Driving Quality, Efficiency, and Compliance in a Pharmaceutical Organization

Executive Summary

Large Global Medical Affairs organizations rarely suffer from a lack of SOPs. They suffer from too many — too fragmented, too inconsistent, and too disconnected from how work actually happens. As Medical Affairs organizations expand globally and operate across increasingly complex regulatory environments, SOP libraries often grow organically — resulting in duplication, unclear ownership, inconsistent execution, and audit risk.

Multiple Medical Affairs organizations have engaged us to standardize and streamline their SOP inventory. The objective was not simply to update documentation, but to establish a scalable governance framework that aligned process ownership, reduced operational friction, and strengthened compliance and inspection readiness — without disrupting ongoing business operations, i.e., an operating model transformation.

We’ve worked with organizations to:

• Standardize templates across all regions, eliminating local variants
• Reduce total SOP volume through simplification and consolidation
• Shorten change control cycle times
• Clarify process ownership across Global, Regional, and Local teams
• Reduce deviation findings linked to documentation gaps
• Enable continuous improvement

The outcome was not simply a cleaner library. It was a more scalable, controllable, and execution-ready Medical Affairs function.

The Hidden Cost of SOP Proliferation

SOP complexity rarely appears on a dashboard — but it quietly erodes performance.

Some common executive signals include:

• Time spent clarifying, explaining, and searching for the correct guidance
• Delays and missed deadlines due to unclear roles and responsibilities
• Unsuccessful attempts to outsource
• Inefficiency due to overly complex processes
• Duplicative or conflicting procedures across countries and functions
• Ambiguity over which SOP governs global vs. local execution
• Different definitions and interpretations of global policy
• SOPs that no longer reflect operational reality

Operational drag increases — but so does compliance risk. When employees cannot quickly determine which SOP or process step applies, the likelihood of errors, delays, and non-compliant decisions increases.

Approach – define evolution stage, then define approach

First, it is helpful to understand where a company currently sits in the example maturity model below.

Most organizations operate between Levels 2 and 3. The goal is sustainable progression to Levels 4 and 5.

Through these mechanisms, organizations can continuously evaluate how well their processes are functioning in practice and make targeted adjustments to improve efficiency, clarity, and compliance over time.

Common Pitfalls and Critical Success Factors

“Common pitfalls we help avoid”

• Trying to standardize without aligning the governance model
• Over-customizing for affiliates/geographies
• Lack of timely communications and training to support the SOPs
• Building SOPs without foundational templates/tools

Critical Success Factors

1. Executive sponsorship is essential to resolve global vs. local tensions.
2. SOP content must match real-world process.
3. Change enablement must be deliberate and measurable.
4. Simplification must be protected and enhanced through structured review cycles.

Conclusion

SOP simplification without measurement is temporary. Measurement without governance authority is ineffective. When integrated properly, organizations create a structural feedback loop that:

• Prevents complexity from reaccumulating
• Protects audit or inspection readiness
• Enables scalable growth
• Preserves speed without sacrificing accuracy

The outcome is not simply standardized documentation, but sustained structural clarity.

Reflections on 20 Years of Potomac

While “four score (and seven)” belongs to Lincoln, Potomac just reached its first score. Tomorrow, the company turns twenty.

When I started the firm, I wasn’t thinking about making it 20 years. I was trying to figure out how to get my first client. That ranged from what I felt was a brilliant idea of covering pharma conferences like PCC and PCF for Matthew Hay at Rx Compliance Report to the worst sales call of my career, trying to persuade the CCO of Cornell Medical Center to let me write their policies when I knew very little about hospital compliance.

Each day I sat down with my laptop on top of a TV tray (i.e., my “desk” in our one-bedroom apartment) trying to figure out how to sell work. I quietly prayed that I hadn’t made a tremendous mistake.

Then the call came. A former client needed help. Shortly thereafter, I had my first engagement. I could put a point on the board and, fortunately, a few dollars in the bank. I was about to get married. That felt like very good timing.

There was no twenty-year business plan. I studied Entrepreneurship in b-school and knew the statistics: roughly half of startups fail within five years. I was just hoping to beat the median. Looking back at my younger self, I’m grateful I had enough hubris to believe Potomac would be different. We leaned into our values and the idea that we should aim for excellence in all that we do.

The Building Phase

In the early years, every project began as a blank sheet of paper. We were carving a new path with a single client who trusted us as we wrote our own musical score. 

• When a client asked us to help design what became the country’s first aggregate spend system, there was no established blueprint. I sketched out some ideas on a whiteboard, thinking, “let’s build it like this.” What began as scribbled notes on a whiteboard became a project named Concerto.
• When we conducted our first live monitoring project, new team member Dan Koerner and I started by doing a couple of ride-alongs ourselves. Shortly thereafter, we were training twenty compliance and legal professionals how to do it. Our qualification? We had tried it a few times so were “experts” on what could happen in the field. 18 years later, Dan leads our live monitoring program as a Senior Director.
• When we launched our first CIA training program, we had never built an eLearning course before. It was an excuse to learn. Michael Young joined as an Analyst, downloaded Articulate, and the next thing you know we were building training modules. It was clunky and time-consuming but our client was satisfied and we met the CIA deadline. Now a Senior Director, Michael continues to drive innovation and new ways of working at Potomac.

Those early efforts were not as polished as the deliverables we create today. But they were built carefully and methodically, sometimes anxiously, and always with the understanding that clients were trusting us to get the details right.

Decade 1

We cleared the five-year hurdle but the wheels were still moving slowly, one project win at a time. Winning or losing one client made the difference between growing and staying flat. One employee leaving the company would significantly change our capacity.

Two of the most memorable stories from this phase occurred just as some of our current Directors were joining the company.

