Lupin employs a ‘three lines of defense’ system to govern and manage risks.
The Risk Management Committee, constituted by the Board, holds the ultimate responsibility for our approach to risk management and internal controls. With their extensive experience and expertise, the committee translates strategic directives into tactical guidelines for the risk management function and oversees its effective implementation. The RMC establishes our risk appetite, taking a holistic view of risks across the entire organization and considering their global impact and interdependencies. The committee convenes bi-annually to provide strategic direction and oversight on risk management activities.
Reporting to the Board Committee is the Risk Management Cross Functional Team, which comprises of individual risk owners. This team meets as frequently as needed to review risk treatment plans, monitor changes in risk exposures, and adjust the risk appetite as required. The risk owners share their reports on risks and mitigation strategies with this team.
At the operational level, our functional and location teams support the risk owners and are responsible for day-today risk ownership. They ensure clear assignment of risk management responsibilities and implementation of risk treatment plans. The functional and location teams meet regularly to assess risks and review the risk treatment plans.
We maintain an independent internal audit unit tasked with advising and auditing yearly to ensure that policies are followed and processes align with the company’s risk strategy and policies. This unit provides objective assurance, safeguarding against conflicts of interest arising from other business priorities and ensuring effective risk management practices.
Biennially, the internal audit team may invite external experts for their comments on the audit process. This may be done to benchmark our practices with global best practices. Further, to strengthen our ERM capabilities, we are set to pursue ISO 31000 Risk Management certification, thus aligning our risk governance systems with global standards.
Alignment of strategy and enterprise risk
management
The company’s risk management
strategy is derived from its overall business strategy.
The Board of Directors plays a pivotal role in setting
the risk threshold and risk appetite aligned with
business expectations. The risk threshold on financial
impact and likelihood frames the cornerstone for
setting the risk categorization.
Risk Identification and Prioritization
We conduct
an extensive assessment of the business landscape,
scanning the risk horizon throughout the year
to identify external trends that may present
opportunities or emerging risks. Additionally, risk
owners monitor their business activities and internal
environment to identify potential risks.
To feed into the internal risk assessment, an external
double materiality exercise is undertaken once every
two years, where material risks are assessed for their
financial materiality and impact materiality. During
this process, material Key Performance Indicators
(KPIs) are identified and compared against the company’s risk taxonomy, ensuring all relevant
risks
are captured and addressed.
Insights from risk owners across the organization
contribute to the risk prioritization process. Risk
exposure is assessed once a year by considering the
likelihood of occurrence and the overall impact of the
identified risks. We utilize our risk appetite framework
to define the likelihood and impact of the risk. By
combining likelihood and impact, we determine
the severity of risks, allowing us to prioritize the risks.
Through this evaluation, risks are categorized as
strategic, operational, emerging, and systemic.
Oversight and Governance
A Coordinated effort
across all three lines of defence enables us to
effectively identify, assess, and manage risks while pursuing our business objectives. The Risk
Management Council, with its role in overseeing the
implementation of the risk management framework
and management of material risks, is the key
component in strengthening Lupin’s risk governance
and oversight mechanisms.
Risk Mitigation
The respective risk owners, with the
support of the site and functional teams, ensure the
development and implementation of consistent risk
mitigation plans. At the start of each fiscal year, the
Internal Audit team conducts an internal risk review.
Additionally, an independent third-party Internal
Audit of the risk management process is conducted
once every two years. The findings from these reviews
are used to adjust and refine the company’s risk
treatment strategies as needed.
Risk Communication
Risk owners monitor risk
treatment plans on a quarterly basis, and the progress
and status of risk treatment are communicated to the
Board committee on a bi-annual basis. This regular
communication ensures that key stakeholders remain
informed about the company’s risk exposures and the
effectiveness of risk mitigation strategies.
The risks in our portfolio are evaluated based on their likelihood and potential impact and categorized into one of the four risk categories.
Prioritization is an outcome of likelihood and magnitude assessment. To illustrate this, we have created a risk prioritization matrix, a heat map that highlights their significance.
