Development & Deployment of a Risk Based Compliance Turnaround Strategy John R. Pinion II Genentech, Inc. The FDA Regulatory and Compliance Symposium August 24 – 26, 2005

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 2 Agenda 1.Objectives 2.Keys to Success 3.Risk Triggers 4.Getting Started / Expectations 5.Business Assessment 6.Risk Assessment 7.Risk Control / Mitigation 8.Communication and Timing 9.Execution 10.Measurement / Effectiveness Review 11.Questions

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 3 Objectives Reduce Overall Patient Risk Reduce Compliance Risk Improve Overall Business Performance Focus Resources Improve Customer Satisfaction Improve Operating Mechanisms & Management Visibility Reset Performance Expectations

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 4 Keys to Success 1.Senior Management Recognition/Understanding of Issues 2.Comprehensive Evaluation / Assessment of Business 3.Effective Analysis of the Results of the Business Evaluation (risk / gaps) 4.Review of Organization and Talent 5.Development of a Risk Analysis / Risk Management 6.Creation of a Progress Measurement Approach 7.Senior Management Acceptance of Approach 8.Broad Communication of Need for Change and Action Plan 9.Adequate Resources to Execute Strategy 10.Implementation of Routine Senior Management Review Process 11.Effectiveness Review of Mitigation Actions

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 5 Risk Triggers Change in CEO & Other Senior Management Changes Restructuring / Mergers Products –New Area –New Molecular Entity RIF –Process Support Staff Regulatory Agency Quality Indicators –FCAs –Complaint Trends or Product Field Performance –Lack of Procedure Maintenance to Current cGMP's

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 6 Getting Started / Expectations Define –Inputs to Be Included in the Business Assessment –Risk Analysis / Management Model (ISO 14971) –Cross Functional Risk Management Team –Outputs of Process Develop and Deploy Measurement System Identify –Risks –Mitigation Actions Verify Effectiveness of Mitigations Establish / Initiate Communication with Appropriate Agencies

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 7 Getting Started / Expectations Product Performance –FCAs –CAPAs –Complaints –Process Performance Quality Systems –8 Key Systems Business Processes Facility Design / Performance Infrastructure Talent / Organization Culture Resources –Personnel –Capital Product Performance –FCAs –CAPAs –Complaints –Process Performance Quality Systems –8 Key Systems Business Processes Facility Design / Performance Infrastructure Talent / Organization Culture Resources –Personnel –Capital Product Decisions Process Improvement Review Quality System Performance Business Process Performance Facility / Capital Decisions Organization / Talent Review Results / Decisions Legacy Issue CA/PA Operating Mechanism Decisions Progress (Score Card) Measurement Results of Effectiveness Review Product Decisions Process Improvement Review Quality System Performance Business Process Performance Facility / Capital Decisions Organization / Talent Review Results / Decisions Legacy Issue CA/PA Operating Mechanism Decisions Progress (Score Card) Measurement Results of Effectiveness Review Inputs Outputs Input Process Output Model (Example) Risk Analysis Process

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 8 Development & Deployment of a Risk Based Compliance Turnaround Strategy Getting Started/ Expectations Overview – Risk Management Process

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 9 Getting Started / Expectations Resource Commitment Long Term Efficiency Gain Following Implementation of Mitigations Resources Required Short Term to Execute Mitigations

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 10 Business Assessment Elements to Consider Compliance History / Regulatory Commitments License Status Product Performance Facility Condition / Performance (Manufacturing) Business Infrastructure Quality Systems Capital / Resource Commitment Leadership / Management Responsibility Organization Structure Talent Internal Improvement Processes Documentation Status

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 11 Risk Assessment Risk Assessment Matrix (example) Product, Process, System, etc. Gap Identified Impact of Gap Impact On Severity of Impact Probability of Occurrence Overall Risk Mitigation or Decision Mitigation Verification Overall Risk Post Mitigation Define Rating / Scoring Criteria to Help Prioritize Mitigation Actions

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 12 Risk Control / Mitigations Decisions / Actions to be Considered System Redesign Management Changes Organization Changes FCAs Process Improvements Facility Capital Improvements Retirement of Product Facility Closure / Simplification Validation Improved Documentation Improved Operating Mechanisms Employee Education CAPA Labeling Enhancements Product Improvements Regulatory Submission Updates

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 13 Communication / Timing AudienceFrequencyObjective Senior ManagementMonthly Review / Discuss Overall Level of Risk, Key Decisions Risk Management TeamWeeklyProcess / Progress / Issue Review Quality OrganizationWeeklyProcess / Progress / Issue Review Broad OrganizationMonthlyAwareness Regulatory Agencies Establish in Conjunction With Agency Update on Progress, Gain Feedback Customers / Patients As Necessary Based on Decisions Ensure Patient Safety Business Stakeholders As Necessary (Material Decisions) Meet Fiscal Requirements

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 14 Communication / Timing Time (days - example) Define Inputs to Be Included As a Part of the Business Assessment Conduct / Complete Initial Business Assessment Develop Measurement System Complete Risk Analysis Prioritize Mitigation Actions Implement ActionsVerify EffectivenessReassessment Start (Dependant of Gaps and Mitigations Needed) Communication Development & Deployment of a Risk Based Compliance Turnaround Strategy

The FDA Regulatory & Compliance Symposium Page 15 Execution Key Considerations Well Developed Plan Communication / Alignment of Organization Objective / Fact Based Measurement Employee Training & Development Prioritization Visible Management Commitment Dedicated Resources Third Party Review of Approach / Progress Forecast of Activity Commitment to Make the Difficult Decisions Verification of Effectiveness

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 16 Measurement ApproachObjective Risk Reduction TrackingRisk Analysis DocumentVerify Reduction of Risk Mitigation Action Progress Tracking Score Card Ensure Timely Implementation of Mitigation Actions Product / Process Trend DataManagement Review Confirm Effectiveness of Mitigation Actions Internal Assessment TrendsManagement Review Confirm Effectiveness of Mitigation Actions Third Party Assessment Results AD Hoc Review Confirm Effectiveness of Mitigation Actions

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 17 Measurement Mitigation Action Score Card Mitigation Person Responsible Initial Status Current Status Verification of Effectiveness Forecast Mitigation 1 Action 1 Action 2 Action 3 Mitigation 2 Action 1 Action 2 Action 3

Development & Deployment of a Risk Based Compliance Turnaround Strategy The FDA Regulatory & Compliance Symposium Page 18 Business AssessmentBusiness Assessment Risk AnalysisRisk Analysis Mitigation PlanMitigation Plan Effectiveness ReviewEffectiveness Review Business DecisionsBusiness Decisions Measurement FeedbackMeasurement Feedback 3 rd Party Feedback3 rd Party Feedback PrioritizationPrioritization Compliance EventsCompliance Events Risk Management TeamRisk Management Team Dedicated ResourcesDedicated Resources CommunicationCommunication Execution and ReviewExecution and Review Risk Reduction TrackingRisk Reduction Tracking Mitigation Score CardMitigation Score Card Management Review (Trend Data)Management Review (Trend Data) Assessment TrendsAssessment Trends Third Party Assessment ReviewThird Party Assessment Review Strategy Deployment Measurement Adjustment

Questions?? Questions??