Staffing Support

A friend of mine called me to say she was leaving her company for a new opportunity.  She liked her new boss, who had just transitioned to Compliance from Legal and was going to need operational help with a CIA on its way. My friend didn’t want to leave her boss in the lurch. Relatively new Consultant Adam Oakley not only stepped into the compliance role, he scored the part of “Blair” in their internal training videos. Thirteen years later, now as a Senior Director, Adam and his team still support that client, who is now the Chief Compliance Officer. What began as a short-term need evolved into something enduring. Today, embedded and fractional compliance support is the fastest growing part of our business.

Transparency Solutions

About the same time came the first Sunshine filing. A client’s SaaS system had failed in epic fashion: the website would just spin endlessly…as the filing deadline approached. The client asked us to deploy Plan B. So, former employee Joel Norris, new Analyst Graham Rich, and I rolled up our sleeves and built an aggregate spend system using Microsoft Access. It was not elegant. But the Sunshine Report had the correct data and went seamlessly into the brand new Open Payments portal. A dozen years later, Graham heads our Transparency Service Line.

A Bahamian Getaway

Reaching ten years felt extraordinary. We had a real office in Arlington and were no longer fully remote. We had even hired our first Operations team member and were feeling more and more like a “real company.”

We celebrated with a trip to the Bahamas and what may have been the “most profitable Happy Learning” session in company history — a tutorial on how to play craps so we could bet together as a team. As former employees Spencer Rasmussen and Chris Hull threw dice against a felt table, we all scored a large pile of casino chips.

Decade 2

I am not a musical person; I can’t read music or carry a tune to save my life.  But Potomac feels like jazz at times complete with its share of improvisations (Covid), its unexpected movements (from both client and employees), yet driven by a clear rhythm and beat.  Throughout our second decade, our little band continued to add more players, taking on new challenges.

In 2018, McCulloch Cline joined as a Consultant, shortly after we began supporting a client’s Global Medical Affairs division. Three promotions later, McCulloch joined our Director team this January. He has been instrumental in building our Operational Excellence service line and now helps our clients read from the same sheet of music.

When we turned eighteen, I wrote about coming of age. Twenty feels different. More about endurance. And a feeling of much greater maturity — even in just the last two years.

Twenty Years

Twenty years is long enough for a generation to turn over.  I’ve watched compliance managers I first met as new hires become Senior Vice Presidents. Watched junior attorneys grow into General Counsels. I’ve watched people start their career and now, more and more frequently, have friends reaching retirement.  Some even become Potomac ICs as part of their second act.

All the while, Potomac has plowed forward. From the financial crisis of 2009 onward through the pandemic. We’ve moved through 5 presidential administrations, flip-flopping across the political aisle. The advantage of advising on risk for a living is that you see its rhythms. Risk rarely disappears. It ebbs and flows. And evolves.

Looking Ahead

The world of compliance and consulting will not look the same in 2031, much less 2046. Artificial Intelligence is rapidly reshaping how knowledge is shared and tasks are performed. It’s changing the way technology is deployed all while adding new risks.  Some of what we built in the early years would be handled very differently today.

Yet I believe what will not change is the need for integrity, accountability, professionalism, and discretion. Our values generate excellence. That in turn, breeds trust — the trust to apply the lessons and skills of the past to a new and evolving future.

My longstanding coach and good friend Alison recently sent me a poem. In it was a line that applies to a lot of things in life: “You will get where you are going by remembering who you are.”  

With Extreme Gratitude

With a nod to Lincoln, it feels “fitting and proper” to remember the people who built this place. Those who took risks, who stayed through uncertainty, who pushed through the unglamorous early work. There is no 20^th anniversary without them.

Since Potomac was founded, we’ve worked with more than nine score clients. Many of them have grown alongside us and are still clients today. Many others have been acquired. Some no longer exist, succumbing to the risks facing small biotechs.

To those who took a chance on us, especially when there was little brand behind “Potomac”, I am forever deeply grateful. Your confidence in us has allowed us to build the firm we are today. I can’t possibly name everyone and I sincerely appreciate those who I may have missed.

Thank you:  Cindy Cetani, Michael Shaw, Julie Kane, Marty Putenis, Christine Cullen, Beth Margerison, Jan Jacovini, Regina Cavaliere, Jim Gibney, Mark Dizon, Patrik Florencio, Steve Franchetti, Cheryl Chamallas, Garineh Dovletian, Matt Allegrucci, Melanie Polloway, Melissa Gothie, Latarsha Stewart, Jeff McHugh, Dobson Schofield, Rich Eschle, Dan Dunham, Heather McCullom, Lori Kagan, Becky Lakata, Michelle Kelly, Maria Woods, Eric Bottelier, John Petrolino, John Knighton, and Matthew Hay.

To our former team members: you helped build the foundation. Even though your path led elsewhere, your fingerprints remain on this company.

Thank you: Joanne Wyman, Ian Hermann, Sheeba Dandurand, Joel Norris, Chris Hull, Spencer Rasmussen, Shannon Ropeleski, Eric Davis, Christian Malias, Pat Wallace, Rawan Fusisi, Whitney Halperin, Kelly Schaller, Paul Mariano, Carla-Marie Ulerie, Rachel Bunting, Chris Allen, Jenni Heo, Julia Tubridy, Kate Bell.  

To my friends who, whether formally or informally, have helped advise me or Potomac, from operations to strategy. Or just being a sounding board for my crazy ideas.  

Thank you: Alison Whitmire, Noah Shannon, Michael Kelberg, Keith Moss, Josh Tuzman, Ben Ellis, Regina Krasner.

To our current team — our 25 employees, 12+ independent contractors, and the many third parties that currently support us: You are the daily proof that this company is far more than the person who started it. We have an amazing team and are committed to moving forward with intention as we look to lead, build solutions, solve problems, and advise our clients.

Twenty years ago, I hoped I hadn’t made a tremendous mistake. Today, I feel immense gratitude and pride. Gratitude for the effort taken, the relationships formed, the excellence of our work, and the opportunity to lead a company that has lasted for 20 years.

Score 1 for Potomac. And thank you to everyone who made it possible.

