Enterprise Risk Management Top Risks for 2016 Enterprise

Enterprise Risk Management Top Risks for 2016

Enterprise Risk Management Process and methodology Add copy here Top Risks for 2016 1 Application and data security 7 Fraud 2 Third party risk management 8 Decline in fundraising revenues 3 Investments 4 The Foundation’s relationship with the pharmaceutical industry 9 10 5 Talent management 11 6 Execution of clinical trials 12 Physical space Insurance coverage Recruitment of next generation of CF scientists and clinicians Employee safety

1 Application and data security Owner: Tim Waire Category: Operational Significance: High Impact High Probability High Velocity Nature of Risk: Risk of patient information or other sensitive information being compromised. Risk that the Foundation cannot continue its day-to-day business activities due to interruption in service. Sub-risks Mitigating step Compromise of personally identifiable information (SSN, bank account numbers, medical information, etc. ) may be result in the Foundation no longer being seen as trustworthy by CFF constituents, including donors, patients, vendors, employees, and grantees. Compromise of patient registry data may result in fines from HHS/state AGs, care centers choosing not to exchange data or patients opting out of being included in the registry, which would have detrimental effects on research. Compromise of credit card data may result in fines or penalties for CFF, and potentially in CFF being unable to accept credit card payments. Loss of critical business functions, revenue, and/or patient engagement due to interruption to technology platforms. Maintain/sustain a robust and comprehensive security management system

2 Third party risk management Owner: Vera Twigg, Eleana Category: Operational Seek, Mark Keavey Significance: High Impact High Probability High Velocity Nature of Risk: Risk of potential failure by vendors to provide appropriate safeguards over sensitive information, and/or to continue performing critical business functions on behalf of the Foundation. Above risks may increase if vendors are not properly vetted and monitored by the Foundation. Mitigating Step: Develop and implement third party risk management framework.

3 Investments Owner: Vera Twigg Category: Financial Significance: High Impact Moderate Probability Moderateto-High Velocity Nature of Risk: Risk of the Foundation’s significant investment portfolio not meeting its objectives to preserve principal and, if possible, enhance the real (inflation-adjusted) value of the portfolio; provide a relatively predictable, stable and constant stream of earnings to support the Foundation’s mission; do so within a reasonable level of risk to support future Foundation needs; and maintain a portfolio that is liquid enough to adequately support planned withdrawals without excessively affecting portfolio value. Mitigating Step: Apply and improve risk management practices for investments.

4 The Foundation’s Relationship with the Pharmaceutical Industry Owners: Preston Campbell, COO, Eleana Seek Significance: Maureen Fraser, Amy De. Maria Category: Strategic High Impact Moderate Probability Nature of Risk: Moderateto-High Velocity The Foundation’s relationship with industry and its transactions with pharmaceutical companies, such as royalties and contributions, present inherent compliance and reputational risks. On the latter point, there is a risk that the Foundation could be perceived as engaging in certain activities for reasons other than for patients. Sub-risks Mitigating steps Risk of Foundation not being viewed as a trusted, independent resource regarding CF care and coverage (by Federal/state agencies, private payers, and pharma industry). Assess various aspects of relationship between CFF and pharmaceutical companies. Implement plan for mitigating certain aspects of the risk, in order to ensure that CFF is a trusted entity. Risk of real or perceived conflict of interest from viewpoint of CF community due to receipt of revenue from the pharmaceutical industry, and a lack of transparency and compliance by CFF. Reduce impact of any reputational risk related to receiving revenue from pharma companies. Risk of implied endorsement through CFF's acknowledgement of pharma industry sponsorship revenue and other interactions with pharma Ensure CFF is viewed as a trusted entity by the CF community. Legal issues with Vertex and perceptions within the CF community Form Board committee and determine way forward.

