Companies across sectors expect that the operational risks of the past few years are going to continue. According to a 2023 BCG survey of 759 global C-suite executives, approximately 75% of leaders consider uncertainty a key challenge. About 50% expect additional global shocks that they cannot foresee today to impact their business in 2023, while only 62% have enough certainty about their company’s mid-term outlook to make long-term investment decisions.

Biopharma and medtech companies face a particularly long list of enterprise risks, many of which existed well before COVID-19. (See Exhibit 1.) Public documents from all the top 20 biopharma and top 15 medtech companies over the past five years cite disruptions, such as shortages of important active pharmaceutical ingredients (APIs), critical material constraints, disruptions impacting the development and supply chains of new modalities, skilled-labor shortages, data and security issues, and regulatory issues. Clearly, inventory buffering and other traditional supply chain strategies that worked in the past are no longer sufficient.

Managing operational risks is especially challenging for health care companies because the industry is patient-centric and heavily regulated. Since many products have the potential to save lives, the ramifications of an operational disruption are far more serious than lost sales. At the same time, regulatory requirements, which are crucial for ensuring patient safety, can make some enterprise risks more difficult to address.

For example, if a critical material is in short supply, the company needs to find a substitute or change the product’s manufacturing process. Both options involve satisfying high-quality standards and a potentially lengthy regulatory submission and filing process.

Given the difficulty of recovering from such disruptions, increasing operational resilience is even more valuable—and urgent—for health care companies than it is for other industries. Biopharmas and medtechs must take steps at once to mitigate the potential impact of disruptions and start putting mechanisms in place to promote a faster recovery.
 

What Advanced Resilience Capabilities Look Like for Health Care Companies

According to BCG’s operational resilience survey, health care companies fall into four segments: thriving, reactive, responsive, and insulated. (See Exhibit 2.)

Of the health care companies that participated in the survey, just 6% are thriving. These elite players understand their exposure to all kinds of risks and use this understanding to manage risks proactively. As a result, they can anticipate, respond to, and absorb the impacts from disruptions in the short and long term. In our experience, these companies have three distinctive elements in common:

• Risk identification and mitigation are comprehensive and integrated. Thriving companies have visibility into potential disruptions across the value chain and monitor their potential exposure collaboratively within their organization and with CMO partners. As a result, they do not suffer from the risk management siloes that commonly occur internally and externally.
• Advanced analytics are key. Thriving firms use advanced analytics to identify and predict risks in real time. These insights enable them to design products and supply chains that are less risk-prone and better able to recover from disruptions. For example, biopharma companies can design their drugs with potential substitute materials (and suppliers) in mind and include these alternatives in their FDA dossiers.
• Responsibility for resilience is owned by the business units. All business units manage their own risks. They incorporate risk management processes into business-as-usual processes and monitor them like other key performance indicators.

The vast majority of companies—88% of those in our survey—are reactive. They have little visibility into potential risks and therefore a limited ability to anticipate them; fragmented, manually intensive, and cumbersome processes for managing the risks they already know about; and supply chains that require significant time and effort to recover from disruptions. These companies are caught in a vicious cycle: because they often operate in firefighting mode, they cannot invest in the resilience capabilities needed to mitigate disruptions in the short or long term.

Each of the other two categories, responsive and insulated, comprises only a handful of companies. Responsive organizations can manage short-term disruptions but lack the resilience capabilities in place to manage volatility over the medium and long term. Insulated firms, by contrast, can mitigate disruptions over the medium and long term but cannot recover quickly from unexpected crises.

How to Build Resilience Capabilities

There are a few companies that have not yet become thrivers but have made real strides in the journey to resilience. We’ve seen from our work with clients that this type of progress typically occurs in two steps, from reactive to responsive, and from responsive to thriving.

From Reactive to Responsive. First, companies build capabilities that enable them to manage disruptions in the short term. They develop better visibility into inventory, lead times, and other dimensions of operational performance across the E2E supply chain.

In one case, a business unit of a major biopharma company faced continual disruptions related to an insufficient supply of some key products. The organization lacked visibility into the risks this business unit faced across the E2E value chain and life cycle. Moreover, the central risk management function, which serviced the company’s various business units, was unable to address risks and disruptions effectively because of its fragmented, complex processes. The company developed a new E2E control tower approach that provides timely visibility of critical supply risks to the leadership level appropriate for handling the particular risk. As a result of these actions, the business unit team in question is now better able to address disruptions and effectively stabilize supply.