Life as a Compliance Monitor

How Experience Transforms Live Monitoring from “Gotcha” to a Strategic Advantage

Some roles in the life sciences industry operate quietly in the background, rarely spotlighted, but deeply consequential. Live monitoring is one of them.

After years of serving as a live monitor for life sciences compliance programs, I can honestly say it’s one of the most fascinating seats in the house. You’re present for the strategy, the science, the sales execution, and the real-world interaction between industry and healthcare professionals. Most importantly, you’re there for one reason: to support these crucial activities by minimizing compliance risk.

What a Live Monitor Actually Does

To many outside of Compliance, “live monitoring” may seem straightforward: attend a program, watch for a violation, and submit a checklist. In reality, it’s far more nuanced.

The real value of an experienced live monitor comes from simultaneously:

• Assessing adherence to FDA regulations, OIG guidance, and the PhRMA Code
• Understanding the scientific nuance of the product
• Evaluating message alignment with approved materials
• Picking up on fair balance and on-label discussions in real time
• Observing speaker conduct, audience engagement, and environmental factors
• Identifying potential risks, both subtle and overt
• Remaining inconspicuous while doing all of the above

You listen for what’s said and sometimes what isn’t. You observe context, slide transitions,

Q&A handling, meal compliance, and the overall tone of the discussion. Effective live monitoring requires regulatory fluency, situational awareness, and a calm presence.

As an experienced monitor, what sets me apart from someone new to the industry is my understanding of how teams accomplish their objectives without compromising compliance. I clearly communicate expectations ahead of the monitoring event and practice discretion throughout. My role is to observe, not disrupt.

The Art of Discretion

One of Potomac’s core values is also one of the most important (and least discussed) skills of an experienced live monitor: discretion. I’m not there to “catch” people.

My purpose is to protect:

• The integrity of the event
• The compliance framework of the organization
• The professionals who are doing their best to operate within complex regulations

A strong monitor knows how to read a room without disrupting it. I maintain neutrality and avoid becoming the center of attention. In essence, I observe without influencing. Done well, most people barely notice I’m there. And that’s the point.

Experience Changes Everything

Effective monitoring isn’t just about observation, though. The noticeable difference between basic observation and seasoned monitoring is insight gained through experience. Experience allows you to:

• Distinguish between minor deviations and true compliance risk
• Recognize patterns across events, not just isolated issues but systemic problems
• Identify early indicators of potential off-label drift
• See areas where the business lacks awareness and needs additional training
• Understand commercial pressures without compromising regulatory standards

Over time, you build a sense for risk before it fully materializes, through subtle phrasing, repeated emphasis, lingering on a slide too long, or a Q&A response that edges over the line. You learn that compliance risk rarely appears dramatically; it accumulates quietly. In my time as a live monitor, I’ve developed an awareness that draws from experiences in hundreds of rooms, across multiple therapeutic areas, formats (live, virtual, hybrid), and audiences. This awareness enables me to deliver meaningful insights grounded in the needs of the client, the strategy of the compliance department, and the subtleties of the regulatory environment.

The Human Side of Compliance

What I’ve learned most in this role is that compliance is deeply human. As my colleague Jon wrote in AI and You and I, “Compliance Programs are ultimately about behavior change … and we’re finding that meaningful change still requires interpersonal, human-to-human connections.”Behind every speaker program, field ride along, advisory board, etc. are professionals trying to balance education, engagement, business objectives, and regulatory expectations, and they are often very nervous when they learn they are going to be monitored. I maintain an inviting demeanor and keep a bright smile on my face to set them at ease, and I listen with empathy when they share about any nervousness. In this way, I build trust and rapport and deepen the human connections our clients care about while monitoring. And when the professionals in the field trust their compliance partners, it enables them to engage ethically with healthcare professionals. It supports patient trust and reinforces industry credibility.

Why Experienced Monitoring Matters Now More Than Ever

Regulatory scrutiny continues to evolve. Transparency expectations are higher. Yet attention spans are shorter, even as compliance requirements are expanding.  And the pressure to “make the numbers” is as high as ever. In this environment, experienced live monitoring can be a strategic asset, rather than a check the box exercise. Perhaps most importantly, when done right, it enriches the culture of compliance in the business without creating fear.

A Seat Worth Having

Live monitoring may not be flashy, and it doesn’t always get the recognition it deserves. But from where I sit, it’s one of the most meaningful roles in life sciences compliance. It requires vigilance without disruption, authority without ego, confidence without arrogance. After years in the field, I’m proud to bring a welcoming presence to every event I attend. Because in our industry, the details aren’t small things. They’re everything.

Fun and engaging ideas for a memorable Compliance Week this Fall

It’s that time of year again – changing leaves and shorter days mean it’s the season for corn mazes, carving pumpkins, college football…and Compliance Week! While your colleagues are likely itching with excitement for the first three, would they say the same about Compliance Week?

Coming up with new and engaging programming is challenging and time-consuming, and each Fall we get asked, “How can we spice up our Compliance Week?” or, for our repeat clients, “How can we outdo what we did last year?”

This year, we’ve decided to proactively pull together our recommendations for low-cost, creative activities that build an engaging Compliance Week and share with the broader compliance community.

1. Identify A Goal

Before selecting activities, it can be helpful to start by aligning on a goal for the week. The Society of Corporate Compliance and Ethics describes “awareness, recognition, and reinforcement” as the core principles for Corporate Compliance and Ethics Week.

More specifically, though, what outcomes would you like to see or what behaviors would you like to reinforce? This can help focus your messaging for most impact. Consider, for example:

• Are you trying to do some Compliance PR? Compliance can be scary for employees who mostly associate it with investigations and discipline. Others may associate it with boredom, recalling slogging through required trainings and read-and-attest policies. A well-executed Compliance Week can help break down those preconceptions and focus on engagement and approachability.
• Are you aiming to strengthen lines of communication with the business? You may have employees who are looking to engage more with the Compliance Team but don’t know where to look or who to contact. Compliance activities can be designed to guide employees to your Compliance intranet page or establish live or virtual face-to-face contact with your team.  How can you make your team even more approachable?
• Is there a particular topic you want to clarify or emphasize? You can develop your themes and programming to highlight trending or high-risk compliance areas, perhaps tied directly to your compliance risk assessment.

