• Home /
• Case studies BCM /
• BCM implementation in a large pharmaceutical company

BCM implementation in a large pharmaceutical company

Company Background

AstraZeneca PLC is a world leading pharmaceutical company committed to sustainable development of its business and the delivery of new medicines that make a difference in the lives of patients and create value for shareholders and society. AstraZeneca is active in over 100 countries with a growing presence in emerging markets including China; corporate office in London, UK; and major R&D sites in Sweden, the UK, and the US.

Sales in 2008 totaled $31.6 billion; R&D investments totaled over $5 billion; and around 12000 R&D people in 17 principal R&D sites in eight countries, manufacturing sites in 18 countries. Source: AstraZeneca

This is an interview with Pierre Wettergren who led AstraZeneca’s BCM implementation programme, Pierre spoke with TBC about how this was achieved. Pierre is co-founder of and senior expert at 5G Continuity, a Business Continuity Management (BCM) consulting company. Before this he was a senior consultant at 4C Strategies in charge of their BCM Services. But the experience he shares with us in this interview is about the position he held before that as Head of AstraZeneca R&D’s BCM Team. Here he developed and embedded a sustainable BCM approach throughout the organization.

He is currently one of the experts on the ISO (International Standards Organization) Technical Committee which is developing an international standard for Societal Security.  You can contact him at pierre.wettergren@5gcontinuity.eu.

TBC - What triggered the BCM programme in AstraZeneca? Was this an individual champion, an external event, a request from a large customer, advice from a consultant, a board level decision – or some combination of these?

The BCM initiative started with a finding made by the external auditor that stated “AstraZeneca had inadequate contingency with respect to its IS/IT dependency”. This was back in 2002. Since it was labeled “Information Systems and Information Technologies (IS/IT)” the task ended up on the IS organizations’ desk. Unfortunately they were only focused on the disaster recovery side making it very IT centric and they weren’t keen to expand its remit. It took a good deal of work from the R&D part of the organization to show that true BCM was much wider in scope. I lead the BCM from that part of the organization and through example we managed to show the rest of the organization how to embed BCM into all its processes.

TBC - Did you use PAS 56 (this is the pre-standard that BSI published about 3 years before BS 25999)? When did you become aware of BS25999?  

Yes, we took inspiration from PAS 56 but we also applied the expertise available in the team and its network. The approach we took differed somewhat from what PAS 56 suggested. However, I would say we succeeded in our aim of making BCM a natural integrated component of the business within 3 of the 5 years stated in our remit.

TBC - How soon did you start to benchmark your processes against the standard internally?

During the implementation of the BCM System we looked closely at BS25999 part 1 when it came out. We could see that we differed in some aspects of the suggested approach but we were still effective. There is more than one road to Rome. But, HOW you travel there makes a huge difference to the capability and strength you have developed. We didn’t want to sacrifice any of this for being compliant on smaller details when our overall aim and objective was more important. Remember we did this for ourselves and not for auditors or inspectors.

TBC - How will you measure success?

In reality success is only measured by how good the response is to an incident, that hasn’t happened yet! For us though the success was evident in the benefits that implementing BCM brought to the organization.

TBC - Did you undertake a formal gap analysis between your organization’s systems and the Standard?  If so was this done internally or with the help of external consultants?

No, we didn’t. But, we kept a close eye on what was going on.

TBC - Within your organization how much involvement was there with other departments and operational managers across the business?

This is a good question for me to give some insight to the approach we took. Since BCM should be a natural component within the business, i.e. we didn’t want to build a cottage industry for ourselves within the company. Therefore our mindset from the outset was that we should be aiming to decommission our team at the end of the implementation in order to make the business fully realize its responsibilities. This was clearly communicated to those accountable and once it was understood by these business managers they started to appoint and assign people from their own departments to work with us learning the skills of facilitating the process components, tools, and methods developed by my team. When I closed the BCM Implementation in Q3 2007 we had trained and coached (hand-in-hand activities) 54 BCM facilitators globally. Those people together with the tools, methods, practices developed, and the BCM System, was the main delivery for us. So, whenever there is a need to renew departmental or business area continuity planning there is always a skilled BCM facilitator available to facilitate this process.

TBC - Did you involve any of your supply chain in this process? Your customers? Your main suppliers? Both?

Yes we did. E.g. on the IT side we had people from the IT infrastructure provider participating. AstraZeneca had outsourced IT infrastructure to a large Blue Chip  IT service provider and it was vital for us to have engagement from them in order to set priorities for the IT improvements required.

TBC - What is the BCM reporting line in your organization? Through the IT dept, Finance, Risk Management or direct to the Board?

I can’t speak for today’s situation but at the time it went through the normal chain of command, since it was implemented as part of normal business processes. Empowered managers equipped with sufficient tools and information should have no problem managing their own information. Because it is their part of the business at stake, they should manage their level of continuity and not be controlled by a separate (cottage industry) department. Through the whole implementation process the BCM implementation team never once took over or shortcut the existing accountabilities for managing the business. What we did was to make the accountabilities clearer using coaching and facilitating of the managers and their teams so that they became familiar with BCM and its methods. Availability of BCM facilitation as an internal service is also lowering the threshold for this work to stay attuned to business requirements.


TBC- Finally, could you say something about the organisational effects from this BCM implementation?

Well, before we decommissioned ourselves we conducted a benefit analysis with some really interesting results that I think will give you an answer. In this benefit analysis we could clearly see less loss for the business in the event of any incident
we saw less frustration from the employees, due to accountabilities being clearer soft benefits such as lower staff turnover and less sick leave were seen since during the implementation employees started to realize how important to the organization they were generally the business obtained a lower risk margin – which was due entirely to the higher level of preparedness
improved relationships between departments due to those relationships being better understood, and finally improved productivity was the main success and that is why I believe a well thought through implementation also, in addition to conventional objectives, delivers objectives of more interest to the CEO than to the Compliance or Security Officer.

The following figure illustrates our benefit analysis and shows both how conventional and unconventional business drivers were supported by our approach.

TBC - Anything else that you’d like to say about your experiences going through this process (good or bad)?

What I can say about going through the implementation is that it was the most rewarding thing I’ve done in my work career. Working with BCM allows you to see everything about the company’s foundation. I therefore strongly recommend that all managers spend some time in their career working as BCM Facilitators, since they then will get great insights and build an understanding about how their company really operates from the ground upwards. Typically in an organization the higher the position the more polished the picture becomes, so if you want to build an understanding on how things work on a broader scale before you move on to a more strategic level. Then, this is the place.