and risk-adjusted approach, particularly in the life sciences sector, where a lot of attention is currently concentrated by the government, and where compliance remains essential. Legal and compliance departments at life science companies can manage the various elements of an effective program, even in a global crisis, by adhering to core compliance principles, namely leadership, communication, risk assessment, policies and controls, training, and oversight.

Attending to Core Program Components While in Crisis

Leadership

Chief Executive Officers, Chief Financial Officers, General Counsels, Chief Compliance Officers, and other members of the C-Suite in the corporate leadership group, in coordination with the board (where one exists), should take the lead in reinforcing the critical importance of compliance at life science entities during the COVID-19 pandemic. Messaging that reinforces adherence to compliance requirements must come from the top and align with the compliance department’s priorities and goals.

Indeed, in times like these, one of the most valuable practices life-science leadership can adopt is to ensure that they keep abreast of real-time developments with respect to the pandemic, and likewise adapt company culture to the changing industry landscape. This can be demanding because, among other things, information is evolving in real time. Ultimately, in order to protect the company, leadership must be aware of germane new legislation, executive orders, ordinances, and guidance proposed and implemented at the federal, state, and local levels to evaluate risk and craft tailored risk mitigation plans.

Compliance officers, in particular, should stay attuned, for example, to the Department of Health and Human Services (HHS) as well as the Centers for Disease Control and Prevention (CDC) and the National Institutes of Health (NIH), among other pertinent agencies disseminating key information, to ensure that key stakeholders and managers have the most current compliance information to disseminate to employees.

Communication

With potential disruptions to supply chains, reduced workforce communications, delayed project management guidance, technological issues affecting employees operating from home, diminished access to information and materials, and other changes to the work environment, life science employees will justifiably have countless questions and concerns for leadership. Compliance directors can help manage inquiries from employees relating to these new, everyday hitches by making themselves available to answer employee questions, even more so than normal. While this may seem paradoxical on its face during a national emergency, modern technology, including vast improvements in video conferencing, can facilitate the regular intake of individual employee inquiries, to ensure that consistent messaging on compliance strategy and faithful program observance continues across the organization.

Risk Assessment

For most life science companies, risk assessment is the most critical of the core compliance program components during a global crisis. In light of this, legal and compliance officers should evaluate evolving risk on a proactive, regular basis and allocate resources accordingly. Indeed, compliance professionals should take the time to assess their most pertinent risks on a daily basis and appropriately distribute resources. Typically, this type of assessment may be initiated on a less frequent basis. But considering the rapidly evolving nature of the COVID-19 pandemic, compliance teams need real-time information, and must work together to triage their compliance efforts, particularly for concerns exacerbated by COVID-19.

For example, with employees working remotely, many companies are facing additional security threats from home networks, along with cybersecurity risks and a greater potential for deviant conduct with (or to) company equipment. Compliance departments should, among other things, collaborate with IT leaders to ensure that all corporate-related connections are secure. This is especially important for life sciences companies, where confidential and proprietary information is often a prominent part of the business enterprise and can be more easily compromised on an employee’s home network.

Further, it is important to ensure that supply chains are not interrupted and, in cases in which they are, maintain contingency plans to minimize disruptions. For instance, China produces roughly 90 percent of pharmaceutical ingredients used by the life science industry. The impact of COVID-19 on China has created a domino effect of sorts, disturbing supply chains worldwide. The actualized impact of any potential supply chain disruption may not be felt until the coming months, making it vital for life science companies to understand their current supply chain and have procedures in place to allay any interruptions or shortages.

Recently the U.S. Food and Drug Administration (FDA) updated its policies to address medical and drug supply shortages during the COVID-19 pandemic. In an effort to combat drug shortages, for example, the FDA revised its list of extended-use dates, allowing some products to be used beyond certain labeled expirations. Consequently, by closely monitoring the risk of supply chain issues during the crisis, life science companies can position themselves to notify the FDA of anticipated shortages. And compliance professionals are particularly adept at evaluating risk, which empowers them during a crisis, to make reasonable efforts to ensure that vital corporate concerns, such as product supply, are not compromised.

