Building an Effective We Hope Corporate Compliance Program

Building an Effective [We Hope] Corporate Compliance Program Pragmatic Advice August 25, 2005 Roger W. Louis Chief Compliance Officer

Compliance: Some Etymology l Regulatory – FDA/GMP/GCP l Financial – SOX/SEC l Legal – CMS/DOJ/OIG l Commonalities & Differences – Sharing Best Practices – Establishing Systems & Processes Across Disciplines – Evolving Toward a Unified Field l It’s All About Risk 2

Genzyme Corporate Compliance Program l Established 1999 l Initial Focus – $ in (Product Pricing & Price Reporting) – $ out (Financial Interaction with Health Care Professionals) l Evolution – – – – Antitrust Privacy Ad/prom International Sarbanes-Oxley Ethics (Beyond the “Have to/Can’t do”) Next? ? ? 3

What’s a Compliance Program & Why Have One? l OIG Model Compliance Programs – Pharmaceuticals April 2003 http: //oig. hhs. gov/fraud/docs/complianceguidance/042803 pharmacymfgnonfr. pdf l Risk Management Device – OIG Risk Focus • Drug Sampling • Price Reporting • Anti-kickback l Evolution – False Claims Act l Ph. RMA Guidelines – compliance will “substantially reduce risk of fraud and abuse” 4

The False Claims Act (“FCA”) l Civil War Statute – Civil & Criminal l Qui Tams (Whistleblowers) l $11 K per Claim & 3 X$ Paid l Huge Recoveries l Creative Interpretations – That’s a claim! – Neurontin & FDA Ad/Prom • Criminalizing off-label • $430, 000 5

FCA (cont. ) What’s Next? l Clinical Trials/GCP – Jim Sheehan comments l FDA Risk Management Guidance – A floor, not a shield l “Fraud on FDA & Fraud on the Public” l GMP 6

Welcome to the Fun House l State Level Activities – State Attorneys General; Spitzer et al – Legislation; e. g. , California & the Phrma Code l International – Proliferation of Enforcement Activities – FCPA l Product Liability Exposure l PR – Overdosed America: Broken promise of American Medicine-John Abramson – Bad Medicine-Jerome Kassirer – Powerful Medicines: The Benefits, Risks, and Costs of Prescription Drugs-Jerry Avorn – The Truth About Drug Companies- Marcia Angell l SOX 7

Corporate Compliance Programs The OIG Elements & Other Pragmatisms l Policy Development l Training l Investigations/Audits/Reviews & “Check-Ups” l Hot/Help lines l Compliance Committee l Code of Conduct l Find the Right Outside Counsel l “Hire a Good CEO” 8

Compliance Committee l “Seek help immediately!!!” l Complexity & Consensus l Patience & Persuasion l Managing the Matrix 9

Compliance Committee l OIG Guidance: “The company should expect its compliance committee members and compliance officer to demonstrate high integrity, good judgment, assertiveness, and an approachable demeanor, while eliciting the respect and trust of company employees. These interpersonal skills are as important as the professional experience of the compliance officer and each member of the compliance committee. ” 10

Compliance Committee l “Manage the white space on the Org Chart” l Influence Without (Formal) Authority l Substance With Style – “Selling the Program” l Forests & Trees – And branches & twigs 11

Code of Conduct l Building Buy-in – From bottom up… • to top down – From business unit… • to corporate wide 12

Developing a Code of Conduct l Identify: – Subject matter – Constituents – Scope – Industry best practices – Ownership – Implementation strategies 13

Elements of a Code of Conduct l Internal Business Relationships l – Confidential Information • Inside Information • Document Retention – Employees • Complaint Resolution Process – Regulatory Compliance – Health, Safety and Environmental External Business Relationships – Trust and Integrity – Competitive Practices • Product Information and Pricing • Antitrust • Health Care Laws – Conflicts of Interest • Financial Interests and Business Relationships • Gifts, Entertainment and Favors – Continuing Disclosure and Accurate Business Records – International Business – Lawful and Ethical Behavior 14

Developing a Code of Conduct: Other Considerations l Compliance with the Code as an element of performance review l Failures to comply, subject to disciplinary actions l Documentation of receipt of Code l Implementation and follow-up – distribution 15

Conclusions l Systems & Processes vs. Substance l Coordination l Integration l Unified Risk Management – Which risks – Who watches – Everyone is No One – But Only One is Not Enough 16