New compliance rulesOn consecutive days last month, both the Consumer Product Safety Commission (CPSC) and the U.S. Food and Drug Administration (FDA) made clear that delays in reporting potential product hazards or defects could significantly damage a company’s reputation and bottom line. The message from these agencies is clear—manufacturers and distributors of products regulated by CPSC and/or FDA would be wise to ensure their product quality processes and compliance programs enable swift communication to regulators and the public. On January 18, FDA Commissioner Scott Gottlieb announced the publication of a draft guidance that “better describes the FDA’s policy on public warning and notification of recalled products as part of [the agency’s] effort to ensure better, more timely information reaches consumers.” The next day, the U.S. Department of Justice announced that a federal district court awarded $5 million in civil penalties in an action brought on behalf of the CPSC against a pharmaceutical company for alleged violations of the Poison Prevention Packaging Act (PPPA) and Consumer Product Safety Act (CPSA), including its failure to “immediately” notify the CPSC once it discovered that its products were not compliant with the PPPA.

The FDA’s draft guidance applies to voluntary recalls of all products under FDA’s purview, including food, drugs, medical devices, and cosmetics. It comments on a variety of issues associated with product recalls, including whether the general public should be informed, and, if so, what the content and method for communication should be. With respect to timing, the draft guidance notes that the agency’s expectations will be driven largely by the nature of the risk presented by the individual recall, although it generally expects firms to issue a public warning within 24 hours of FDA notifying the firm that it believes a public warning is appropriate.

Notably, the draft guidance explains that FDA has the authority to issue its own public warning or to supplement a company’s communication, which it will exercise whenever deemed necessary, such as when the firm’s warning is not “prompt or effective.” Although the agency has long held this authority, the inclusion of this statement could signal a greater willingness to exercise it where companies fail to meet expectations. Although the reputational damage resulting from a public warning issued by the agency may be difficult to quantify, this is a significant “stick” that FDA appears increasingly willing to wield.

The damage to Dr. Reddy’s Laboratories, Inc. (Dr. Reddy’s) for alleged violations of the CPSA and the PPPA is more easily quantifiable. The consent decree, which included a $5 million civil penalty and compliance monitoring requirements, marks the conclusion of a nearly six-year investigation. This consent decree represents the first civil penalty against a drug company for allegedly knowingly distributing products in violation of the PPPA child-resistant packing regulations and for failing to notify the CPSC about the noncompliance.

The government’s complaint alleged that Dr. Reddy’s imported, manufactured, and distributed five household oral prescription drugs that were legally required to be in child-resistant packaging. Despite an internal report that noted the failure of this packaging to comply with CPSC rules, Dr. Reddy’s continued to manufacture and distribute the drugs in this noncompliant packaging—for several months—while concurrently developing compliant replacement packaging. The complaint cited the company not only for shipping products in violation of the rules, but also for failing to comply with the CPSA requirement to “immediately” (interpreted by regulation to mean “within 24 hours”) report to the CPSC information relating to a product’s failure to comply with the PPPA. Dr. Reddy’s allegedly waited almost fifteen months after publication of the internal report to notify the CPSC that its packaging was potentially noncompliant.

Taken together, the FDA draft guidance and the entry of the consent decree against Dr. Reddy’s underscore the importance of communication between companies and regulators, particularly where public health and safety are implicated. Agencies appear ready to use all their tools to deter delay, which should give pause to companies large and small. Whether your company is a large business with a bureaucracy requiring multiple approvals before a regulatory notice or press release can be issued or a smaller operation that may take longer to understand the potential hazard due to a lack of compliance procedures and policies, timely reporting is critically important.

Bureaucratic and unintentional delays are unlikely to be excused by regulators who believe that communication can help mitigate a risk to public safety. Companies would be wise to create and implement the appropriate reporting policies and compliance programs. But that is not enough. They also need to test their processes, which can be done through mock recalls, audits, and other exercises, to ensure that their systems enable the company to meet regulatory expectations. Their reputation ̶ and bottom line ̶ may depend on it.