Policies and Controls

In a crisis of this magnitude, life science compliance teams must also take the requisite time to locate, organize, and make existing policies and procedures conspicuous. Managers and employees will need access to guidance quickly during uncertain times, and having key policies and procedures at arm’s length will help save time and eliminate ambiguity when making decisions. Now is also a good time for compliance departments to reevaluate by setting forth new guidance and updated policies and controls to reflect the current environment. Fresh policies and procedures can also help outmaneuver the potential negative consequences of COVID-19, such as sick leave issues, employee safety, and novel employment-related rules promulgated by federal and state lawmakers. Finally, any new policies or procedures – even if temporary for COVID-19 – must be properly disseminated to all applicable employees and departments.

Training

Also, importantly, with the constantly developing nature of COVID-19, it may be tempting to allow existing life science training programs to fall by the wayside. Compliance leaders, however, must find ways to keep employees engaged in training. Many companies today, for instance, have adopted e-learning programs employees can complete remotely. Using such technology will not only facilitate ongoing and essential training for management and employees, it can also serve as a communication vessel for compliance leaders to remind employees that, despite the COVID-19 outbreak, regulators expect training programs to continue.

Monitoring and Oversight

Monitoring employee activity is more difficult when the workforce is geographically fragmented, which dictates that life science compliance teams be more vigilant in their compliance program oversight efforts. Legal and/or compliance officers should check in with the board, leadership, and employees regularly, and use secure email, audio, and video technology to create regular touchpoints, virtual or otherwise, to check that stakeholders, from the board room to the mail room, are adhering to company policies and continuing to follow compliance program requirements and expectations. Teaming with internal audit professionals and leaders from other business areas of the corporation can make this task much less daunting.

Managing Current CIA or Related Requirements

Adding to the above demands, life science companies currently beholden to Corporate Integrity Agreements (CIAs) from HHS, or enhanced compliance program obligations from any number of other agencies will, for the most part, be expected to maintain those responsibilities. If, for some reason relating to the pandemic, compliance programs face financial, resourcing, or related challenges making certain heightened compliance requirements either impractical or, perhaps, impossible, legal and compliance leaders are responsible for proactively notifying the appropriate government entity to request, through suitable channels, a temporary relaxing of such obligations.

Maintaining Program Robustness During COVID-19

With the continued uncertainty of the coronavirus emergency, compliance teams at life science companies must be prepared for the murkiness that lies ahead for business operations and program devotion. While the spread of COVID-19 certainly presents challenges, maintaining compliance program efficacy is achievable. Compliance teams can also take advantage of the pandemic-related complications to evaluate what strategies work, which may assist in making their programs more efficient in a post-COVID-19 world. 

Ultimately, life science companies that successfully navigate COVID-19’s unprecedented landscape will be those that proactively attend to the essential compliance program components discussed above, prioritize pressing compliance risks for timely remediation, and strategically allocate resources. Adhering to certain best practices tailored to the demands of a national emergency, including the following, which are mined from compliance program fundamentals, can serve as a guiding light in the inherent darkness of a pandemic:

1. Develop a plan to provide cohesive and consistent messaging to leadership and employees relating to both the upkeep and any necessary adjustments to your compliance program during the COVID-19 outbreak.
2. Stay proactively apprised of the continuous changes to relevant federal and state laws, regulations, legislation, and executive orders inspired by the pandemic.
3. Reassess pertinent operational, business, and compliance risks on a more frequent (preferably, daily) basis, and reallocate compliance program resources accordingly.
4. As a compliance professional, be accessible and available to answer employee and corporate leadership inquiries by leveraging audio and video technology.
5. Use lessons learned during the crisis to begin to develop longer-term compliance program improvements to help ensure that the compromising of vital business practices will be mitigated in the event of a future national emergency.
6. Ensure that all relevant policies, procedures, and controls are readily accessible, even in the wake of COVID-19, so that employees can quickly access guidance.
7. Continue to require that employees remain active in the company’s training program, so existing training regimens do not lapse.
8. Plan and facilitate regular touch points with executives, the board, and employees using secure email, audio, and video technology to monitor compliance program adherence and remind appropriate leaders of required compliance resources.
9. Skillfully team with internal audit professionals and trusted leaders from other business units in the corporation to assist in overseeing the compliance program.
10. Continue to observe CIA obligations, or enhanced compliance program requirements from other government bodies; and if, due to COVID-19 complications, this becomes unmanageable, promptly notify the proper authorities.