In the past two decades, the worldwide value of pharmaceutical goods traded has grown sixfold, from $113 billion in 2000 to $629 billion in 2019.1 Amid this growth, supply chains have become increasingly global, complex, and opaque. More companies are outsourcing production to contract manufacturers, adding new modalities (such as cell therapy), and exploring novel ways to reach patients. For some products, this results in supply chains that are so complex that they start in Asia and circumnavigate the globe twice.
Leading pharma companies have succeeded in shifting their supply chains to drive growth and manage costs. But unless they assess and plan for the risks that come with these changes, they can suffer huge losses.
Pharma executives say supply-chain risk is a significant reason for their companies’ susceptibility to disruption, according to a recent McKinsey Global Institute survey. Nearly 50 percent of respondents cite sole sourcing of inputs as a critical vulnerability, and 25 percent point to a lack of visibility into supplier risks. Although supply-chain risks are unavoidable, companies can minimize their disruptive effects through greater visibility, rigorous risk management, and newer technologies that help companies better anticipate and respond to shocks. But first, building supply-chain resilience begins with understanding the nature of the risks the chain faces.
Disruptions have become commonplace
Natural disasters, international trade tensions, cyberattacks, and global pandemics are just a few of the shocks that can immobilize pharma companies (Exhibit 1).
Pharma companies are somewhat more insulated from supply-chain shocks than other industries are because they generally hold higher inventory levels, but that can’t protect them from everything (Exhibit 2). In 2017, Merck reported that a cyberattack that occurred in June 2017 unfavorably affected revenue in the fourth quarter of 2017 by $125 million and for 2017 and 2018 by $260 million and $150 million, respectively.2 As such events become more commonplace, McKinsey Global Institute estimates that the pharma industry will lose an average of 24 percent of one year’s earnings before interest, taxes, depreciation, and amortization every ten years.
In the pharma industry, cyberattacks and trade disputes create the greatest risk of supply-chain disruption (Exhibit 3). That’s primarily because of the industry’s abundant proprietary knowledge, capital intensity, international data flows, and moderate level of digitization. Trade disputes pose a threat because of the industry’s high levels of international trade and constant pressure to relocate parts of the supply chain for economic and other reasons.
Regional dependencies and potential supply-chain shifts
Although the pharma supply chain is more global than those of other industries, companies often source critical materials from a single region, putting them at risk of shortages during natural disasters and local conflicts. Around 40 percent of pharma trade occurs within a particular region, while the average is 50 percent for other industries (Exhibit 4). For example, 86 percent of the streptomycin sold in North America and 96 percent of the chloramphenicol sold in the European Union come from China.3
Companies can reduce their exposure to single sources and other supply-chain risks by diversifying where they buy materials. To secure an input better, a company might revert to domestic production, nearshore the supply, or offshore to new locations. We estimate that 38 to 60 percent of the international pharma trade, worth $236 billion to $377 billion in 2018, could potentially be considered for sourcing diversification (Exhibit 5).
For pharma companies, relocations are often driven by noneconomic factors, such as governments’ desire to bolster national security and become more self-sufficient. For example, the Indian government is seeking to increase domestic production of bulk drugs and medical devices with a $1.3 billion stimulus plan.4 And the Austrian government is jointly investing with Sandoz International to support antibiotic production at the company’s Kundl facility to ensure that the country has an adequate supply.5
Four ways to build supply-chain resilience
Supply-chain resilience requires four elements: end-to-end transparency, routine stress-testing and reassessment, reduced exposure to shocks, and supply-chain resilience on the executive agenda.
End-to-end transparency
A lack of visibility into the business practices of suppliers and suppliers’ suppliers can be a significant risk for pharma companies. Major consumer brands have been accused of unfair labor practices when overseas suppliers have been found to have used child labor.
A company must map its suppliers by tier to have an end-to-end view of the supply chain and identify vulnerabilities. It’s also vital to have a clear understanding of exposures beyond supply, including how products are developed, delivered, and stored, because each stage poses its own potential problems. For example, the bankruptcy of a small transportation provider at a critical location could shut down an entire supply chain.
