Sean O’Hearen

How well does your organization understand the impact of illicit trade (i.e., counterfeiting, diversion, tampering, and theft) on its products, business, and, by extension, society? Well enough to determine whether that impact is material in the same sense used in financial reporting? This would mean that there is “a substantial likelihood that a reasonable person would consider it important.”¹

Under the European Union’s new Corporate Sustainability Reporting Directive (CSRD), these are no longer academic or isolated questions.² They are regulatory obligations that many pharmaceutical manufacturers and their supply chain partners need to be aware of and assess accordingly to ensure compliance.³ Is your organization prepared?

‘Double materiality’ in focus

At the heart of the CSRD is the concept of “double materiality:” financial materiality (how sustainability issues affect the company’s performance, position, and development) and impact materiality (how the company’s operations impact people and the environment). Companies must evaluate and disclose on both dimensions. Exactly what and how to report on any material sustainability issues are covered in the accompanying European Sustainability Reporting Standards (ESRS), a common reporting framework adopted by the European Commission.⁴

While illicit trade is not explicitly named in the ESRS, if counterfeiting, diversion, tampering, or theft pose material risks to your business—or materially impact patients/consumers—you are expected to identify and disclose them.

What’s in scope?

In addition to assessing double materiality, organizations are also expected to consider risk across their entire value chain—both upstream and downstream activities—not just their own operations. Illicit trade activities drive innumerable risk scenarios throughout the pharma ecosystem, from counterfeit products undermining patient safety, to diverted medicines causing shortages in one market while fueling illegal trade in another, to cargo theft causing financial and potential reputational harm.

We know from experience that illicit goods can infiltrate legitimate supply chains at virtually any point. That means assessing suppliers, contract manufacturers, distributors, logistics providers, and even end-of-life product management. If there are vulnerabilities, they fall squarely within the scope of your double materiality assessment. Do you have a good handle on the security posture of your partners—and their partners?

Is illicit trade material?

At the industry level, the answer is clear. Global estimates place pharmaceutical crime in the hundreds of billions of dollars annually, with wide-ranging consequences for industry stakeholders, patients, and the healthcare system. Incidents affect every therapeutic category and every region of the world. From a financial standpoint, the cost to companies of maintaining adequate security and risk management programs, as well as the impact of lost sales, reputational damage, and legal exposure, is significant. From a societal standpoint, patient safety risks and erosion of trust weigh on our healthcare systems.

But what about your company? That is the crux of the CSRD challenge. If illicit trade is material for the industry, is it material for your organization? Many large pharma manufacturers already acknowledge illicit trade as a material issue in their sustainability reports.⁵ More companies will likely soon follow as regulatory deadlines approach.

The measurement problem

Herein lies a core difficulty: illicit trade is notoriously hard to measure. Incidents are underreported. Criminal networks operate in the shadows. Comprehensive and reliable data is scarce. Without standard methodologies, companies are left to decide on their own how to quantify financial and societal impact. What metrics should be used? How should companies compare risk exposure across different geographies or product categories? How can companies benchmark their practices against others?

For small and medium-sized enterprises, the challenge is even greater. Many lack dedicated brand protection or product integrity functions. Yet CSRD expects most companies, eventually—large and small—to assess, manage, and report on illicit trade risk if it is deemed material.

Assurance and the need for standards

CSRD also introduces assurance requirements. Auditors will be asked to verify the accuracy of a company’s sustainability disclosures, including those related to illicit trade. But, today, there is no widely accepted framework for what “good” illicit trade risk management looks like in pharmaceuticals. Unlike GxP in manufacturing and quality, no equivalent exists for anti-illicit trade practices.

That is why I believe the industry should develop the equivalent of a GxP for illicit trade risk management. Perhaps we could insert an “S” for Security (though I think “S” for Storage is already in use) or use “RC” for Risk and Compliance. A GxP-type framework would provide a foundation of standard methodologies, controls, and reporting practices for identifying, managing, mitigating, and measuring illicit trade risk. It would provide auditors with a benchmark to test against, and it would offer companies a common language and approach to demonstrate compliance and effectiveness.

The clock is ticking

Large EU and multinational companies began reporting in accordance with the CSRD as of the fiscal year 2024 (reporting in 2025). Phased adoption follows for others over the next several years. If you have not yet considered illicit trade in your materiality assessment, the window to prepare is closing.

Illicit trade is the dark side of pharmaceutical commerce—an ever-present, growing threat to patient safety and product integrity. In the past, even companies with industry-leading brand protection programs did not dedicate a lot of effort toward actually quantifying the impact of illicit trade, either in terms of financial loss, reputational damage, or patient safety impact.

Now, the industry will need to take a closer look at the measurement challenge and gain some consensus regarding how to best answer the question: To be or not to be material? The answer may determine not only your compliance with CSRD but also your credibility as a trusted steward of patient safety.

About the Author

Sean O’Hearen is Founder and Principal Consultant at 1st Line Partners.

References

1. SEC Staff Accounting Bulletin: No. 99 – Materiality. US Securities and Exchange Commission. August 12, 1999. https://www.sec.gov/interps/account/sab99.htm

2. Corporate Sustainability Reporting. European Commission. https://finance.ec.europa.eu/capital-markets-union-and-financial-markets/company-reporting-and-auditing/company-reporting/corporate-sustainability-reporting_en#what

3. The CSRD (Article 5) phases in ESRS reporting in waves: Wave 1 - large public-interest entities that were already subject to the previous NFRD reporting standard from FY2024; Wave 2 - other large EU undertakings (meeting size thresholds) follow from FY2025 (delayed to FY2027 under the 2025 ‘stop-the-clock’ amendment); Wave 3 - listed SMEs

4. Europe’s Voice in Corporate Reporting. EFRAG. https://www.efrag.org/en

5. Consumers and End-Users (S4). EMD Group. https://www.emdgroup.com/en/annualreport/2024/management-report/sustainability-statement/social/consumers-and-end-users-s4.html?