Merck’s strategic objectives cannot be achieved without IT support. The future focus and globalization of Merck will only succeed if consistent standards, systems and processes are in place. Reacting timely and flexibly to changing market developments, conducting innovative research, running production reliably, and supplying customers rapidly require reliable, high-performance IT.
Risks resulting from the complexity of internal and external requirements
IT risks with an impact on the business result occur when information is unavailable or erroneous, unintentionally disclosed or when the processes to be depicted have been implemented in IT systems in a way that is too inflexible, too complex or illegal. Security gaps that are recognized too late, or in the worst case not at all, and insufficient emergency planning measures can quickly become incidents that affect the entire company. IT systems that do not reflect the expectations of the businesses have the potential to massively hinder the economic development of companies. Undesired data protection violations owing to incorrect or absent authorizations create a negative external impression. The increasing dependency on IT as well as the growing interconnectivity of IT landscapes in international companies make it necessary for companies to invest heavily in maintenance, in the integration of new applications or even systems, and in the mapping of new processes. This development, in conjunction with constantly new national and international legal requirements, makes data processing a time-consuming and costly activity. As the complexity of the IT landscape increases, so do the potential risks.
Risks resulting from external threats
In addition, the general risk situation means more professional threats can be expected, with the trend moving away from general viruses and toward targeted industrial espionage and sabotage.
Significant potential IT risk scenarios for Merck include the failure of the central ERP (Enterprise Resource Planning) systems, the publication of classified confidential research and business development data, the manipulation of IT systems in chemical process control, as well as the revocation of drug registrations due to deficient validation of the relevant IT systems.
The IT infrastructure of Merck has been consolidated to improve service quality while simultaneously optimizing costs. Subsequent to the acquisition of Millipore, the Millipore IT systems were combined with the Merck IT systems within the scope of a controlled integration program.
Risk minimization strategy
Merck ensures the necessary availability of business-critical application systems and access to business-relevant data – even in the event that individual components fail – by means of redundant structures of technical components, networks and sites, as well as suitable, tested contingency measures. Security guidelines are in place for the entire Merck Group. They include appropriate organizational, technical and software-related precautions for access control, access rights, virus protection and data protection. The adherence to and efficacy of these measures are continuously monitored and reviewed by Internal Auditing as well as external auditors. A dedicated IT risk management process ensures that IT risks are evaluated and appropriate measures taken. Based on the measures taken, we assume that the likelihood of a serious IT risk occurring is low.