This article is a collaboration of the Vanguard Network and Debevoise and Plimpton, and first appeared in the Debevoise In Depth series.

By Mark P. Goodman, Maura K. Monaghan, Paul D. Rubin, and Jacob W. Stahl

Life sciences companies are susceptible to a wide range of legal crises that could expose them to legal liability, negatively impact commercial relationships and destroy a reputation built over many years.

A crisis can trigger concurrent investigations by Congress, the Food and Drug Administration (FDA), the Securities and Exchange Commission (SEC) (for publicly traded companies), the Department of Justice (DOJ), and, potentially, other federal and state regulatory agencies. In addition, life sciences companies may be named in lawsuits alleging violations of the False Claims Act (FCA), product liability lawsuits, and class-action lawsuits in multiple jurisdictions, while also being subject to extensive media scrutiny. But these risks need not lead to disaster— provided that a company has prepared in advance for the possibility of such a crisis.

Below, we present a hypothetical situation, followed by a series of questions and answers,to provide life sciences companies with suggestions for preparing for and managing crisesand addressing the wide array of legal issues that may arise.

NewKnee Corp. manufactures state-of-the art knee replacements and distributes them worldwide. In January 2018, six patients in South Korea reported severe knee infections three weeks after knee-replacement surgery. In July 2018, NewKnee received reports of ten patients across the United States who also experienced severe infections about three weeks after knee- replacement surgery. In October, 2018, XYZ News ran an exposé. According to a whistleblower who was a former NewKnee employee, the post-surgery infections were due to knee replacements that had become contaminated because a manufacturing plant in China failed to adhere to good manufacturing practices (GMPs). The whistleblower claimed that NewKnee contracted with this plant last year as part of cost-saving measures and failed to adequately audit the facility. Further, the whistleblower claims NewKnee knew about the infections for months but hid them from the FDA. Two days after the news report, FDA and FBI inspectors raided NewKnee headquarters. NewKnee’s CEO received a subpoena to testify before Congress the following week.

This hypothetical scenario has unfolded in different real-world variations at many life sciences companies. Allegations that a company is manufacturing an adulterated, dangerous product and concealing the “bad news” from the public or regulators are the perfect recipe for a PR crisis. How the company responds may well determine its future. Ifthe company can successfully implement a crisis management plan, it may ultimately regain the trust of the public and government regulators and survive the torrent of investigations and lawsuits it is likely to face. By contrast, if the company responds hastily and without a strategy, it may easily end up exacerbating the crisis.

Our company has never had a major PR crisis. Should we prepare for one?

Yes. Any company that manufactures a product ingested by or implanted in a person runsthe risk of allegations—truthful or not—that a product defect caused patient injury. A company will be best positioned to respond to this type of allegation if it develops a crisis management plan ahead of time. A crisis management plan should begin by identifying the interdisciplinary team of both internal and external personnel to be called on to handle a crisis, including (as applicable) company leadership, counsel, communications and PR experts, safety and quality experts, regulatory affairs, and investor relations. The overriding objective of such a plan should be to ensure that the company establishes a coherent strategy for responding to the crisis, buttressed by specific tactics, rather than implementing ad hoc tactics with the hope that a strategy will emerge. Additionally, the plan should ensure that all statements released to the public are validated for accuracy and that the impact of all statements and company actions are assessed in advance through the prism of legal and PR exposure. The company may alsoconsider determining, in advance, which outside counsel and outside communications consultants it would retain to advise on crisis management issues.

Our company is facing a PR crisis but we do not have a crisis management plan in place. What should we do first?

When a company is facing allegations similar to those levied against NewKnee, it should assume that the emerging crisis will attract the interest of a variety of potentially adverseparties including the FDA, Congress, the DOJ, plaintiff attorneys, and the media. Faced with this array of forces, a company should consider retaining outside counsel with expertise in a combination of crisis management, government investigations, litigation, and FDA law. Outside counsel can help the company develop an integrated legal strategy to respond to potentially hostile parties (whether private plaintiffs, the government, or themedia), accurately inform patients, and facilitate key business objectives. In addition, involvement by outside counsel (and in-house counsel) will protect certain privileged communications from discovery.

Most importantly, outside counsel can advise a company on steps the company should take to alleviate the situation as well as actions it should avoid that might make things worse. In some cases, the greatest legal risks that a company faces will come not from the facts that led to a crisis but from the company’s response to it. All too common examples include making false or incomplete statements to regulators, Congress, investors, or the public (whether in regulatory filings, during testimony, in press releases, or on social media); destroying relevant documents; or failing to conduct an objective and thorough investigation (usually supervised by the board) to understand thefacts and get to the root of the problem.

Our company believes the XYZ News report is full of distortions, but the negative news coverage is causing us to hemorrhage customers. We frequently audit the Chinese manufacturing plant and have every reason to believe it is operating appropriately. Should we publicly proclaim that our products are safe?