The traditional pharmaceutical industry is facing disruption from AI powered drug discovery startups, which are accelerating the drug discovery process, and potentially eroding the advantages of established players. AI brings more efficiency in today’s high costs and slow processes and holds the potential to identify new drugs that go beyond traditional methods. As per a report by Markets & Markets published in November 2023, the integration of AI and machine learning in drug discovery is expected to grow significantly, with a compound annual growth rate (CAGR) of 40.2% from 2023 to 2028. Lupin faces the risk of being outpaced by digitally agile competitors, and our advantage in NDD could be threatened by the emergence of AI-enabled startups that offer newer medications and therapies.
Mitigation Action
Lupin is investing in technology enabled
solutions such as AI and ML, with a potential to disrupt the
market.
Our supply chain is always exposed to interruptions in raw material inputs due to factors such as geopolitical risks, physical climate risks and transition risk against import from a specific region. Moreover, international sanctions and trade policies can also cause issues with raw material availability, while conflict ridden trade routes may potentially affect our logistics time.
Mitigation Action
Import substitution strategies can be
effective in mitigating the above mentioned supply chain
disruptions but require careful consideration of potential
risks in sourcing regions. Lupin has an import substitution strategy as part of its broader
strategy to de-risk the
company’s supply chain, which could be impacted
by geopolitical tensions and potential war zones in
sourcing regions, particularly in regions such as the
Middle East and Eastern Europe. Our Global Sourcing and
Contract Manufacturing team engages with suppliers
worldwide. However, the emphasis is on collaborating and
developing domestic manufacturers to reduce import
dependency and contribute to the local economy. We
have a cross functional team comprising experts from the
Research and Development, Quality Assurance, GSCM,
and Regulatory Affairs departments, who collaborate
closely with suppliers working on import substitution.
The World Economic Forum’s ‘The Global Risks Report 2023’ ranks ‘Misinformation’ as the 5th most severe global risk over the long term.
As the internet evolves, pharmaceutical companies like Lupin are becoming more susceptible to misinformation campaigns that can spread unreliable evidence on any of the products affecting the public’s trust in the brand and the industry at large. With the potential to develop hostility toward the brand, deep fakes and AI-generated content are a novel threat to our credibility and business. It poses higher stakes and more harmful risks due to its capacity to create believable content at scale and at speed, which makes it challenging for us to counter.
Pharmaceutical companies have experienced an uptick in cyber attacks over the last few years due to valuable data and intellectual property held by these organizations. According to the Journal of the American Medical Association, the frequency of cyberattacks on U.S. hospitals and health systems more than doubled from 2016 to 2021. Another example closer to home is the recent 2023 ransomware attack on one of India’s largest drug manufacturers, drawing attention to the industry’s vulnerability to data breaches and cyber threats. Cyber criminals are increasingly leveraging AI techniques to enhance the effectiveness of their attacks, making them more difficult to detect and defend against. Generative AI tools can be used to create counterfeit medical records, produce sophisticated phishing emails, create malware, and even manipulate diagnostic imaging results from X-rays and MRIs for ransomware. In diagnostic businesses like Lupin’s, medical imagery like MRI and CT scan results are typically stored on a central system and retrieved when required, making them susceptible to weaponized AI attacks without adequate measures to fend them off. AI systems could also be used to analyze and reverse-engineer our proprietary drug formulations, manufacturing processes, or research data, leading to IP infringement and potential legal battles.
Failure to Maintain Timely
Supply of Compliant Medicines
Litigation Risk
Compliance Risk
Pricing Pressure and Competitive
Risk
Customer Health and Safety
Patent Expiration Risk in
Branded Generics Market
Financial Risk
Portfolio Risks for
International Non-Proprietary Names Markets
Data Privacy and Protection
Business Ethics
Protection of Human Rights
Water Management
Pollution
Occupational Health and Safety
Waste Minimization
Ethical Marketing and Product
Labeling
Anti-Microbial Resistance
(Pharmaceuticals in the Environment)
Assurance Statement