Today’s pharma and medical device industries operate in a truly global market environment. Now, in the wake of major devastating events (such as the earthquake, tsunami, and partial nuclear meltdown in Japan last year), leading healthcare organizations have moved quickly to ensure their global supply chains and manufacturing operations are capable of sustaining sudden – and potentially ruinous – disruptions and disasters. This new Best Practices, LLC report examines how world-class companies optimize their Business Continuity and Crisis Management groups and how their response plans fare when faced with major disasters or operating disruptions. This report is designed to help companies develop an evidence-based understanding of how other companies plan, prevent, prepare and respond to threats to their supply chains and operations – both to keep employees safe and ensure continued production and long-term viability. The study includes two segments: a Large Healthcare Company segment and a Small Healthcare Company and Clinic segment. KEY TOPICS Business Continuity Group Structure & Leadership Assessing Risks & Prioritizing Response Securing Your Supply Chain to Safeguard Customers and the Company Working with Sole-Source or Strategic Suppliers Performance Metrics Creating a Business Resiliency Framework: The Next Generation Developing a Prevention Mind-set and Fast Response Using Backups & Redundancy Management Communication During a Crisis

1. Best Practices in Crisis Management & Business
Continuity for BioPharma Manufacturing and
Supply Chain Operations
Best Practices, LLC Strategic Benchmarking Research
REPORT SUMMARY
0

2. TABLE OF CONTENTS
I. Universe of Learning, p. 4-7
 Participating Companies, p. 5
 Participating Companies by Segment, p. 6
 Job Titles of Participants, p.7
II. Key Insights and Findings, p.8-19
III. Structure and Leadership, p. 20-27
IV. Emergency Response: Building Capabilities To Respond
Quickly & Effectively Throughout Your “Ecosystem,” p. 28-38
V. Assessing Risks & Prioritizing Response , p. 39-50
VI. Assembling The Tools and Techniques to Build an Integrated
Business Continuity Plan, p. 51-60
VII. Developing A Prevention Mindset and Fast Response, p. 61-66
VIII. Using Backups & Redundancy Management, p. 67-72
IX. Importance of Communication During Crisis, p. 73-79
1

3. TABLE OF CONTENTS
XI. Securing Your Supply Chain To Safeguard Customers
and the Company, p. 80-86
XII. Working With Sole-Source or Strategic Suppliers, p. 87-
94
XIII. Performance Metrics, p. 95-97
XIV. Creating A Business Resiliency Framework: The Next
Generation, p. 98-103
XV. Current Trends and Future Directions For Contingency
Planning, p. 104-106
XVI. Lessons Learned: Key Opportunities To Support
Continuous Business Continuity Improvement, p. 107-
110
XVII.About Best Practices, LLC, p. 111
2

4. List of Participating Companies
In total, 33 Business Continuity (BC) leaders from 29 national and global health care organizations
participated in this research. All study participants answered all or relevant parts of a comprehensive BC
performance benchmark assessment. In addition, selected executives provided qualitative insights
through deep-dive interviews and “lessons learned” observations.
3

5. Job Titles and Functions of Study Participants
This research accessed Business Continuity leaders across the enterprise. More than
54% of benchmark partners hold roles at the Director or Vice President levels.
Interestingly, nine out of 10 BC managers seem to hold generalist responsibilities, with
Business Continuity being just one of their job responsibilities.
•SVP Global Operations
Business Continuity and Emergency Management Leadership- Skill Sets
•VP Product Supply and Facility
•Head of Engineering, Facilities & EH&S
•Executive Director
Managers ,
•Director, Global Commercial Development 46%
•Director of Operations (2)
•Director, Supply Chain (3)
•Director Material Management (2)
•Deputy Director of Pharmacy
•Director of SC & CS Excellence
Directors or
•Associate Director - Business Improvement - Center Of Expertise Above, 54%
Manufacturing Bulk
•Associate Director, EHS & Business Continuity
•Associate Director, Compliance & Risk Management
•Associate Director, Global Artwork Management •Distribution Manager
•Team lead •Project Manager (2)
•Sr. Manufacturing Manager •Project Manager- Manufacturing
•Global HSE Consultant - BCP •Business Process Owner (2)
•Manager, Supply Chain •Automation Specialist
•Manager, US Distribution •Pack. Operator
•Logistics Manager •Energy Engineer
•Distribution Manager 4