In many cases, all of the above are true. The important piece to remember is to not try to tackle too much. It’s better to deliver on one goal than to do some of everything and overwhelm.

2. Decide on Your Activities

Now for the fun part! We’ve compiled the list of ideas and inspiration for interactive Compliance activities across both live and virtual audiences. Consider adding incentives to up the stakes, either by offering entry in a prize raffle for participation or by awarding prizes based on a leaderboard.

Engaging Games:

• Two Truths and a Lie: This activity is particularly effective for getting to know the Compliance Team. Present participants with 3 statements and ask them to determine which is the false one.  For virtual, include the 3 statements for each team member in the department and reward the top score.
• Compliance Wordle: Plenty of sites have popped up offering a “create your own wordle” option.Each day of Compliance Week, send out a custom Wordle puzzle with compliance-themed words (e.g., Value, Guide, Trust). This is a low-effort but enjoyable and familiar game for employees.
• QR Code Scavenger Hunt: Place several QR codes around the office, starting at the Compliance booth. Each QR code leads participants to solve a Compliance riddle to find the next code. Completion of the final question earns them a prize or raffle entry.

Trivia with a Twist:

• Giant Jenga: Most folks are familiar with the classic block game. The big version is the perfect eye-catching activity to draw people over to a booth in the office. On each of the blocks, add a knowledge-based question the participant needs to answer to win an award (small prize) or face a consequence (such as having to go again!).
• Putting Challenge: Set up a small mini golf putting green and assign trivia categories to each hole on the green. Categories could include Compliance Team get-to-know-you questions, policy quizzes, or general fun facts. After putting into a hole, participants answer a question from that category to enter the raffle. A hole-in-one grants an automatic raffle entry!
• Spin the wheel: Have participants spin a wheel (either live or virtually) to pick a Q&A quiz category. Categories may be topic-focused (e.g., social media, cross-functional interactions, meals) or format-focused (e.g., Pictionary-style draw-your-answer, act it out like Charades).

Creative Communication:

• Compliance Week Playlist: Make a Compliance topic soundtrack for your Compliance Week with an AI song generator. You can share the playlist internally and use it for background tunes at a booth. You can also get the whole organization involved by requesting mad-lib style Compliance terms – the best submissions get featured and a shoutout in the playlist!
• Videos from Leadership: Share some short, “TikTok” styled video messages from company leadership throughout the week to highlight the importance of Compliance and demonstrate leadership commitment.

• Compliance Comic Strip: Create characters and tell a series of brief stories with a daily Compliance comic strip. For added fun and familiarity, make members of your Compliance Team the stars of the story.
• Compliance Selfies: Think Snapchat or Instagram filters but with your Compliance Week brand, theme, or slogan. Employees can send in their best pic to enter a Compliance Selfie Competition.

3. Get the Word Out There!

Have other fun ideas to get your teams in the Compliance Week spirit? Feel free to connect and share with us!

Potomac’s Internships Provide Opportunity to Make a Lasting Impact

How to Have a Better Summer

Every year, Potomac invites a bright group of rising college seniors to contribute fresh perspectives, work on engaging, self-driven projects, and test drive a career in management consulting. Our summer interns work at our office in Arlington, just outside Washington D.C., learning the ins and outs of the life sciences industry and developing healthcare compliance experience. Through Potomac’s internship program, they get the chance to gain insight and exposure to client‑facing work while also learning about the inner workings of a consulting firm.

Three Elements, One Big Impact

Potomac’s intern program team designs the summer experience around three mutually-reinforcing elements:

2) The Individual Project: Own a piece of Potomac
Each intern develops and presents a standalone project that advances a firm resource. They take a deep dive into Potomac’s capabilities and ways of working. This summer’s projects included developing AI-centered resources for Potomac’s Launch Pad policy toolkit, synthesizing improvements to our Retro Monitoring framework, and exploring uses for a new eLearning tool. Through the individual project, interns get the opportunity to build project management experience, show off problem solving skills, and learn to present their own recommendations. At the end of the summer, interns can point to the workstream they’ve owned, see a finished product, and say, “I built that.”

Over the last year, I’ve been on at least five calls with companies where I’ve said, “I don’t think you need Potomac’s support, save your money for now.” Each time, the companies have been more than a year away from launching their products and are already asking about deploying a software solution to meet their Sunshine Act reporting obligations.

Don’t get over sold… if you’re more than a year away from launch, you do not need to purchase a software solution for transparency reporting. That’s far too early. Don’t rush.

When do I need to begin collecting data? When do I file my first report?

FDA approval is a milestone worth celebrating, so enjoy it! But it also exposes your company to a whole new set of compliance obligations. If your product is reimbursed by Medicare, Medicaid, or CHIP, you have a Covered Product and are very likely on your way to being considered an Applicable Manufacturer under the Sunshine Act.

There’s some good news: designation as a new Applicable Manufacturer qualifies for a 180-day grace period from when the product becomes first available for purchase before manufacturers are obligated to start CMS data capture. Therefore, the earliest payment that you’ll report to CMS is at least six months after launch.  

Keep in mind that many of the states aren’t quite so accommodating and do not have the same 180-day grace period. So, depending on the industry (rules vary between pharma and device) and states in which you operate, you may have state reporting obligations at launch.

