Adopting a resilient approach for recall management

The rise of recalls

Barely a week goes by without news of a product recall. Recalls affect companies big and small, domestic and international—from food producers to vehicle manufacturers. Although recalls are nothing new, several factors are having a profound impact on the product risk landscape, resulting in an increase in both the frequency of recalls and their impact on businesses.
 

The rise in reported recalls is fueled by a range of factors, including an increasingly robust regulatory environment. For example, in the US, the 2011 Food Safety Modernization Act (FSMA), which emphasizes the prevention of food safety hazards, has required companies to implement more stringent preventive controls and closely examine their supply and distribution chains. Technological advances in product testing technologies have also contributed to rising numbers of recalls, particularly in relation to the detection of foodborne illnesses. The industrial internet of things (IoT) and whole-genome sequencing (WGS) are working to significantly improve detection of pathogens and traceability of products.

Social media and heightened consumer awareness have also been key drivers. Social media has connected disruptive events, such as outbreaks of foodborne illness around the world, and empowered broad audiences to pass judgements and assign blame. The rapid spread of information (and misinformation) via social media has turned incidents into crises in the blink of an eye. The role of social media in prolonging the reputational and associated financial fallout of a contamination incident or recall is also a key factor; it has been cited as the primary reason why the 2015-16 Chipotle E. coli crisis was so much more drawn out than that of Jack In The Box in 1992-93, despite the fact that the health consequences of the latter’s outbreak was actually far more severe.

Control Risks has also seen a shift in cultural mindset, as customer tolerance for recall incidents continues to decrease. This has been further complicated by the proliferation of competitive products in spaces that were once dominated by 1-2 brands. Recognizing the lifetime value of a customer, companies have increased the number of voluntary recalls in order to demonstrate a more conservative approach to quality while avoiding potentially brand-damaging incident-based impacts such as death, injury or illness.

The ever-changing global risk landscape also contributes to the increase in recalls. This is no more evident than when it comes to cyber risk, compounded by the rapid growth of IoT in the manufacturing space. For example, in 2017 the FDA ordered medical devices firm Abbott to recall a half-million pacemakers amid concerns over allegedly lax cyber security practices. In addition to cyber risk, which we expect to continue to grow given the expected growth of the IoT device market, food and beverage producers around the world have increasingly had to contend with economic pressures and the associated rise in food fraud, referred to by the FDA as “economically motivated adulteration.” The horsemeat scandal in the EU, wheat gluten in China and industrial-grade rapeseed oil being sold as olive oil in Spain have all triggered consumer concern in recent years.

Growing impact

As the frequency of recalls is increasing, so is the impact. According to a recent study by the Grocery Manufacturers Association (GMA), the average direct cost of a recall in the US is $10 million, not including lawsuits, government fines or lost sales. In 2018, 5% of US businesses had direct recall costs greater than $100 million. The consolidation of supply chains for global companies and the rise of just-in-time manufacturing have meant that a single recall can now impact entire industries across multiple geographies.

Recalls can cause significant short-term damage in terms of supply disruption, product removal and stock replenishment, as well as real longer-term harm. According to an insurance industry study, approximately 80% of the total costs of a recall are incurred long after the products have been pulled from the shelves. Residual costs include brand rehabilitation, litigation, regulatory fines and stock value decline.
 

Addressing the challenge: a more holistic approach to product recall resilience

It is more critical than ever that companies take the necessary proactive measures to effectively prepare for and respond to a recall. Otherwise, companies leave themselves exposed to unnecessarily high levels of risk exposure. The risk exposure is of particular concern in highly regulated industries or for products where the risk exposure is inherently higher (such as with fresh produce). Food and beverage producers, for example, are required to follow strict HACCP, PCQI and FSMA requirements and conduct regular training. Similarly, under new regulations stated in the Cannabis Act, Health Canada requires all Canadian cannabis producers to have a recall plan in place and conduct an annual recall simulation. Failure to address these risks and comply with these regulations can result in a shutdown of operations.

In addition, in order to qualify for product recall coverage, many insurers require prospective insureds to satisfy basic product safety requirements. At minimum, a company will have to demonstrate that it: has a recall plan and product quality and safety programs in place; operates under GMPs; and has proof of corrective actions for previous incidents. And while these compliance activities result in the creation of recall management capabilities (e.g., dedicated teams and plans), those capabilities are often built around meeting the bare minimum required by the regulations, rather than addressing the holistic risk and its associated likelihood and impact. This often means that the tactical considerations of a recall (e.g., steps needed to invoke a recall) are addressed while some of the larger, more impactful strategic considerations (e.g., communications, brand/reputation management, escalation and coordination among other response-related teams) are either nonexistent or ad hoc in nature—resulting in unnecessary risk exposure to the organization.