6. Framework for Study Insights, Best Practices, & Pitfalls
The performance benchmark and field research have harvested scores of insights and
observations. They have been organized into the following executive summary framework
for discussion and planning purposes.
8. Business Resilience Is
1. BCP Is A Young Function
Next Frontier of BCP
7. Secure The Value Chain: 2. Balance Centralization &
Supply, Develop, Distribute Insights, Fast Field Response
Best Practices,
6. Cultivate A Pitfalls 3. Train & Drill For
Prevention Mindset Fast Emergency
& Capabilities Response
4. Planning Paradox:
5. Develop Risk Assessment
Capabilities For the Enterprise Plans Are Useless;
Planning Is Priceless
5

7. SAMPLE KEY INSIGHTS:
“Train & Drill for Fast Emergency Response”
 Emergency Response Training Is Essential for Fast Response
– But Training Occurs Sporadically:
 More than 60% of companies conduct emergency response training
only once or twice a year – or not at all.
 Training frequency goes hand and hand with response effectiveness.
This seems an Achilles’ heel for many companies.
 Less than 1/3 of companies train monthly or quarterly.
 Business Continuity Mastery Comes through Practice Drilling:
 Frequent training drills are one proven way to prepare for “high-impact,
low-frequency events.” Conduct regular practice drills to prepare the
organization for the unlikely.
 The act of training ultimately becomes more important than the type of
crisis for which one prepares.
6

8. SAMPLE DATA SLIDE:
“Majority of Companies Give Themselves Mediocre Scores for Fast Emergency
Response”
General response time assessments are poor when companies are asked to grade
themselves. More than half of all companies score themselves as “mediocre” for fire,
evacuation, return-to-production, and communication response times.
Q29 Based on practice drills and/or actual emergency events, what is your
current level of performance for the following response types?
Exemplary response time (performance exceeds response time goals)
Mediocre response time (performance meets response time goals)
Fire response 47% 40%
Evacuation response (of employees,
47% 40%
contractors, vendors, customers)
Return-to-full-production response 47% 47%
Communication response (internal, external) 27% 47%
(N=15)
7

9. SAMPLE DATA SLIDE:
“Emergency Response Training Occurs Only Sporadically”
More than 60% of all participants reported conducting emergency response training once or twice a year –
or not at all. Training frequency often goes hand and hand with response effectiveness. It appears this
may be an Achilles’ heel for many companies. In contrast, less than 1/3 of companies train monthly or
quarterly.
Q7 How frequently do you conduct emergency response training - as
contrasted with actual drills - throughout for your key operations groups?
4%
Monthly
Data Trends Quarterly 24%
2/3 of partici-
pants from LHC 36%
Annually
conduct
emergency 16%
Semi-annually
response training
less than 2 times
a year, or not at Other 4%
all. The number
jumps to 80% We do not conduct any 16%
when looking at training exercises
SHC.
0% 20% 40%
(N=25)
8

10. SAMPLE DATA SLIDE:
“Fire Drills Most Frequently Rehearsed Emergency Response”
Aside from fire drills, most emergency responses are practiced once or twice each year – or
not at all. Hazardous waste, safety and accident response drills are the most frequently
practiced drills after fire.
Q9 Please indicate how frequently you conduct the following emergency response
drills for ensuring successful emergency management and business continuity
(N=21)
9

11. SAMPLE DATA SLIDE:
“Single Sourcing Is Capital-Efficient but High-Risk”
Almost one third of benchmark organizations single-source more than 60% of their critical
supplies or raw materials. This procurement approach enables companies to negotiate
low supply prices – but it places significant risk on the overall enterprise in the event of
supply disruption.
Q45 What percentage of your critical supplies, parts and raw materials are
single-sourced?
Sourcing At Given Levels
% of Companies Sole-
% of Supplies Sole-Sourced
(N=14)
10