A Roadmap for Implementation

Capturing and reporting data for Sunshine reporting may seem like a daunting task but it doesn’t have to be a full-time job and you don’t need complicated or expensive systems to fulfil your reporting obligations. I’ve helped numerous companies launch their transparency programs and each company faces a different set of challenges when launching. Following these steps can help you better prepare:

Step One: Examine Your Spend

First, critically examine your internal infrastructure and determine if your existing framework has the capacity to capture appropriate data. Conducting a comprehensive spend inventory will help you prepare for data capture and the launch of a transparency system. A spend inventory offers clear insights into your spending and about the process you plan on using to capture the data. This doesn’t mean you always need to integrate an IT system; in many cases, Excel works just fine.

Step Two: Configure Source Systems

Not all life sciences companies are the same and neither are their source systems! For new companies, the first system I recommend focusing on is your highest-volume system, usually the T&E system (most frequently Concur in the life sciences industry). Implementing a tool to allow users to search for HCPs within your T&E system instead of manually entering information is one of the best investments you can make in the early stages. It will save you and your team headaches and time during reporting. Beyond T&E, it’s helpful to have a plan on how you will capture other areas of spend such as ERP direct payments, third-party vendor payments, reprints, and any other area identified in Step One.

Step Three: Determine Your Best Reporting Option

For most companies, investing in a flashy new system or hiring full-time support can be time-consuming and costly when resources are limited and there aren’t enough hours in the day to complete everything needed for launch. In my experience, most companies simply need to analyze their existing infrastructure and procure supplemental resources or external assistance to fill the gaps.

How Should my Approach to Transparency Change Based on Organization Size?

Level 1 (<10 Reps): Smart Manual Solutions

For companies with a sales force of 10 representatives or fewer and minimal reportable transactions, your entire CMS reporting can likely be handled via Excel. There are also companies that focus on manual reporting options at extremely cost-effective prices.

Level 2 (10-50): Managed Services

Companies with 10-50 representatives often have enough complexity to need real infrastructure but not enough to justify a large technology investment in a SaaS solution. Hiring a managed services firm for outsourced support is an efficient and simple approach to fulfilling reporting obligations. Managed service firms help companies with limited volume navigate data management. For example, my team at Potomac uses our in-house aggregate spend database, WholeSum, to collect, remediate, and report your data without the overhead and effort associated with implementing and running SaaS Transparency solutions.

Level 3 (50-200): Fractional Support

For higher volume companies, reporting can be streamlined by using SaaS solutions that automates data collection from various sources, generates reports, and provides the company with greater access to their data for monitoring and other purposes. However, a SaaS system does not necessarily require a full-time transparency resource. There are companies, including Potomac, that provide fractional transparency team support to allow your team to focus their attention on other areas of your compliance program. Transparency experts are typically the busiest during “reporting season,” the period from January-March before Open Payment reports are due. But there is often less to do throughout the year, making it difficult to justify a full-time headcount.

Level 4 (200+): Transparency FTE

If your company has over 200 representatives, you will likely need to build out a larger-scale transparency program that likely includes licensing a SaaS solution and hiring a full-time resource. There are still decisions to be made about the seniority level of the employee and whether they are primarily leading the program with support from others or with a data steward who is an expert at getting data into the SaaS system, remediating errors, and analyzing data for accuracy. 

The Grace Period (And How to Use it Wisely)

Don’t Overcomplicate It

Getting FDA approval for your first product is exciting! I know that comes with pressure and that pressure is real. But launching a transparency program doesn’t have to be a lonely (or expensive) sprint. The best programs are the ones that start simply, build steadily, and fit the solution to their company. Don’t get oversold…

 

When life sciences compliance teams build monitoring plans, they often start with a broad list of activities such as speaker programs, advisory boards, and charitable contributions.

Start with the Activity – Then Go Deeper

At first glance, it might seem like your compliance team should start with regulatory risks like kickback or off-label promotion when developing a monitoring plan. But Potomac has found it’s more effective to begin by understanding the full scope of what your teams are doing. Listing out activities serves as the foundation for identifying risk and can complement your compliance risk assignment to directly align to your monitoring plan.

Once you have your list of “umbrella activities”, ask yourself and your team: Are the risks different, even within the same type of activity?

The answer is almost always yes. And that’s where segmentation comes in.

Why Segmentation Matters

Segmentation means breaking down your umbrella activities into smaller categories that reflect different risk profiles. That could include:

• Format (live vs. virtual)
• Audience (patients or HCPs)
• Product profile (new launch vs. established; high off-label use or not)
• Varying risk tolerance across business units
• Geography (U.S. & international, regions/territories, etc.)

For example, live speaker programs for a newly launched therapeutic area might require closer scrutiny than a mature brand presenting data on a new indication.

By segmenting, you’re no longer saying, “We’ll monitor 10% of speaker programs.” You’re defining which ones, why, and how often based on a defensible risk rationale. Segmentation becomes increasingly important for mid-size and large life sciences companies considering the high volume of business activities. As an added benefit, this approach helps ensure your monitoring team work efficiently while focusing on the most critical compliance risks

Visualize the Approach

The graphic below illustrates how a broad activity like “speaker programs” can be broken down into manageable, meaningful segments. Applying multiple layers of segmentation allows you to hone in on the most relevant risks and prioritize with greater precision.

Even if you don’t have exact volumes while segmenting your activities, that’s okay. Use historical data, your annual needs assessment, annual budget plans, and business strategy to make informed estimates and update your plan as you learn more about activity volumes.

Build a Flexible Plan

Once you’ve identified your high-risk segments, build a plan that balances:

• Risk-based reviews (targeted where you’re most vulnerable)
• Randomized sampling (to catch blind spots and establish baselines)

Then make segmentation and risk review an annual exercise. Risks shift. Controls evolve. Revisiting your segmentation regularly keeps your monitoring plan relevant and proactive.

Use Monitoring as a Strategic Tool

With an organized, segmented approach, your monitoring plan becomes more than just checking the box on compliance requirements. Your compliance program is becoming more effective, turning monitoring into a tool that helps you understand and gain visibility into your business activities, detect and mitigate risks, and strengthen your controls over time.

So, the next time you revisit your compliance program plan and monitoring goals, don’t just ask what you need to review – ask how you can segment smarter to focus on what matters most!

