Top risks in life sciences for internal audit in 2024

Financial risk is a top concern for life sciences organizations. Because of recent and current economic conditions, limited access to capital, and pricing pressures, organizations have to do more with less. Life sciences leaders need to be aware of how various financial risks could cause potential problems for their organizations and how to mitigate them.

Capital funding

The initial public offering (IPO) market slowed in 2023 and early 2024, and capital funding poses a top risk for life sciences organizations of all types and sizes as they grapple with funding based on fluctuations in the economy. Many organizations are delaying funding (or IPOs) and seeking alternative sources such as private equity. In an environment in which elevated interest rates have made it more difficult for life sciences organizations to compete for capital, private equity funds are ready to deploy the cash on their balance sheets and offer an alternative source of funding. This type of funding and approach can bring other risks to the leadership environment and can lead to possible audits regarding those items.

Life sciences organizations operate on very thin margins to keep cash flows steady so they can extend their organizational life cycle, and financial planning, budgeting, and strategy are becoming even more critical. Organizations need to examine key third-party relationships for proper payments and billing in addition to reviewing budgets more frequently. Specifically, internal audit functions need to review processes regarding clinical trial spend, U.S. Food and Drug Administration (FDA) approval time, and expected revenue to efficiently manage risks.

Next steps for internal auditors:

• Review clinical trial budgeting, spending, and compliance
• Review third-party contract compliance, billing, and payment structure
• Review financial planning and budgeting
• Review operational spending, process, disbursements, and trends

Pricing and charge-backs

As it was in 2023, drug pricing is a top risk for life sciences organizations in 2024. Scrutiny of rising prescription drug costs led to the passage of the Inflation Reduction Act of 2022 (IRA), which, among other provisions, includes policies for managing the cost of prescription drugs. Drug manufacturers have long felt considerable pricing pressure between escalating rebates extracted by pharmacy benefit managers (PBMs) to potential “double-dipping” by covered entities claiming reimbursement under Medicaid and 340B.

For products sold through wholesalers, charge-backs represent a top risk for life science organizations, and they are often one of the largest expenditures. As the volume of transactions resulting in charge-backs and related dollar value increases, so do potentially inaccurate billings from wholesalers. Life sciences organizations need to confirm that their wholesalers are operating in accordance with their contracts.

Next steps for internal auditors:

• Review third-party contract compliance, rebates, and PBM contracts
• Review financial planning and budgeting

Back to top

Life sciences leaders can better understand strategic risks by implementing or strengthening an enterprise risk management (ERM) strategy. With limited access to capital, mergers and acquisitions (M&A) might become more prevalent, and organizations might want to divest parts of their portfolios. In addition, with recent innovations in technology and science, new products might enter the market, and understanding the impact these products might have can help guide the development of a strategic response.

Identifying and managing enterprisewide risk

Identifying and managing risks helps life sciences leaders mitigate potential negative events and identify potential opportunities. A comprehensive ERM framework consolidates and improves risk reporting to better identify, quantify, and manage key risks and implement the proper controls to eliminate or reduce threats. Understanding enterprisewide risks helps executives and internal audit functions view the risk universe and develop a strategy and audit plan unique to their organizations’ specific goals and objectives.

Next steps for internal auditors:

• Review current ERM process
• Understand risk appetite of the organization
• Review internal audit approach as it relates to ERM

Mergers and acquisitions

M&A remains a viable transformation tool for life sciences organizations. Large pharmaceutical companies continue to pursue midsize biotech companies to expand business lines and services. Private equity firms are also acquiring innovative healthcare assets. With the slowdown of the IPO market, sale processes have emerged as an exit strategy for investors. In addition, with high interest rates creating a difficult financing environment, divestitures likely will become more important as a capital-raising mechanism. M&A activities introduce risks such as poor due diligence, overpaying, overestimating synergies, integration challenges, unexpected costs, faulty communications, and insufficient security. Proper valuation, strong internal controls over M&A, and technology implementation and integration can help mitigate these risks.