In addition, at many companies, preparedness activities are conducted in a siloed manner, either focused disproportionally on a single area of recall management or otherwise informal or incomplete. These companies may fail to link activities that reduce the likelihood of disruption with those that reduce their impact. This problem is not limited to a particular industry or geography—companies of all types often suffer from a disconnect between quality teams (who typically lead the implementation of risk mitigation activities and risk management) and finance teams (who might be responsible for purchasing recall-related insurance and/or allocating the budget required for such implementation).

With all this in mind, Control Risks believes taking a siloed or purely compliance-driven (“check-the-box”) approach does not constitute an effective and holistic recall management strategy. In our experience, the companies that really excel when faced with the daunting prospect of a recall are sufficiently prepared to respond ahead of the recall and utilize a set of integrated response capabilities that include product recall, crisis management and business continuity.
 

Such a posture separates the companies that fold or merely survive following a recall from those that thrive and even enhance their competitive edge. Control Risks organizes its own recall management framework into three categories: Readiness, Response and Recovery. Our “3R” approach aligns to leading practices and provides a unique lens through which to understand “what good looks like” when it comes to holistic product recall management.

A truly integrated and effective recall readiness program must be grounded in better alignment of complementary risk management capabilities around recall management, crisis management, business continuity and supply chain management. Today’s complex recalls result in events that touch people, processes and technology across an organization. Companies need to understand the risks associated with every point throughout the supply chain and distribution chain and have plans to address each of these risks. A lack of integration and fragmented capabilities between product recall and crisis management is where we often see companies struggle during a recall event. The integration of these two elements is crucial to ensuring the company is not only focused on identifying the root cause of the recall and removing impact product from shelves but also maintaining a focus on the broader operational, reputational and financial impacts the recall is having on the broader organization, its customers and its employees.

While many “Readiness” activities place a premium on preparing to respond as effectively as possible, leading-edge companies also work to minimize the likelihood of a recall occurring in the first place. Proactive risk monitoring activities are crucial to recognizing an emerging product safety issue and to predicting and preventing potential recalls. 
 

It is fundamental to take measures to identify and assess your organization’s key product risks at the outset and use those risks to inform your recall management program and specific risk mitigation activities, including, but not limited to, the following:
• Ensuring that risk assessments and preventive controls are built into new product development.
• Regulatory requirements are strictly adhered to.
• A stringent preventative maintenance program is followed.
• Microbial prevention methods are strictly adhered to through sanitation and good hygiene practices.
• Diligent evaluation and reviews of suppliers and co-manufacturers are regularly carried out.
• GMPs are adhered to in every aspect of production and other quality and risk programs are implemented (such as HACCP, HARPC and FMEA).

 

More mature recall programs recognize that these risks will change over time and can be influenced by both internal and external factors that could be out of the organization’s control. A significant change in people, processes or systems can impact or change the risk landscape and the way a company may approach a risk. Many companies lack basic risk monitoring and management activities needed to inform risk likelihood and impact mitigation measures. Risk assessment and monitoring activities need to be conducted periodically as the risk environment is dynamic and monitoring and management need to be objective and driven by data and analysis. Taking such an approach arms a company with the necessary data to inform resource allocation decision-making on an ongoing basis and to ensure that the company is aligned with the continually evolving risk landscape. All these activities should be done in conjunction and/or alignment with the organization’s other risk management efforts (e.g., enterprise risk management, cyber risk management, third-party risk management) to ensure alignment on intent and approach.

Implementing robust readiness activities requires investment—but in our experience it is better to spend thousands of dollars upfront on risk monitoring activities and associated controls than potentially millions in losses, regulatory fines and legal fees following a preventable incident. Companies can also take creative routes to reduce readiness costs. For instance, most recall insurers provide a pre-incident fund allocation (a percentage of the policy premium to be spent on risk likelihood and impact mitigation activities). Companies typically have a significant amount of leeway in how they can utilize those pre-incident funds, so long as they are focused on the reduction of likelihood or impact of a recall occurring. This includes activities such as plan development or improvement, crisis simulations/exercises and robust training on new regulations in emerging markets (e.g., Canada’s cannabis market). All these activities are incredibly valuable in helping companies be “ready to respond” when the recall occurs—but many companies that have access to these pre-incident funds either don’t realize they have them or don’t understand how to access them. In our experience, the companies that best utilize pre-incident funds are the ones that break down the barriers discussed above and integrate risk managers who “own” the policies with those responsible for mitigating recall-related risks (often a combination of quality, supply chain, crisis management and business continuity professionals within an organization).

