Compliant Doesn't Mean Risk-Ready: Lessons From a $12M Product Recall

This post forms a series of papers and assignments I have prepared for my education under the International Chartered Governance Programme (ICGP) at the Chartered Governance Institute of New Zealand. The context for my latest professional development can be found in my earlier post.

In this post, I have developed a Board paper as Fisher and Paykel Healthcare’s board secretary to review their risk and compliance management processes and identify areas of improvement for consideration.

*Disclaimer: This paper was prepared as part of an academic assignment. The views, analysis, and recommendations presented are my own and do not reflect the positions of my employer or any affiliated organisations. The content is intended for learning and discussion purposes only, and should not be taken as professional advice.

Executive Summary

This report assesses Fisher & Paykel Healthcare’s (F&P) risk and compliance management approach and its alignment with strategy. F&P demonstrates a strong governance foundation, robust regulatory compliance and structured risk oversight. However, its risk and compliance management (RCM) remains predominantly compliance focused and functionally segmented. This limits enterprise wide risk visibility and strategic integration.

The absence of a clear risk appetite for key risk categories and limited risk prioritisation constraints decision making under uncertainty. The 2024 Airvo recall highlights the consequences of insufficient risk integration, causing financial, operational and reputation impacts due to product failure.

This report recommends F&P’s transition towards an integrated and risk intelligent organisation by adopting the following:

• Risk adjusted performance metrics
• Enterprise risk register with assurance mapping
• Defining risk appetite and prioritising risk using certain tools

These implementations will embed risk into F&P’s strategic decision making, empowering capabilities for anticipating emerging risks, optimise resource allocation and sustaining long term growth in an increasingly complex regulatory healthcare environment.

Introduction

This paper presents a review of F&P’s current RCM approach, evaluating how it links company strategy and risk management. A gap analysis will be conducted to identify areas of improvement and optimisation to tighten F&P’s risk governance, strengthening the sustainability and delivery of business objectives. Recommendations will also identify and control emergent risks, to strategically position F&P as a forward looking company that anticipates and prioritises customers’ health and safety with quality product and services.

Company Context

F&P is a global medical company that focuses on products that provide a suite of respiratory care and address obstructive sleep apnea (Fisher & Paykel Healthcare Corporation Limited, 2025). From the latest FY2025 annual report, F&P has a revenue over NZ$2 billion, where about 11% of revenue is prioritised for research and development spending (Fisher & Paykel Healthcare Corporation Limited, 2025). 

Manufacturing in New Zealand, Mexico and China, F&P operates out of 55 countries while selling its products in more than 120 countries (Fisher & Paykel Healthcare Corporation Limited, 2025). F&P’s long term sustainability depends on its product innovation capabilities, and high compliance with multiple countries’ regulatory standards. For example, the U.S. Food and Drug Administration requirements must be adhered when selling within the United States while ISO 13485 must be complied with within EU countries (European Commission, 2017; International Organization for Standardization, 2016; U.S. Food and Drug Administration, 2023).

Regulatory standards are tightening globally, which reinforces the importance for an RCM that goes beyond monitoring risk and compliance. F&P’s operations are simultaneously exposed to product quality risk, patient health & safety, supply chain vulnerabilities and cybersecurity as products and services are increasingly digitalised (World Economic Forum, 2023). Failure to effectively integrate these risks into strategic planning will constrain F&P’s ability to sustain growth while maintaining compliance and patient safety outcomes.

Current Risk and Compliance Management Approach 

Governance Structure and Risk Ownership

Overall, F&P has a formal and mature governance structure where the Board of directors are majority independent, supported by three committees: the Audit and Risk Committee; the People and Remuneration Committee; and the Quality, Safety and Regulatory Committee. Responsibilities of the committees are detailed in Table 1 below (Fisher & Paykel Healthcare Corporation Limited, 2025). 

Table 1. F&P Board committees and their responsibilities (adapted from Fisher & Paykel Healthcare, 2025).