Potomac is Here to Help Bring Clarity

“Umbrella activities”, segmentation, selections – oh my! Potomac is excited to cover the key concepts of segmented monitoring plans at PCF 2025.

Join me alongside a panel of pharmaceutical and medical device industry experts to learn more about building a smarter monitoring plan.

“It was the best of times, it was the busiest of times”

A full year has passed since my last article, though not for lack of ideas or industry developments. I kicked off last year with a goal to write more. For a while, I did just that—then business picked up… and before I knew it, a year had flown by.

Now that the dust has (momentarily) settled, I wanted to share what is current in our latest Currents. 

I thought the best place to start was musings from the latest Pharmaceutical Compliance Congress (PCC) where AI was all the rage…

Experts Create Better Prompts

From the main stage, my friend Daryl Kreml provided an anecdote very similar to our experience with AI. With apologies for anything I misattribute, Daryl explained how he asked GenAI to develop a policy on funding for independent copay foundations. The first draft was appropriately formatted and well-organized, but lacked specifics to help control risk. Like someone new to the industry writing a first draft. A second prompt got closer, more akin to an experienced compliance professional. A third prompt focused on adding in controls from specific DOJ settlements, prompted based on Daryl’s own bank of knowledge and experience. On the third try, the GenAI pulled together a policy that could go forward more or less unedited. 

It took 20 minutes, because of 20 years of experience. 

How do we train the next generation to be experts?

This was one of my favorite discussions (from late at night at the hotel bar, where the best conversations take place). If experts do it best, how will the next generation learn to be experts once AI is everywhere? How do we ensure they develop the required knowledge and judgment to be elite users of AI?

These are difficult questions and while I don’t have the answers I thought I would share my thoughts on some key parameters. 

On Tuesday, three members of our Class of 2026 internship program will join us for the summer. To put things in perspective, they were about 3 years old when the first iPhone came out. They cannot remember a time when they have not had access to an incredibly powerful computer in their pocket. While some of us Gen X’ers (and older) remember the days before the Internet when we had to memorize facts and dates, an entire generation has grown up asking Siri for any fact or figure (or DOJ settlement). Now Gen AI provides not just the knowledge of the Internet but a very strong helping hand. Our job as leaders is to provide our teams with structure to effectively use these powerful tools.

In the absence of memorized knowledge, we need to teach our teams to prime the AI by adding a research step to the queue of prompts, ideally before diving into the task. For example, before starting a policy on co-pay foundation funding, ask the AI questions about settlements and risks. 

Prompts like:

• I am going to ask for help in drafting a policy on pharmaceutical companies providing funding to an independent co-pay foundation. Before you do so, can you provide a list of risks that companies should be aware of?
• Can you provide information on recent settlements related to co-pay foundation funding so I can brush up on the topic.
• What were the key findings from these settlements?
• What changes did pharmaceutical companies make based on these enforcement actions? What do enforcement agencies expect now? 
• Can you help me write a policy in clear, easy-to-understand language that addresses these specific risks?

The results of this series of queries can be viewed here.

Where Do Compliance Professionals Fit in Today’s Post-AI World?

The most common question we heard was, “Do you think AI is going to take my job?” People across the country are thinking about this, not just Compliance professionals. 

Compliance Programs are ultimately about behavior change. AI can help develop policies, procedures, communication, and training. AI monitoring engines can point out data outliers for further evaluation. But Compliance is more than just policies and training—it’s about persuading people to do the right thing. And monitoring is more than running algorithms to identify risk. It’s the ability to understand nuance and identify root cause(s) of observations to be able to make systemic changes, not “gotcha” compliance programs. We’re finding that meaningful change still requires interpersonal, human-to-human connections.

So here are some of the areas we think are unlikely to change soon and where we are focused right now. For our in-house colleagues and clients, these are also areas that are likely to remain AI-free for the intermediate time-period and may be good areas to focus career paths, especially for those that are earlier in their careers:

Reflections for Future Currents

If last year taught me anything, it’s that writing every month may have been an overly ambitious goal. This year, we’ll be mixing it up. You’ll hear from others across Potomac, with other voices joining the conversation—and likely, a little help from our friend ChatGPT.

Hamlet-Inspired Rationale for the Thoughtful Use of AI

The Increasing Prominence of AI for Compliance Professionals

If you took a drink every time you heard the word “AI” at the recent Pharmaceutical Compliance Conference (PCC), you’d have been drunk before 10 AM. It seemed as if every presentation mentioned “AI”, including several exclusively focused on the topic.

“To AI or Not to AI?”

Many of the discussions centered on whether companies should use AI.

In one corner were those emphasizing the impact AI can have in streamlining manual tasks and advancing data analytics. Oversimplified, no need to hire, AI can do that.

In the other corner were those claiming that AI can never (or at least not in the near future) replace the human component of compliance programs.

The naysayers added that AI creates a myriad of new risks for the organization including access to confidential information, privacy concerns, and potential for error and put simply, needs to be approached with extreme caution.

With apologies to the Bard, I believe “To AI or Not to AI”? is the wrong question. Like the debate on rules vs. values-based compliance programs, the answer is both.

Generative AI is here to stay. And for any who refuse to approach it head on, I cite Hamlet’s Queen Gertrude — “the lady doth protest too much, methinks.”[1] Let us not be like Hamlet and allow our conscience to make cowards of us all. Instead, let’s focus on three critical questions:

1. What is AI best at?
2. How do we use generative AI effectively?
3. When should we not use AI?

I conversed with ChatGPT to flesh out these questions and found it immensely helpful. All text in blue was drafted by ChatGPT (often edited for brevity). The subsequent Hamlet quotes were largely identified by ChatGPT — including one from Henry IV. More on that later…

[1] Please note, gendered language used throughout this piece is specifically from Hamlet, written in ~1600).

What is AI Best at?

