Requirement

Assist a large and growing pharmaceutical company in developing a comprehensive Third-Party Risk Management (TPRM) program within their global supply chain.

Issues

With multiple product lines - including over-the-counter and prescription drugs - a fast growing pharmaceutical company was having immense challenges in trying to successfully monitor their large supplier base.

Senior leadership wanted a plan - and quickly - in designing and executing a TPRM program for all of their suppliers in the organization’s supply chain.

Additional issues for the client

No Experience with Vendor Management: The client had no real familiarity with the concept of TPRM, as such, no meaningful monitoring was being performed on their supplier base.

No Compliance Officer: The client had no official compliance officer, therefore, no real ownership existed in terms of managing, or even beginning to conceptualize, what an actual TPRM program meant. As a result, the CFO was tasked with the job, but had no experience with TPRM.

Missing Compliance Culture: Regulatory compliance was never high on the list in terms of organizational importance. Additionally, management often questioned why such a heavy investment in time and money was necessary.

Solution

Centris deployed a team of TPRM experts that successfully accomplished the following:

• Defined project scope and client participation.
• Identified all control gaps and recommendations for remediation.
• Completely reviewed all current TPRM measures and began authoring new TPRM specific policies and procedures.
• Established contact and working relationships with all in-scope third-party vendors to begin the all-important task of identifying all external suppliers.

Outcome

• Built and deployed an extensive TPRM program - complete with policies, procedures, and processes consisting of a mixture of automated and manual controls.
• Created a true culture of compliance where employees now understand and value information security, cybersecurity, and data privacy.
• Implemented a continuous monitoring program for ensuring controls are properly monitored long after the consultants are gone.

Duration: 5.5 Months