Beyond enhancing visibility, companies also invest in the capabilities needed for absorbing and recovering rapidly from disruptions. This includes scenario modeling to understand the impacts of high- and low-probability events in different types of markets and supply chain setups. Companies leverage their experience and existing data (when available) to characterize and prioritize risks according to likelihood and impact. This analysis in turn informs their investment, focus, and overall mitigation strategies.

For example, soon after the semiconductor supply crisis began in 2020, a global medical device company created a data room and control tower to enable real-time monitoring and proactive alerts of potential supply disruptions. Functional teams began holding daily meetings to review performance metrics and determine mitigation actions. And a new team, process, and playbook were set up to optimize decisions during shortages. With this data-driven approach, the company was able to redesign most of its key products or find component substitutes for them. As a result, the business minimized the impact of the supply chain disruption on patients and reduced potential revenue loss by 20% in a year.

In the final step of the transition from reactive to responsive, players improve their ability to react by leveraging advanced analytics. Many companies model different scenarios that take into account the probability of potential events according to various market and supply chain conditions. More-advanced organizations are building decision support tools that allow them to adjust product offers, production plans, and supplier actions in response to disruptions. This was exactly the approach that some leading medtech players took to mitigate the printed circuit board shortage that impacted many industries two years ago. Thanks to their decision support tools, these companies were able to maximize the utility of the available supply.

From Responsive to Thriving. Once companies can predict and manage short-term risk, they can shift their focus to building the capabilities that will allow them to recover from disruptions faster and be more resilient over the long term. Making this transition is quite challenging because the organization must ensure that the changes, such as the creation of a new network architecture, are integrated into the long-term strategy and core business processes. This requires fundamentally changing business-as-usual processes in innovation, network strategy, product supply strategy, commercialization, digital strategy, and capital investments to drive proactive risk management. Companies also need to establish clear and nimble risk escalation processes appropriate for the potential impact and timing of each risk.

At the same time, companies must make important organizational changes. They should set up a central team to define their resilience strategy, guidelines for crisis response, and standardized business processes for identifying and mitigating risks. In addition, organizations should add risk management to the responsibilities of existing operational team members. They should also embed risk management roles in core operational functions where needed.

A major biopharma player provides a good example of how this can be done. Early in the clinical development of a new asset, the company began redesigning its supply chain to accommodate that asset. The organization conducted an E2E readiness assessment to identify any major gaps in critical capabilities such as manufacturing, supply planning, sourcing, and digital. Using those findings, it designed network, sourcing, and supply strategies to ensure resilience prior to launch. This effort significantly increased confidence in the company’s ability to deliver lifesaving innovative medicines to patients, who otherwise would have limited treatment options.

Three Essential Moves for Ensuring Operational Resilience

Because business uncertainty will continue for some time, health care companies must take action now to ensure that they have the resilience capabilities needed to mitigate future disruptions. Three steps are crucial.

Understand where you stand. A company’s first move should be to determine which quadrant it falls into in the resilience matrix. A comprehensive risk assessment across each major product’s life cycle and value chain helps identify gaps in performance and capabilities. By comparing these findings with existing resilience capabilities, organizations should be able to identify which key dimensions, such as visibility and response, are currently inadequate.

Build a cohesive resilience strategy. Companies must identify the critical capabilities they need to build resilience. We have developed a holistic resilience framework to help businesses with this task. (See Exhibit 3.) To strengthen recovery capabilities, companies should improve monitoring, prediction, and crisis response. And to build the necessary capabilities to absorb the impact of disruptions, organizations should embed risk management principles into the business processes that support network design, sourcing strategy, inventory and planning, and product design. Improving enablers such as processes, talent, and digital tools will be essential for making these changes stick.

Engage the enterprise. Resilience is everyone’s responsibility. To drive this point home, we recommend that companies pilot the program in a real-world context. The change and communication effort should reach people in the organization in their own individual day-to-day work. The goal is to help employees uncover risks that might have remained hidden until a disruption occurred and the ability to serve patients was compromised.

Given the uncertainty of the current business environment, it is incumbent upon health care companies to ensure that they have robust resilience capabilities across the life cycle and value chain. As unpredictable disruptions become increasingly common, companies that have invested in resilience will not only lead the way operationally and financially—they will also be better positioned to live up to their commitment to the patients who depend on them.