Declaring unequivocally at the start of a crisis that a company’s products are safe is often a risky strategy. If the company is subsequently forced to carry out a recall, the company is likely to lose credibility with the FDA, other regulators, investors, and the public. At worst, a company may be accused of actively misleading these stakeholders.

Before making any statements about product safety, the company should carefully examine the data it has already amassed about the issue and should work with counsel to develop an appropriate response. If the data do not provide a conclusive answer, additional investigative work and analysis should be undertaken. Typically, it is preferable to err on the side of caution, even if it means short-term market losses, rather than to make statements that turn out to be incorrect. However, that does not necessarily mean the company should go silent, as outsiders may interpret silence as evidence that the company is paralyzed with fear—even if not guilty of the alleged shortcomings. Where feasible, the company should provide carefully worded, factually accurate updates communicating what it knows and what it is doing to investigate the issue. In the hypothetical scenario posed by this question, for example, the company might inform the public that it frequently audits the Chinese plant to ensure that it is in compliance with GMPs, and that the last audit was carried out two months ago.

One circumstance where it may be safe to make unequivocal statements about product safety is when a company has strong evidence that allegations about a supposed product malfunction are unfounded or are the result of malicious conduct by outsiders. A classic example is Allergan’s successful response in 2004 to reports alleging that patients who received Botox injections later suffered severe botulinum poisoning. In response to the reports, Allergan released statements and background documents describing Botox’s safety record and the company remained in close communication with regulators and public relations teams at state and federal health agencies. Allergan also communicated through practitioners, who were anticipated to be the principal source of information for many patients. Investigators later determined that the poisoning was not caused by Botox but rather by a doctor who diluted a nerve toxin and was subsequently sentenced to jail.

Pepsi faced a similar situation in 1993. At that time, there were numerous reports of foreign objects—typically syringes—found in Pepsi cans and bottles. Pepsi produced four videos defending the safety of its product, including a comprehensive report on the canning process. Pepsi explained that cans are turned open—upside-down—for less than one second and then closed, making it virtually impossible for foreign objects to be inserted during the canning process. The FDA backed the company; the FDA Commissioner publicly stated that the tampering claims could not be substantiated. The crisis began to subside when investigators uncovered evidence that the claims were hoaxes, including a supermarket surveillance video showing a woman inserting a syringe into a can of Diet Pepsi.

We think there is a reasonable possibility that there is something wrong withour product. Should we announce a recall? What should we say about the recall?

The answer to this question will largely depend on the circumstances, as a recall may be required by FDA regulations. In general, if a company believes there may be something wrong with its product and that the safest course is to pull it from the shelves, conducting an immediate voluntary recall in conjunction with the FDA may be the best way to mitigate additional harm and begin regaining the trust of regulators and the public. Johnson & Johnson, for example, immediately recalled Tylenol in 1982 after reports that cyanide-laced Tylenol had caused multiple deaths. When it reintroduced the product into the market, it did so with triple-seal, tamper-resistant packaging. If a company decides to conduct a recall, it should work carefully with counsel to devise a statement regarding the recall that is both accurate and avoids making any admissions that could be used against the company in future litigation.

We don’t want to face another PR crisis. What can we do differently next time?

There is no sure-fire way to avoid such crises because they can be triggered by false allegations and factors entirely outside of a company’s control. That said, there are steps that companies can take to mitigate risk, including:

• Develop a crisis management plan and a strong corporate compliance The company’s board and executive leadership should be actively involved in both steps. They should emphasize to the entire company that compliance, safety, and quality should be prioritized even if it is costly in the short run. Additionally, when a significant problem is identified, it should be elevated to senior management or the board (as appropriate) and corrective action plans should be developed and implemented.

• Develop a robust risk-assessment program that prioritizes identification and mitigation of quality and compliance risks during product development. Newly developed commercial strategies should be subjected to risk-based analysis by a cross-functional team that includes representatives from medical affairs, regulatory, and legal. As with crisis management and compliance programs, both senior management and the board should be actively involved.

• Develop protocols (including standard operating procedures) to ensure that the company is complying with its disclosure obligations to government regulators.

• Audit adverse event reports and consumer complaints (as required by the FDA, or more frequently) to determine any trends that may suggest a problem with compliance, safety, or quality.

Life sciences companies should conduct periodic assessments to determine whether they have appropriate and up-to-date compliance, risk assessment, and crisis communications programs in place. Outside counsel and compliance and communications experts may facilitate this process by conducting assessments which highlight deficiencies and identify state-of-the-art practices that the company may consider adopting. Companies that undertake effective, proactive efforts are likely to reduce the risk of unforced errors and will be better positioned to weather the storm— and even prosper—in the aftermath of public-relations crises.