Next steps for internal auditors:

• Review valuation process
• Review controls, design, and testing of M&A process

Product innovation

In the life sciences industry, innovation is the process of using scientific knowledge and technological advancements to create new products, services, and processes that help promote human health and well-being. Innovation holds the potential to revolutionize the healthcare industry, improve quality of life, and foster economic growth. It involves the collaboration of scientists, engineers, healthcare practitioners, and business executives to develop solutions to help people live longer and healthier lives. However, when new products are developed, they might render previous products obsolete and potentially affect revenue negatively. Whether a new product with the potential to cannibalize an existing product is developed inside or outside of the organization, leaders need to be aware and ready to address that event. In addition, leaders need to consider supply chain impacts of new products. By employing data analytics, organizations can better measure the impacts of product cannibalization and develop strategies to address it.

Next steps for internal auditors:

• Review internal controls for product planning, budgeting, and operations
• Model and test supply chain resiliency
• Review vendor management

Back to top

Clinical trials are the lifeblood of many life sciences organizations. Having access to and managing clinical trials are critical to the success of the organization. However, clinical trials also pose many risks. Managing clinical trials is complex, as they involve many stakeholders who play a part in their operations and ultimately their success – patients, third parties, investigators, scientists, and procurement and accounting teams, to name a few. Managing risk across all trials and across all regions in which organizations operate is key.

Research and development

The discovery and development of new products, as well as the development of new uses for existing products, are core activities for many life sciences. As patents on products expire and lose market exclusivity, it is important for life sciences organizations to replenish their product portfolios with new and innovative products that address unmet medical needs among patients. In recent years, the nature of how products are discovered and developed has changed considerably and in several different ways. First, treatments using precision medicine continue to grow rapidly, as has the use of artificial intelligence (AI) and machine learning technologies. Second, the COVID-19 pandemic, as well as the need for sponsors to execute clinical trials faster and improve the experience for patients and healthcare providers, prompted the increase and popularity of hybrid, virtual, and decentralized clinical trials. While these trial designs offer many benefits, they also raise risk considerations that could affect several facets of a trial across site activation, patient enrollment, and the conducting of the clinical trial. Third, as many life sciences organizations begin to expand clinical trial operations across borders, they face new and evolving global risks that could affect core research and development (R&D) activities, such as clinical trial site selection, patient enrollment, and clinical trial portfolio management, among many others.

Next steps for internal auditors:

• Review controls, design, and testing of R&D processes
• Review R&D tax credits
• Review third-party contract compliance

Clinical trial accounting

Managing clinical trial accounting is a singular challenge that nearly all life sciences companies encounter. As a significant estimate on financial statements, considerable pressure comes from multiple arenas to confirm that clinical trial accruals are reported accurately and reliably. This pressure is further compounded by the inherent risks and challenges of managing clinical trials, such as frequent changes to contracts and change orders, unreliability of data provided by third-party clinical research organizations, as well as the variable and opaque nature of investigator spend and the challenges of manually managing information through myriad spreadsheets.

Next steps for internal auditors:

• Assess controls, design, and testing of clinical trial accounting process
• Review financial reporting of clinical trials, including close process, trial balance access, and key accrual calculations

Back to top

Cyber risk includes any risk of financial loss, business continuity disruption, or reputational damage that occurs because of the failure of one or more of the organization’s information technology systems. Cyber risk management is critical in the life sciences industry because these organizations handle personal health information (PHI), and many consumers depend on minimal disruptions for their treatment or care.

Cyberattacks

Cyberattacks come in many different forms and often lead to the loss of sensitive data, business continuity disruptions, and reputational damage, and they are becoming more common and costly. In 2022, 5.5 billion malware attacks occurred worldwide. According to IBM, the cost of healthcare data breaches averaged $10.93 million in 2023– the highest average across industries. These attacks include but are not limited to:

• Phishing attacks, in which attackers attempt to trick employees into sharing sensitive information
• Ransomware attacks, in which hackers encrypt company’s files and data and demand payment for encryption keys
• Denial-of-service attacks, in which attackers flood critical websites or online services with requests, rendering those sites and services unavailable

Life sciences companies that fall victim to cyberattacks are at risk of regulatory penalties and jeopardizing critical medical processes if the correct mitigation strategies are not implemented. During a clinical trial, companies prefer to digitize health records, which poses risk of exposing participants' PHI. Data breaches targeting PHI are a constant concern across the life sciences industry.

Next steps for internal auditors:

• Audit key security policies and procedures
• Audit inventory of valuable systems and data
• Review security controls

Data loss

Life sciences companies process sensitive data such as the clinical trial subject PHI and organizational IP as part of R&D efforts. Regardless of the data type, it can be very easy for data to escape the environment – maliciously or accidentally. When protected data falls into the wrong hands, it loses value because it becomes corrupted and unreliable, and this loss of data integrity can lead to significant financial repercussions.

