When Criticality Isn’t What You Think: Business Continuity for a Pharmaceutical Distributor
Sector: Pharmaceuticals | Scope: BC programme development, BIA, planning | Outcome: BC readiness achieved ahead of listing; programme overhauled over a decade later
In most organisations, the question of which products or services matter most has an obvious answer: the ones that generate the most revenue. In pharmaceuticals, that answer can be dangerously wrong.
This case study spans more than a decade — an original engagement that delivered a full business continuity programme ahead of a significant corporate milestone, and a return engagement many years later that speaks to the lasting value of work done well the first time.
The Original Engagement
Cambridge Risk Solutions was brought in to develop a business continuity programme across the organisation as it prepared for listing. The work needed to demonstrate that the business understood its critical dependencies, could recover from disruption, and had the documented arrangements in place to evidence that capability to investors and regulators.
The Business Impact Analysis at the heart of that programme produced one of the most instructive findings of any engagement Cambridge Risk Solutions has undertaken.
The client distributed a wide range of pharmaceutical products. Asked to identify the top ten critical products, three entirely different lists emerged depending on the lens applied. Ranked by value — income to the business — one set of products came to the top. Ranked by volume — the number of patients served — a different set emerged. Ranked by clinical criticality — the consequences for patients if supply was interrupted — the list changed again entirely. Drugs that kept people alive featured prominently in the third list and barely at all in the first two.
For a pharmaceutical business, that third list is the one that matters most when a BC decision has to be made under pressure. It is also the list that would never have emerged from a purely financial or operational analysis. Understanding criticality — genuinely understanding it, from the perspective of the end user rather than the balance sheet — is what a well-conducted BIA is for.
The programme was delivered successfully. The business achieved the BC readiness it needed ahead of listing.
An Unexpected Return
Organisations change. The business went through a difficult period and a number of subsequent iterations before stabilising under new leadership. When a new Managing Director was appointed — the former Operations Director who had been closely involved in the original BC work — one of his early decisions was to contact Cambridge Risk Solutions to overhaul and update the arrangements.
That call, made more than a decade after the original engagement, is perhaps the most honest measure of whether the work had been worth doing. The original programme had been good enough that the person who knew it best, returning to lead the organisation, wanted it rebuilt to the same standard.
The current engagement has completed the BIA and outline planning across the organisation’s three sites. The complexity of limited interoperability between those sites presents genuine planning challenges that are being worked through — a reminder that BC programmes are rarely finished in a straight line, and that the client’s active participation in the process is as important as the consultant’s input.
The Insight That Stays
The criticality question that emerged from the original BIA remains one of the clearest illustrations of why impact assessment matters and why financial metrics alone are an inadequate basis for BC prioritisation. Revenue, volume, and end-user criticality are three different conversations — and for any organisation whose products or services have a direct impact on people’s lives, conflating them is not just analytically imprecise. It is a risk in its own right.