Being able to respond effectively to a recall, whether voluntary or mandated, hinges on being able to bring together a variety of expertise. Even the largest companies are unlikely to be able to retain all the necessary skills and expertise in-house. Recalls are unique events and responding to them can require disparate types of expertise, from crisis communications to product destruction or forensic testing. Companies need to be prepared and willing to seek external assistance. Control Risks has seen a rise in organizations partnering with dedicated recall crisis response providers that combine deep technical recall expertise with crisis decision-making and stakeholder management experience. Many of these firms include a global network of experts to provide capacity support and subject-matter expertise. In fact, product recall insurance policies often include exclusive response providers, such as Control Risks’ partnership with Hiscox, who can help companies respond to the recalls at no additional cost to the company.

The indemnification of costs through the insurance provider, combined with the response expertise provided by the third party, provides a tremendous benefit in addition to the potential financial and reputation savings. This connection is even more powerful if the company utilizes its pre-incident funds and involves that response provider in its readiness activities (e.g., training, exercising), enabling the company easy and cost-effective access to leading practices and a wide variety of expertise (e.g., product recall, crisis management, business continuity) to ready them for future recalls. At the same time, the response provider obtains a better understanding the company, its culture, and its recall capabilities ahead of time rather than learning about them for the first time during a crisis. Cementing a partnership with a response provider from day one can make the difference between an effective and ineffective recall response.

Recovery activities are focused on those steps taken by companies to return to business as usual following a recall event. These range from initiatives led by quality teams on improving food safety training, to a complete overhaul of the manufacturing environment. Upon discovery of the cause of the recall, many companies will put together a corrective and preventative actions (CAPA) plan. This may result in improving environmental programs, maintenance reviews or equipment replacement, changing SOPs to avoid certain hazards or an overhaul of the operations itself. In 1998, Sara Lee spent about $25 million to renovate its Bil Mar plant after a recall for Listeria monocytogenes; in 2007 ConAgra spent about $15-20 million to renovate one of its plants after a recall for Salmonella.

However, continuous improvement is an area where many companies fall short. When companies don’t take the time following a recall to evaluate how prepared they were, and how effectively they responded, history tends to repeat itself. For example, Bravo Pet Foods had a total of eight separate recalls between 2007 and 2015; all were for either Salmonella or Listeria contamination. This points to a potential lack of integration between lessons learned and risk mitigation activities. Firms often skip or pay lip service to this vital step, eager to resume business as usual and turn a page on a disruptive recall as quickly as possible. Many companies do not take the time to pause and reflect on lessons learned and make changes. Failure to address lessons learnt from recalls in a systematic and objective manner not only minimizes a company’s chances of mitigating the likelihood or impact of a similar event occurring but also potentially jeopardizes its survival. An evaluation process should include formalized procedures for conducting post-recall reviews; these reviews should capture strengths and weaknesses and result in measurable actions that can be assigned ownership and shared with senior leadership or a designated resilience steering committee to ensure accountability and monitoring of progress. Companies that do this well set up formal projects, often with the support or oversight of a corporate project management function, that are tracked and monitored until completion. Resilient organizations will realize the opportunities created by this process to emerge stronger from such events.

Conclusion: The road ahead

Companies face an increasingly formidable set of challenges when it comes to preventing and recovering from a recall. The approach and mindset that a company takes in its response determines whether it can successfully reduce the frequency of recalls while lessening their impact should they occur. Based on our experience, we suggest organizations take a holistic approach to product recall management, similar to Control Risks’ “3R” methodology described above, that focuses on managing the risk before, during and after a recall event.
 

At a minimum, this approach should consider the following considerations:

• Take the necessary proactive measures to effectively prepare for and respond to a recall. Don’t wait for a recall to figure out what to do.
• Move beyond “check the box” capabilities and address the broader holistic risk.
• Integrate capabilities across response capabilities (e.g., product recall, crisis management and business continuity) to drive effective and efficient response.
• Invest in robust training and exercising. There is no better way to help response teams be prepared for the real thing.
• Investigate insurance options, including those with exclusive response providers and access to pre-incident insurance funds that can be utilized to pay for key readiness activities (like crisis simulations and product recall plan reviews).
• Don’t forget about evaluating a recall’s success and failure with a post-incident review and maintain a focus on continuous improvement. Without it, your next recall is only going to be as effective as your last one.

 

Authors

Matt Hinton, Partner

Daniel Sachs, Associate Director

Carol Kozlowski, Product Recall Response Manager