Automation of Repetitive Tasks

“Though this be madness, yet there is method in’t.” – Polonius

First and foremost, AI — and technology more broadly — should be used to automate manual processes. At Potomac, we often talk about the importance of sharpening your saw as conveyed in the 7 Habits of Highly Effective People. Undo the madness of performing the manual activity, identify the consistent method to it, and automate it. Technology is great at this.

There are many use cases for compliance professionals. Some are easily identifiable and have been available for years, such as aggregate monitoring and automated sanction screening. Others are newer, such as using tools like Microsoft Copilot to reduce formatting time. I cringe watching transparency professionals look up HCPs one at a time in the NPPES registry (if you do this, please, please reach out to me to stop that madness).

And as natural language processing continues to improve, there will be a growing host of automatable functions. For example, highly educated (and compensated) human beings in the Medical Affairs function frequently review doctors’ résumés to “tier” them as part of a “fair market value” assessment. In the future, this first pass could and should entirely be handled by machines.

Enhancing Creativity

“There are more things in heaven and earth, Horatio, than are dreamt of in your philosophy.” – Hamlet

The potential of generative AI in ethics and compliance transcends our current understanding, offering opportunities for innovation and advancement that may surpass our wildest imaginations.

Generative AI is exceptional at expanding initial idea generation. In Hamlet, the “play’s the thing.” When dealing with AI, you could say “the prompt is the thing.” The key is knowing where and how to prompt the discussion. Because Generative AI is best when building on existing creative ideas. It becomes an instant group brainstorming session. If you have an inkling of an idea, ask the AI for more. See what it says, and then ask for more details. It’s like having colleagues working with you on a whiteboard.

I don’t know about “surpassing our wildest imagination.” Maybe I haven’t mastered prompts. But in building this piece, I initially asked for Shakespeare quotes to help support this piece. When it provided an example from Hamlet, I pivoted and asked for more quotes from Hamlet and how to tie those quotes into my central theme.

If Hamlet is not your thing, ask generative AI for lyrics from Taylor Swift songs that relate to your latest Code of Conduct training. Or famous movie quotes…or…. Like any good brainstorming session, you’ll get good ideas and bad ideas; the key is to zone in on what you want to keep.

Motivation

“Something is rotten in the state of Denmark.” – Marcellus

I’m feeling a little “unmotivated” to write this one.

I submitted the following prompt to ChatGPT, “Can you tie the concept of motivation to starting something new with the quote “Something is rotten in the state of Denmark.” Aiming for something centered around how hard it is to get going when you are feeling “rotten” or unmotivated.“ (Note: I have edited the text below for length by deleting redundant paragraphs).

“Something is rotten in the state of Denmark” serves as a poignant metaphor for the internal state of disarray or discontent that can hinder our motivation to embark on new endeavors. Just as the characters in Hamlet confront the pervasive sense of corruption within their society, individuals grappling with feelings of disillusionment or stagnation may find it challenging to summon the motivation needed to initiate change or pursue new opportunities.

However, just as Hamlet ultimately confronts the corruption within his kingdom and takes action to restore order, individuals can overcome their internal barriers and find the motivation to initiate change.

Staring at a blank sheet of paper is hard. Generative AI can be a useful starting point to get a first draft moving. It need not cover everything but can help overcome that initial inertia. Especially when you are feeling unmotivated to tackle the corruption within your kingdom.

How do We Use Generative AI Effectively?

Validate Independently

“Doubt thou the stars are fire, Doubt that the sun doth move, Doubt truth to be a liar, But never doubt I love.” – Hamlet, as read by Polonius

“Here’s a list of 30 additional Hamlet quotes… 26. “The better part of valour is discretion.”

To which I immediately asked ChatGPT where I could find that quote in Hamlet. It responded:

“The better part of valour is discretion” is a famous quote from Shakespeare’s play “Henry IV, Part 1,” spoken by Falstaff in Act 5, Scene 4.

For those looking to use Generative AI to help provide compliance answers to complicated questions via chatbots and similar tools, I have serious concerns. While natural language processing is improving, there is still a tendency by GPTs to “hallucinate” and guess at responses even when facts are straightforward and easily verifiable. It’s obviously harder when different words are used in the questions than those specifically stated in the policy or training are fed into the system. There is a real risk of providing inaccurate guidance.

Others have covered this topic much better than I can. Maybe these hallucinations are the ghosts of Hamlet’s father. Over time, I imagine AI hallucinations will improve, potentially immensely. But right now, answers unchecked by human eyes can be troubling. “Doubt truth to be a liar.”

Edit for Clarity and Conciseness

“Brevity is the soul of wit.” – Polonius

Polonius’ wisdom reminds us of the importance of clarity and succinctness in communication.

GenAI ≠ “Clarity and succinctness.”

A friend and colleague of mine (who inspired this article) mentioned at PCC how much bad writing we’ve fed into the AI engine. It has not learned to be concise. Edit the output.

Organizational Preparation

“The readiness is all.” – Hamlet

ChatGPT did a good job with this one. I’ll let it explain:

Hamlet’s profound realization before the climactic duel with Laertes speaks to the importance of preparedness. When it comes to automating repetitive tasks with AI, readiness in terms of data preparation, infrastructure setup, and organizational alignment is crucial for successful implementation.

For those looking to use AI to develop risk-based insights, I’ll remind everyone of the importance of data quality: garbage in, garbage out.

And there must be organizational alignment on how and when to use AI securely to prevent loss of confidential information, protect privacy, and be net beneficial to compliance efforts.

When Should We Not Use AI?

People and Culture

“This above all: to thine own self be true.” – Polonius

Polonius encourages Laertes to prioritize authenticity and self-awareness…to maintain one’s integrity and moral compass…

Human interaction plays a crucial role in fostering trust and building relationships, especially in compliance investigations and audits….

