TPRM - Pharmaceutical Case Study
Requirement
Assist a large and growing pharmaceutical company in developing a comprehensive Third-Party Risk Management (TPRM) program within their global supply chain.
Issues
With multiple product lines - including over-the-counter and prescription drugs - a fast growing pharmaceutical company was having immense challenges in trying to successfully monitor their large supplier base.
Senior leadership wanted a plan - and quickly - in designing and executing a TPRM program for all of their suppliers in the organization’s supply chain.
Additional issues for the client
No Experience with Vendor Management: The client had no real familiarity with the concept of TPRM, as such, no meaningful monitoring was being performed on their supplier base.
No Compliance Officer: The client had no official compliance officer, therefore, no real ownership existed in terms of managing, or even beginning to conceptualize, what an actual TPRM program meant. As a result, the CFO was tasked with the job, but had no experience with TPRM.
Missing Compliance Culture: Regulatory compliance was never high on the list in terms of organizational importance. Additionally, management often questioned why such a heavy investment in time and money was necessary.
Solution
Centris deployed a team of TPRM experts that successfully accomplished the following:
- Defined project scope and client participation.
- Identified all control gaps and recommendations for remediation.
- Completely reviewed all current TPRM measures and began authoring new TPRM specific policies and procedures.
- Established contact and working relationships with all in-scope third-party vendors to begin the all-important task of identifying all external suppliers.
Outcome
- Built and deployed an extensive TPRM program - complete with policies, procedures, and processes consisting of a mixture of automated and manual controls.
- Created a true culture of compliance where employees now understand and value information security, cybersecurity, and data privacy.
- Implemented a continuous monitoring program for ensuring controls are properly monitored long after the consultants are gone.