RISK MANAGEMENT

Management Issues: RISK MANAGEMENT

ISTOCKPHOTO.COM

Protect Investments by Managing Risk

Learn how to spot the storms ahead

Drug development is risky. Only one of every 10,000 potential medicines investigated by research-based pharmaceutical companies in the United States is approved for patient use, according to the Pharmaceutical Research and Manufacturers of America. Given an estimated $60 billion spent by the drug industry on research and development in 2007, it is clear that drug development is a high stakes business in need of risk management.¹

A logical starting point for any organization is basic project-level risk management. The outputs are raw materials for portfolio and, in turn, corporate risk management efforts. Project risk is an uncertain event that may impact project objectives either positively or negatively. For example, highly utilized non-clinical resources may become unavailable because of the demands of higher priority projects. This situation alone can throw off the project timeline and budget. It is possible, however, for project teams to identify, analyze, plan, and monitor risks, thereby managing them proactively.

The Risk Management Process

The Project Management Institute (PMI; Newtown Square, Pa.) outlines several methods designed to manage risks that are potentially deleterious to projects. Best practice suggests that the initial risk assessment should be done during a project planning meeting in which the team has defined its deliverables and key activities and has agreed to at least a preliminary schedule.

At this point, the key deliverables and work activities are shown in a Work Breakdown Structure (WBS) chart, which represents the full scope of the project (see Figure 1, below). According to PMI, the WBS is "a deliverable-oriented hierarchical decomposition of the work to be executed by the project team to accomplish the project objectives and create the required deliverables."¹ Its purpose is to delineate all the tasks that comprise the project. The lowest level of the WBS-the point at which you can go no lower without micromanaging the effort-is referred to as the work package. These items not only go into the master schedule but are also the primary places to look for risk.

While looking at each item in the WBS individually, the project team should ask: "What can go wrong? What risk is prevalent in this task? What is the cause of this risk?" The best way to identify true risks is to use a cause-risk-effect statement. An example of this is the statement "Because the container is made of faulty material it might leak, preventing us from receiving a regulatory approval." The fact that the container is made of faulty material is the cause, the risk is that the container might leak, and the effect is failure to obtain regulatory approval.

In reviewing tasks, the team should not limit itself to identifying only technical risks, such as product or process risks, but should also note project risks (i.e., do we have the right skills and resources to fulfill the task?), commercial risks, and environmental risks.

Best practice suggests that the initial risk assessment should be done during a project planning meeting in which the team has defined its deliverables and key activities and has agreed to at least a preliminary schedule.

Prioritizing Risks

The team can also set up the probability of a risk occurring based on historical context and its own estimate as to how likely the risk is. For instance, if clinical trials will be conducted in a particular region, has there been previous experience there? Were there challenges, such as not reaching the right rate of enrollment, associated with executing the trials? What was the impact of the challenges? Is there a risk that the same challenges might recur?

Next, the team determines the potential impact of the risk on the project. Would the impact to the project be minimal? That is, could the project survive the risk with minimal impact on its objectives? Or would the impact be so great that it would affect the schedule, budget, or quality in profound ways? If your project schedule slips by a quarter, the risk of not being first-to-market is low, but associated advantages may diminish. On the other hand, if the schedule slips by a year, a first-to-market position may be forfeited and the business outcome dramatically reduced.

It'S a good idea is to generate a matrix that details the level of probability and impact of each risk and compares them (see Figure 2, p. 52). More detail is needed to show the true impact of a given risk, which should be quantified in relation to cost, schedule, and quality, considering, for example, exactly how long a delay might result. Finally, the team should define triggers for each risk, along with appropriate responses.

Figure 1. Sample of a partial work breakdown structure chart

Figure 2. Probability/impact matrix

The response is the action that will be taken to mitigate or avoid the risk. Responses should be incorporated into the project schedule as tasks to be completed. For example, it may be necessary to train a staff member or consultant in case of the loss of a key team member. For those risks that are not actively mitigated or avoided, contingency plans may be put in place. For instance, if enrollment rates have typically been low in clinical trials, an up-front contingency would include identification of secondary sites or, possibly, other regions to be included in the trials if a certain percentage of enrollment is not reached by a defined date.

The team can set up the probability of a risk occurring based on historical context and its own estimate as to how likely it is to occur. For instance, if clinical trials will be conducted in a particular region, has there been a previous experience there?

The results of the team'S work should be documented and maintained in a risk register. At weekly meetings, team members can be required to report on the status of each risk and whether any actions have had to be taken. These meetings can also be used to identify any new risks that may have arisen or to retire any that have been closed.

One challenge to risk management is getting the teams to revisit their schedule, business case, and development approach based on the risk scenarios. As time goes on and the team members become more expert in their use of schedule and risk, they can contemplate using even more sophisticated tools, like a Monte Carlos analysis. Monte Carlos allows the team to simulate the project multiple times, looking for key areas of risk, in an effort to determine the likelihood of the project actually ending on its predicted date.

Quality Risks Vs. Project Risks

The International Conference on Harmonisation quality risk management guideline focuses on product risks related to patient safety. It advises, for example, that product quality be maintained throughout the product life cycle so that the attributes that are important to the quality of the drug product remain consistent with those used in the clinical studies. The high quality of the drug product should also be ensured by providing a proactive means to identify and control potential quality issues during development and manufacturing.

These considerations are vital. To ensure a successful product launch, however, risk management activities in drug development should extend beyond impact on the quality objectives alone. A simple way to accomplish this goal is to ensure that the risk management process incorporates all of the cross-functional work activities. By doing this, the project team adds rigor to its quality risk management efforts, while going beyond quality risk to understand all factors that might interfere with a successful launch.

By agreeing to a standard risk management approach up front, teams can assess risk more consistently and can more easily spot risks across other projects. Centralizing project risk management also allows for effective communication of risk and uncertainty, an important benefit given the fact that most risks affect multiple project objectives and outcomes.

In light of the cost of bringing a new drug to market-more than $1 billion-a systematic process that consistently meets an organization'S needs and supports risk management throughout a project is critical to its success. Although basic risk management requires adherence to a discipline, it can be done anywhere, at any time and can be counted on to yield predictable outcomes in a volatile environment. �

McKee and Stewart are senior consultants with Action for Results, Inc. Reach them at or (978) 824-0400, ext. 104.

REFERENCES

1. Project Management Institute. A Guide to the Project Management Body of Knowledge. 3rd ed. Newtown Square, Pa.: PMI Publications; 2004:112.