Getting a clear picture of what’s happening at each stage requires gathering from internal and external data sources the leading and lagging resilience metrics in seven areas: data security, finance, operations, organizational maturity, regulation, reputation, and structure (Exhibit 6). For example, a review of one company’s data security may reveal insufficient data-protection protocols. A structural review may uncover a heavy concentration of suppliers in a region subject to significant effects from climate change, such as hurricanes.
To conduct these analyses, companies can use a range of technologies. Some companies partner with third-party organizations, including start-ups funded by venture capital, to make investments (often of less than $1 million) to map their value chains and set up risk-monitoring systems. Others are investing up to $50 million in digital and advanced-analytics use cases to eliminate operational risks. For instance, some pharma companies are using AI-driven root-cause identification to improve quality performance. Others have set up reliability rooms to track performance and risk metrics across their end-to-end networks in close to real time to identify and resolve issues before they cause disruptions.
Routine stress-testing and reassessment
Companies often use scenario planning and simulation models to anticipate their vulnerabilities, quantify the potential impact, and mitigate the effects. For example, during the COVID-19 pandemic, a leading pharma company used a digital-twin simulation to understand the impact of production slowdowns and shutdowns on the supplies of patient medication. This helped the company realize that it had more time than it had anticipated to design and implement safer ways of working at its manufacturing plants, allowing it to take more time to get the best solutions. Once a company has visibility into its supply chain, it can assess the likelihood of different risks continuously.
Reduced exposure to shocks
One of the most common strategies for building resiliency is to expand the network of suppliers. Relying on a single source for critical components or raw materials can be a vulnerability, as can depending on multiple suppliers concentrated in the same place.
But multisourcing isn’t the only answer. A company can also strike a better balance between just-in-time and just-in-case inventory levels, harden its physical assets to withstand hurricanes and storm surges, and provide financial support to distressed but essential suppliers. Many companies are experimenting with technologies that enable quick changes among suppliers and advanced analytics that help predict potential challenges better.
Being able to reroute components and flex production among sites can also keep production going in the wake of a shock. This requires robust digital systems and analytics to explore different scenarios. It also requires a standardized operating model—a company that has different specifications for the same API at each of 20 sites has dramatically reduced ability to flex its production. Also, regulatory filings should include the technical specifications of the supplies on which a product depends. If a company’s filing relies on a particular brand of venous-access device, it’s difficult to substitute alternates.
A case in point is Biogen’s recovery from the impact of Hurricane Maria on its production plan in Puerto Rico. Applying its prior experience with natural disasters, the company identified the threat days before the hurricane made landfall. A global risk team created a war room to pinpoint supply-chain threats and critical subtier suppliers. It transferred production from Puerto Rico to Kentucky and secured alternative suppliers for critical materials in advance, paying $1.3 million for items at risk of shortages. As a result, its stock price recovered and surpassed the prestorm price within 15 days of Hurricane Maria’s landfall.
Supply-chain resilience on the executive agenda
Supply-chain risk and resilience should be embedded in an organization’s strategic planning and day-to-day execution, with structured governance to ensure that decisions are made and acted on at the right level and time. There are two common approaches:
- Embed supply-chain resilience in existing forums. Each function and line of business conducts risk assessments, which are aggregated and discussed in existing forums, such as management-team meetings. Each unit must have risk-identification and -analysis tools, capabilities, and expertise for this approach to work. The organization must combine disparate risk assessments and have the incentives and escalation criteria for unit leaders to take ownership of risk management. The operation-leadership team serves as the forum for reviewing risks and making mitigation decisions about daily and strategic risks.
- Create a chartered risk committee. A risk committee comprises a subset of a company’s operation-leadership team and risk experts. A company can have committees at different levels of its organization. This approach ensures that a group of people is accountable for assessing and managing risk across the company. The committee will need strong analytic capabilities and tools that provide useful data. And there should be tight connections with existing governance forums to secure ownership of risk by functional leaders.
Leaders need to be able to see their organization’s risks and have people continuously evaluate and mitigate them. Supply-chain shocks are inevitable, but as Biogen illustrated during Hurricane Maria, disruptions aren’t. Every pharma company has some of the four elements we describe, but few have all. A company that wants to increase its resilience to shocks can review itself against these elements to determine where to start and how to proceed.