5 Talent Management Owners: Glen Goldmark Category: Operational Significance: Moderate Impact Low-to. Moderate Probability Moderate-to -High Velocity Nature of Risk: Risk of CFF being unable to execute its broad and ambitious mission due to failure to recruit, retain, and develop key employees, and/or to implement robust succession planning. Sub-risks Mitigating steps Risk of inability to recruit high-quality candidates Enhance employment opportunities presence on cff. org Implement consultant recommendations Recruitment training and assessment Risk of failure to properly retain and develop key employees Identify and provide leadership development resources to management Design and pilot a mentor program targeted to junior staff Risk of failure to implement a robust succession planning program Conduct National office talent review

6 Execution of clinical trials Owners: Mike Boyle Category: Strategic Significance: High Impact Moderate-to. High Probability Moderate Velocity Nature of Risk: Risk of inability to adequately recruit patients into clinical trials, which can jeopardize the development of new therapies. Additionally, a severe or adverse event in a clinical trial could damage the Foundation’s reputation and/or lead to significant financial losses. Sub-risks Mitigating steps Risk of inability to adequately recruit patients into clinical trials Increase outreach to patients/ families to facilitate trial recruitment Risk of a severe adverse event damaging the Foundation’s reputation and/or leading to significant financial losses Formalize communication plan for sudden adverse events Risk of inadequate number of patients available to participate in CFTR modulator clinical trials due to more patients being enrolled in successful treatment regimens Advance clinical development pathways for CFTR modulators

7 Fraud Owner: Vera Twigg. Category: Financial Mark Keavey, COO Significance: Moderate-to. High Impact Nature of Risk: Moderate Probability High Velocity Risk of fraudulent activities such as asset misappropriation, embezzlement, or misappropriation of grant funds occurring. Risk of the Foundation not detecting significant fraudulent activities in a timely manner. Mitigating Step: Formalize fraud awareness program.

9 Physical space Owners: Tervor Hunter, Category: Operational COO Significance: High Impact Nature of Risk: High Probability (already happening) Moderate-to -High Velocity Risk of negative impact on CFF's ability to recruit and retain talent due to inability to procure appealing physical space in a timely manner. Mitigating step: Address headquarters space limitation issues.

10 Insurance coverage Owners: Trevor Hunter, Category: Operational Mark Keavey, COO Significance: Moderate-to- Low Probability High Velocity High Impact Nature of Risk: Risk of CFF self-insuring against a loss due to missing/insufficient insurance coverage, insufficient management of insured risks, or inadvertent misrepresentation by CFF during the application or renewal process. Mitigating steps: 1. Replace insurance broker 2. Work with new broker on risk mitigation plans

11 Recruitment of next generation of CF scientists and clinicians Owners: Bill Skach, Mike Boyle, Bruce Marshall Category: Strategic Significance: High Impact High Probability Low Velocity Nature of Risk: Risk of clinicians, basic scientists, and clinical investigators not engaging in CF research or care as a specialty. Sub-risks Mitigating steps Risk of Federal budget cuts discouraging next generation of basic scientists from engaging in CF scientific research Develop a robust research community that addresses the latest technological advances in CF Risk that we will be unable to recruit CF clinical investigators Improve clinical investigator development programs and support Risk that we will be unable to recruit clinicians Improve support for CF clinicians Risk of Federal budget cuts halting critical ongoing research Maintain a robust research community with focus on CF

12 Employee safety Owners: Glen Goldmark, Trevor Hunter, COO Bruce Marshall Category: Strategic Significance: Moderate-to. High Impact Low-to. Moderate Probability Low Velocity Nature of Risk: Risk of employee safety being compromised due to a lack of clear, transparent, broadly-enforced and properly implemented policies and procedures on physical safety, e. g. building security, other emergency procedures, and employee harassment. The Foundation must ensure that the laboratory in Boston and its more than 70 chapter offices across the country comply with these standards. Sub-risks Mitigating steps Risk of employee safety being compromised due to lack of policies/procedures on building security Enhance and standardize building security policies across all CFF locations Risk of employee safety being compromised due to lack of policies/procedures on physical safety Develop and deploy safety plan & harassment training