Many organizations struggle to implement effective data loss prevention (DLP) solutions due to the complexity of the data they seek to protect. However, a staggered rollout of a DLP solution can allow organizations to focus on their highest criticality data first. Regardless of the implementation strategy, rigorous testing of the DLP solution is recommended to verify that it restricts data that should not leave the environment while not flagging too many false positives that could interrupt operations.

Next steps for internal auditors:

• Audit network- and email-based DLP technology
• Determine if the solutions are tested and operate effectively

Lack of adaptation and updating of compliance frameworks

It is imperative for the life sciences industry to comply with a multitude of regulations, including the Health Insurance Portability and Accountability Act of 1996, the FDA’s guidance on cybersecurity, the Securities and Exchange Commission’s (SEC’s) cybersecurity disclosure requirements, and industry frameworks such as the National Institute of Standards and Technology (NIST) cybersecurity framework (CSF). As these regulations and industry standards are ever-changing, organizations must stay up to date with changes or be responsible for financial and reputational damages that result from noncompliance. Adopting a control framework that aligns with industry standards is vital to establishing compliance. Some examples include but are not limited to the NIST CSF, ISO/IEC 27001, and ISO/IEC 27002. Once a framework is adopted, compliance staff should continue to update that framework to avoid potential penalties. Any updates and changes to the framework must be clearly communicated and understood by all personnel to guarantee effectiveness.

Next steps for internal auditors:

• Audit cybersecurity framework and applicable policies

Back to top

Digital transformation initiatives to create new or augment existing business processes, culture, and customer experiences can generate opportunities for growth and enhanced resiliency. However, rapid digital transformation also introduces new risks. With the perpetual development of technologies like AI, machine learning, internet of things, cloud computing, robotic process automation (RPA), and big data, threats are constantly evolving in scale and complexity.

System implementations

From simplifying processes and optimizing efficiencies to enhancing security and achieving a competitive advantage in the market, implementing the latest IT systems is a foundational element to an organization’s digital strategy. Yet transformative innovations can produce new risks when they do not get the attention they require.

The absence of a well-designed and well-executed project plan for system implementations can result in cascading impacts to key downstream processes. Ineffective implementations include inefficiencies, subpar integration, and compliance risk.

From an operational risk perspective, unforeseen inefficiencies can arise if organizational change management is not properly implemented throughout a project. Implementations of new systems and tools can increase time and effort to complete daily tasks if end users are not properly trained and if awareness and alignment with overall business and strategic objectives are not clearly communicated.

Incompatible system integration can result from a lack of due diligence as early as the vendor selection process or during the requirements gathering phase if the ability to integrate with other new or existing systems, such as cloud applications, payroll systems, and warehouse management systems, is not clearly defined. Confirming appropriate and secure communication among the various systems is critical to avoiding issues. Any deviations of the system dependencies that require additional development should be defined and considered as part of the project and thoroughly tested to confirm security, confidentiality, availability, and integrity.

If compliance is overlooked, significant regulatory and reputational damages can result. Risk management plays a key role in mitigating compliance risk. Management should follow a sequential approach for developing and implementing controls by process maturity. Throughout each phase, it is important to internalize the components and customize deliverables to meet specific departmental and organizational goals. The approach should increase the efficiency of management’s efforts to implement an effective internal control environment over financial reporting, based on the SEC’s guidance for management and the auditing standards of the Public Company Accounting Oversight Board.

Next steps for internal auditors:

• Conduct pre-implementation review (system development life cycle, data, security, process, and controls)
• Conduct post-implementation review
• Conduct integration and middleware review

Robotic process automation

RPA uses bots to facilitate and automate routine manual processes. While RPA has been a hot topic in recent years, its technical complexity has slowed its adoption. With recent advancements and lower-cost providers now available, RPA use is expected to continue throughout 2024. Some key benefits of RPA for the life sciences industry include:

• Real-time analysis and decision-making to respond to emerging situations
• Analyzing trends to address supply chain risks and availability of key drugs and medical supplies
• Eliminating wasted time on manual tasks and opening up capacity to focus on competitive innovation

While it’s important to take advantage of automation’s benefits, it’s equally important to manage the risk of deploying this technology. Bots can be considered as digital workers if proper controls are in place. As organizations continue to digitize processes through RPA, it is important to consider and address key risks by:

