Risk management

Ongoing interactions with stakeholders, trendspotting, business monitoring and the integrated systematic risk management process are tools to identify the issues that are material to Novo Nordisk’s business. In turn, the company’s response to current and emerging business and societal challenges is shaped in a closer dialogue with representatives of the stakeholders affected by the issue. As a result of this process, Novo Nordisk frames its strategic response and defines its targets. The company regularly reviews its key priorities to ensure that they reflect current agendas, and reports on progress in relation to performance targets.

For Novo Nordisk, risk management is about identifying and reducing risk to an acceptable level. Risks are defined as ‘events or developments which could reduce our ability to meet our overall objectives’, as defined by the company’s vision and reflected in business plans.

The company’s risk policy spells out that ‘we will manage risks to enable continued growth of our business and to protect our people, assets, earnings and reputation against material loss’. Hence, risk management considers both financial and non-financial risks, and key risks are reported through one integrated and systematic process.

Novo Nordisk’s strategic planning process forms part of the risk management process. Once a year a strategic plan with an in-depth identification and evaluation of long-term strategic growth opportunities is drawn up across the organisation. This also creates the basis for formulating critical success factors and setting targets for the key performance indicators (KPIs) which are part of the company’s Balanced Scorecards.

Subsequently, risk factors and mitigations are identified and these are factored into individual business plans for all units in Novo Nordisk. The assessment of key risks will build on Novo Nordisk’s existing organisational assurance activities such as Organisational Audits, Facilitations, quality audits and Group Internal Audit.

Since 2004 Executive Management has had a dedicated Risk Management Group of senior executives, representing all key business activities and selected supporting functions. Chaired by the chief financial officer, it reports to Executive Management and the Board of Directors. It sets the strategic direction and challenges for risk management, and analyses the risk and control information generated by the individual business areas. This process helps reduce blind spots and consider potential cross-functional impacts. In quarterly reports to Executive Management and the Board of Directors, risks are assessed and quantified in terms of potential financial impact and reputational damage. For each risk the potential impact is specified, as are mitigating actions.

Risk Office is the secretariat of the Risk Management Group, and drives and consolidates risk reporting from discovery and development, through manufacturing and logistics, to marketing and sales. In addition, risks related to support functions such as quality, regulatory, business development, finance, legal & IT and HR are included. This is done in consultation with relevant Novo Nordisk committees, boards and management groups.

Novo Nordisk’s risk management process identifies and assesses material risks associated with the company’s overall business objectives. The risk management framework aims:

• to provide timely and accurate reporting of risks to Executive Management
• to maintain and improve stakeholders’ confidence in the ability to achieve short-term and long-term goals, thereby maintaining and improving the company’s reputation in the marketplace
• to utilise an effective and integrated risk management process while maintaining business flexibility
• to identify and manage a comprehensive risk portfolio aligned to the vision and the corporate Balanced Scorecard
• to monitor and mitigate risks to maximise business benefits.

This model illustrates Novo Nordisk’s risk management process.

In the assessment of risks, two factors are considered: the likelihood of the event and its eventual impact on the business. Impacts are quantified and assessed in terms of potential financial loss and reputational damage. The matrix shows how Novo Nordisk assesses its key risks.

The risks are assessed at a gross level and a net level. The gross level is the assessment of the risk with the assumption that no mitigating actions have been implemented. The net level is the residual risk when taking into account the mitigating actions and their anticipated effect.

Rising healthcare costs are putting pressure on public healthcare. This, in turn, threatens to undermine the profitability of the pharmaceutical industry and discourage investments in research into therapeutic areas where there are limited prospects for commercialisation. For Novo Nordisk this situation would imply that the company cannot sustain its insulin prices at their current level as governmental price regulation would be likely to result in lower prices for insulin. While we fully recognise the need to resolve the issues, we also proactively defend the value of our products.

Backed by clinical and health economic studies of the benefits of a high-quality insulin therapy regimen, Novo Nordisk is closely monitoring initiatives from regulatory bodies and advocates moving diabetes higher up the healthcare agenda for the benefit of the 194 million people in the world with diabetes and the estimated 333 million people at risk of developing diabetes by 2025, as projected by the International Diabetes Federation.

In pharmaceutical production, quality is paramount, and any incidents where patients’ wellbeing is at risk would go against the Novo Nordisk Way of Management. It would also imply major reputational risks as well as risks of costly compensation payments in the event of product liability claims.

While gross risk is very high, this is an example of how mitigating actions can significantly reduce the net risk to the company. Novo Nordisk has a corporate quality system in place, with quality audits, quality improvement plans and a number of management reviews.

The majority of Novo Nordisk’s manufacturing capacity is concentrated at a few sites in Denmark. This in itself entails a relatively low risk profile, yet there is always a risk of failure or breakdown in any of the company’s vital production facilities. This would entail physical damage and potential loss of life, and could in the longer term also affect the supply chain. In order to mitigate this risk, procedures and instructions are in place to minimise the risk of fire, each site is inspected annually, and there are some back-up facilities and minimum safety inventories in place, should an incident happen.

Moreover, to reduce losses, buildings are designed to prevent any fires from spreading by measures such as fire separation, fire alarms and fire-extinguishing systems.

Adherence to ethical marketing practices is particularly critical in the pharmaceutical industry. Companies are expected to provide evidence that they have policies in place and that any misconduct is brought to light and rectified. Any major breaches might jeopardise the company’s reputation and could also mean ‘blacklisting’ by institutional investors, regulatory bodies, IGOs such as the United Nations, or other influential stakeholders.

In December 2005 the office of the US Attorney for the Eastern District of New York served Novo Nordisk with a subpoena calling for the production of documents relating to the company’s US marketing and promotional practices. The company believes that the investigation is limited to its insulin products.

The subpoena indicates that the documents are necessary for the investigation of potential criminal offences relating to healthcare benefit programmes. Novo Nordisk is cooperating fully with the US Attorney in this investigation.

In 2005 Novo Nordisk implemented a global business ethics policy, supported by standard operating procedures and training for everyone affected. Business ethics practices will be audited by Group Internal Audit and will also be addressed in the company’s facilitation process.

In addition, affiliates’ ethics and compliance policies, some of which have been in place for many years, supplement and enhance the global policy in accordance with local laws and requirements.

This page has been assessed by PricewaterhouseCoopers as part of its assessment of Novo Nordisk’s statement that it reports ‘in accordance’ with GRI. Please refer to Audit and assurance for a full description of the nature of assurance offered.