Ethical dilemmas and complex compliance decisions require human expertise to consider factors such as intent, mitigating circumstances, and ethical implications…

Humans are better equipped to communicate findings, address concerns, and collaborate with stakeholders…

Human oversight is essential to ensure that AI systems are deployed ethically, responsibly, and in alignment with organizational values and regulatory requirements.

Our role as compliance professionals must expand with AI. We need to shift our own focus from the monotony of following the black and white “rules” towards the gray area of “values.” We need to step up our game and show thoughtfulness in evaluating complex scenarios. Only humans will be able to solve new and evolving compliance concerns that cannot be fed into the algorithms.

The job for building and enforcing the company’s culture will remain the job of the Compliance Officer. At the heart of that is our individual relationships with people. AI will not replace that.

Reflections on Potomac’s First 18 Years

Potomac turns 18 today. For Jewish people like me, the number 18 has special meaning. It stands for “life.” As Tevya sings in Fiddler on the Roof, Jews say “L’chaim!” which generally translated means, “to life.”

About Hebrew numerals

When I was in second grade, we learned Roman numerals in school, which was important if you wanted to read Super Bowl logos. My local team, the defending champion (at the time named) Washington Redskins, got crushed in Super Bowl XVIII to the hated (at the time) Los Angeles Raiders. All of us in the DC-area knew XVIII meant 18.

Ancient Hebrews also used letters to represent numbers. Each of the letters in the 22-character Hebrew alphabet represented a unique number. Rather than using five characters to represent 18, you only needed two.

The word chai (life) is made up of two letters: ח ( “chet” with a “kh” sound as in the guttural German pronunciation of “Bach”) is the 8^th letter of the alphabet so = 8. And The letter י (pronounced “yood” like yellow) is the 10th letter of the alphabet so = 10. These two letters form the word chai and add up to 18.  This is why the number 18 is associated with life.

L’Chaim – To Life and For Lives

While L’chaim generally means “To Life,” the “L-” sound up front is translated as both “to” and “for” in English. The word chaim is the plural of chai, so is more accurate as “lives,” not just one life. Put together, “For lives” is just as accurate as “to life.”

Some have claimed that l’chaim “expresses the idea that no one can live life alone. We all need someone else. There’s no point in toasting to life alone.” It’s not about one life – it’s for lives.

Reflecting on my life and Potomac’s lives

For the last 18 years, I have had a hard time separating my life from Potomac. I’ve admitted to my team on many occasions that I often take criticisms of Potomac as personal criticisms. When something goes wrong, I wonder what I could have done differently to have prevented it. On the external side (especially in the early years of the company) we worked hard to brand Potomac as being unique from “Jon’s company.” But personally, I felt like there was little separation between Jon’s life and Potomac’s life. It seemed like one life.   

But there is no point in toasting to life alone. We all need someone else. And to get to 18 years, I’ve had the benefit of working with many, many hard-working and dedicated people. We’ve had and currently have an incredible team. 

I am truly grateful for the more than 100 people who have worked for the company, whether as employees, independent contractors, or our third-party support partners. I am proud of the relationships built over the last 18 years. I have danced at our employees’ weddings, met their new babies, and wished others well as they left us for business school or other pursuits.  In several cases that included becoming our future clients.

I am especially appreciative of our senior team, who have worked tirelessly to embed our values of integrity, accountability, professionalism, and discretion into all that we do. Many of our team members have been with the company for more than 10 years. We would not be the company that we are today without their unwavering dedication.

The picture on the left below is from 2016 and of the 11 people pictured (besides me), 6 are still current team members—from left: Carla-Marie Ulerie, Adam Oakley, Meredith Swartz, Michael Young, Dan Koerner, and Graham Rich. I’m proud of that longevity.

Reflecting on our clients’ lives

We’ve had the privilege of working with over 150 companies and thousands of people.  Over time, I’ve watched as our client leads have gained promotions and changed roles, taken on wider responsibilities, or in some cases, opted to downshift and/or retire.   

Over 18 years, you get to know some of the people at those clients very well.  We work hard to become an extension of our clients’ teams and, in some cases, like our co-workers, our clients become our friends.  I’ve heard stories about weddings and divorces, babies being born and kids going off to college, exciting vacations to far-away places, and debacle home renovations.  This past month, one of my earlier and most fun-loving clients passed away relatively suddenly. That one touched a nerve – wasn’t prepared to add funerals to this list.  

18 = Becoming an Adult

About 10 years ago, a client described her company as a “gangly teenager” that was going through the awkward phase that many teenagers do. I hadn’t really thought about companies maturing in a similar way to humans but the more I thought about it, the more I realized it was true:

• Start-ups, like babies, need constant help and support.
• Young companies keep trying to make themselves seem older.
• Teenagers go through emotional growing pains, balancing not being a startup / kid anymore but not having the infrastructure / maturity of a full adult

And now, we’re 18 and Potomac is supposed to be an adult. In some ways, I feel like I’ve been preparing for this day for a while, getting my child Potomac ready to go off to college. Especially over the last year, when we’ve pursued a project appropriately named Operation Evolution. Part of its focus is to make the business less dependent on me. This included changing my role to allow the company the space it needs to grow and mature. And give me time to write these types of articles. 😊

Meanwhile, our senior team has stepped up and taken on additional responsibilities –ranging from Finance to HR to Business Development. The transition has been hard at times, but we are evolving and making progress.

Evolution is necessary to sustain life (and business). There will be more change to come as we work through new structures, processes, and approaches to remain a sustainable, long-term business.  We are committed to maintaining the level of excellence and teamwork that has marked the first 18 years of our life.

I personally look forward to also evolving my role back to where it started. Completing the circle of life, if you will.  In the months ahead, I am hoping to spend more time working directly with our clients.  I love wrestling through their most complicated issues, working together to make our industry more ethical.  And ultimately safer for the lives of patients.

In closing, I pledge to continue to work to make a difference in the lives of our team members and our clients. We will continue to be a great company that people want to work for and work with for the foreseeable future.

L’chaim. For lives.

To receive email notifications when new Currents arrive, click here