12. SAMPLE BEST PRACTICE: “Risk Rank Vendors to Spotlight
Supply Chain Weak Links”
A supply chain is only as strong as its weakest links. One business continuity best
practice is to risk rank all vendors to spotlight supply chain weaknesses that
otherwise may not be obvious.
BUSINESS CONTINUITY
Lessons Learned Observation INSIGHT:
• Risk rank your suppliers.
“We have several parallel paths, one of
•Assess supply history for
which is vendor management … which I past disruptions.
call the Achilles’ heel of our business • Are they a sole-source
continuity our reliance on IT and our supplier?
suppliers. So we’re working with strategic • Do they provide a strategic
sourcing to risk-rank our suppliers . . . and part or material?
based on that we’re going to look at what • Do they possess patents or
proprietary processes?
are our options? Do we get another vendor
in place? If they’re our single-source, do
we stockpile additional material, and if so,
where -- our warehouse? Their warehouse?
-- Business Continuity Director
11

13. SAMPLE INSIGHT:
“Geographic Risk Is Key Dimension of Facility/Vendor Rankings”
All locations have some level of risk associated with their geography and frequency of
storms, brownouts, or other natural disasters. Savvy business continuity groups
assess geographic risk for every facility and major supplier.
Lessons Learned Observation BUSINESS CONTINUITY
INSIGHT:
“Location is part of risk analysis. For example, we’re
required by law to test (our medicines) on animals prior to • Physical location is a part
providing the drugs to the human population. Some of the of risk ranking for vendors
areas or farms where we get these animals are in locations and your own facilities.
that are very desirable. If you look into the future, say five • Natural disasters common
years, then there’s a good chance that that farm will be sold to a geography create risk
to a developer which would obviously impact our supply. for your supply chain.
That is part of the risk ranking. So that led to us looking to • Avoid sole-source
find an alternate supplier because we’re foreseeing (the suppliers in locations with
farm supplier) in the next three, four, five years going away. special natural risks.
“Another example is we have some sole-suppliers in the
L.A. basin, which based on the threats of brownout,
blackout, wildfires and earthquakes, we’re not good with
those as sole suppliers.. . .Because of all the natural
disasters of the world, the physical location of the facilities
is a part of that risk ranking.”
-- Associate Director of EHS & Business Continuity
12

14. SAMPLE DATA SLIDE:
“IT Integration Empowers Overall Business Continuity”
The majority of participating companies reported having IT fully or partially involved in their
Business Continuity planning. Nearly 20% of companies evidence some vulnerability from non-
integrated siloes. Also, general lack of preparation to prevent cyber threats suggest additional
improvement opportunities across the IT frontier.
Q20 To what extent is your IT group a part of your business continuity
planning?
Completely siloed
and segregated
from business
Fully integrated
continuity plan 18% into business
continuity plan
29%
53%
Integrated when and
where necessary (or
likely to be involved)
(N=17)
13

15. SAMPLE DATA SLIDE:
“Capital Funding a Key Barometer of the Importance Placed on Business Continuity”
Nearly 90% of companies dedicate less than 10% of their overall capital expense plan
budget on business continuity programs to sustain the enterprise. On average, study
participants dedicate 4.6 percent of their capital expense plan for Business Continuity.
Q6 What percentage of your capital expense plan spend is devoted to business
continuity projects and investments?
Data Trends
More than 3/4 of
participants from Large
and Small Healthcare
companies reported
dedicating less than
10% of their capital
expense plan to
business continuity
projects and
investments
(N=20)
14

16. SAMPLE DATA SLIDE:
“New Technologies Offer Promise for Managing Risk”
A plethora of cutting edge technologies and trends are proving critical to improving
business reliability, including risk management systems and improved bandwidth.
Companies in the LHC segment are highly active in using each of these technologies.
Q34 Please rate the current or predicted level of impact each of the following new
technologies will have in helping to improve reliability:
(not used)
(N=14)
15

17. Learn More About Our Company
Our company is an internationally recognized thought leader in the field of best practice benchmarking®. We
conduct research and consulting based on the simple yet profound principle that organizations can chart a
course to superior economic performance by leveraging the best business practices, operating tactics and
winning strategies of world-class companies.
Best Practices, LLC
6350 Quadrangle Drive, Suite 200, Chapel Hill, NC 27517
919-403-0251
best@best-in-class.com
www.best-in-class.com
16