• Segregating duties of digital workers to assign a unique identity to each digital worker and developing process to maintain segregation among functions
• Preventing abuse and fraud by restricting access (similar to end users) and enabling privileged ID sessions for which elevated access is required
• Establishing log integrity to confirm audit logging capabilities and implementing procedures to monitor activity regarding sensitive access

Next steps for internal auditors:

• Audit RPA governance
• Audit RPA security
• Review data integrity
• Audit RPA IT general controls

Artificial intelligence

AI has the potential to transform industries and day-to-day jobs, and the life sciences sector has only scratched the surface of its potential. AI could revolutionize nearly every stage of drug development, from drug discovery and diagnostics to clinical trials and supply chain operations. While the opportunities to transform the industry using AI are immeasurable, it is imperative that companies are aware of the risks and challenges to consider, including:

• Data privacy. The use of sensitive PHI and IP are keys to success in the life sciences industry. AI applications can use such confidential information to automate processes, which could pose a risk to exposing confidential and proprietary information. The rapid development of open-source AI tools such as generative AI could pose a threat to a company’s confidential data if appropriate mechanisms are not in place. Such privacy risks might exist through data access, data processing, and data retention.
• Data bias and discrimination. The life sciences industry relies on immense quantities of data from patients, providers, and payers in drug development processes, which might inherently contain biases. Because AI tools use real-world information, data sets and algorithms must be designed to eliminate biases to generate the most value and eliminate adverse consequences.
• Regulatory compliance. Several countries are in the process of drafting AI regulations and guidance frameworks; however, regulations are largely not yet in place due to the rapid technological advancements. The current regulations that exist include guidance in Canada and the European Union (EU), which serve as strong benchmarks for companies to consider, including Canada’s Artificial Intelligence and Data Act (AIDA) and the EU’s Artificial Intelligence Act.
• Knowledge and skill gaps. With the rapid adoption of AI across the industry, there remains a large gap of knowledge and skill sets to be able to fully use the technology while maintaining a risk-averse mindset. While knowledge and skills are evolving to meet technological advancements, it is important to educate employees on best practices and avoid risks that AI might pose. The first step in adapting to these changes is to develop and communicate policies regarding AI use within the organization.

Next steps for internal auditors:

• Review AI policy and procedure
• Review AI governance framework
• Audit algorithmic fairness and bias

Back to top

The workforce landscape has changed dramatically in the last few years. However, more recently, it seems that the workforce is on the tail end of the Great Resignation, and the job market demand for new personnel seems to be leveling out. As a result of the turbulent times, companies have started to investigate the causes and impacts of increased turnover, refine their recruiting practices, and take into account potential candidates' needs.

Recruiting, retention, and reduction

The recruiting difficulties many life sciences organizations face can be summarized into the following categories: headcount reduction, budget constraints, workplace culture, and talent not aligning to need. Specifically, within the small and medium-size life science companies, headcount reductions have been on the rise and have had a direct impact on the job market, causing companies to approach hiring cautiously, especially as readily available liquidity has been hard to find. Coupled with budget constraints as businesses balance candidate salary expectations with available financial resources, these factors have made the recruitment landscape more challenging.

Organizations are going through a transformation in which talent alignment doesn’t always align to talent need, which has raised concerns about retaining talent and maintaining a stable work environment. This disconnect is especially true for workforces that are dependent on the ever-looming results needed to continue to the next stage of product development from R&D to release. It is a delicate balancing act to reduce costs and retain valuable talent. Employee retention is a pressing issue, and economic uncertainty creates an atmosphere of job insecurity. Companies must grapple with preserving a positive workplace culture and ensuring high levels of employee engagement amid these challenges.

Next steps for internal auditors:

• Audit workforce planning process
• Analyze talent retention
• Review incentive compensation

Succession and transition planning

In the context of the evolving job market, companies are preparing for future talent needs. Identifying and developing internal talent for leadership roles is a priority. Supporting a smooth transition of knowledge and responsibilities from outgoing employees to new hires or internal successors has become essential. Companies are taking a proactive approach to succession planning to mitigate potential disruptions caused by headcount reduction and workforce changes. This strategic planning allows organizations to maintain continuity and minimize the impact of workforce fluctuations on their operations.

Next steps for internal auditors:

• Review succession planning

Back to top