From an enterprise risk management perspective, F&P has demonstrated alignment with the Three Lines of Defence model (Institute of Internal Auditors, 2020; Chartered Governance Institute of New Zealand, 2024). Operational staff assumes primary responsibility for risk ownership, management and Board provides strategic oversight, while the audit function serves as an independent assurance layer for transparent and integral risk management.

However, risks are structured along functional lines between committees within F&P, instead of being integrated or cross function across the organisation. The delineation of risk oversight may limit the Board’s ability to identify cross functional (strategic, operational and regulatory) risk impacts, missing the potential of synergising risk controls.

Risk Identification, Categorisation and Appetite 

Across F&P’s public information, F&P’s strategy was articulated well publicly, focusing on research and development of innovative medical products, increasing global presence and transforming clinical practice by emphasizing patient care through design (Fisher & Paykel Healthcare Corporation Limited, 2025; Morningstar, 2024). The clear strategy then translates to identification of relevant risk categories (strategic, operational, compliance, financial/reporting and reputational), which are assigned clear accountabilities across the Board committees. However, the risk appetite for F&P has not been defined adequately in public disclosures. 

Risk appetite is critical in defining how much risk a company is willing to take when pursuing business expansion opportunities (ISO, 2018). Essentially, a clear limit or threshold will guide key decision making, resource allocation and risk prioritisation for a company. From F&P’s annual reports, risk appetite is primarily expressed through financial metrics, such as capital structure targets, dividend policies, and funding parameters (Fisher & Paykel Healthcare Corporation Limited, 2025). The Board’s attention to financial risk appetite ought to be replicated to other risk categories, especially when F&P’s risk profile is skewed towards regulatory compliance and operations due to its business model of growing sales and manufacturing across multiple countries (PwC, 2023). 

Although risk identification and categorisation is well developed for F&P, identifying and specifying clear and measurable risk appetites will empower F&P with clearer decision making criteria to pursue strategic growth while mitigating excessive risk.

Compliance Management 

Operating in the healthcare industry, F&P is subjected to multiple strict regulations such as the United States Food and Drug Administration (FDA) and European Union Medical Device Regulation (MDR). As a result, F&P has established comprehensive governance controls around regulatory compliance and product quality, evident in their public disclosures* and strong business growth across international markets (Fisher & Paykel Healthcare Corporation Limited, 2025; European Commission, 2017; U.S. Food and Drug Administration, 2023). 

* NZX and ASX listing disclosures (NZX, 2023; ASX Corporate Governance Council, 2019), annual modern slavery reporting aligned with ISO 20400 (International Organization for Standardization [ISO], 2017), quality compliance aligned with ISO 14001 (ISO, 2015), business risk processes aligned with ISO 31000 (ISO, 2018), and product risk aligned with ISO 14971 (ISO, 2019).

F&P’s governance controls mirror well with Committee of Sponsoring Organizations of the Treadway Commission (COSO)’s governance principles (COSO, 2017), which encourages companies to align risk management with the company’s business objectives at all levels by utilising 8 key components (refer to Image 1 of COSO RCM framework). Overall, F&P has demonstrated strong compliance management and that has translated to the company’s positive reputation and sustained growth.

Although it is important to maintain strict regulatory compliance, these activities tend to focus on present and known operating risks and constraints. A balanced approach for managing present and future risk is essential for a comprehensive risk management approach, supporting sustainable business development (ISO, 2018). Currently, F&P’s public disclosures have emphasised more on compliance (Fisher & Paykel Healthcare Corporation Limited, 2025). F&P needs to ensure that risk management attention is not disproportionately skewed between the two committees' activities. Rather, equal attention needs to be placed on anticipating and systematically responding to emerging or less prominent business risks together with current regulatory challenges.

Link Between Strategy and Risk 

A key aspect of an effective RCM is the integration of risk awareness and controls with an organisation’s strategy and operations for effective decision making (COSO, 2017; ISO, 2018). A successful integration  drives business success and sustainability. F&P’s strategy and operations exposes the organisation to complex and evolving risks which include regulatory changes, supply chain dependencies, tariffs, currency exchanges, cybersecurity, clinical trial outcomes and more. In addition, these risks often interact with each other, requiring the need for a coherent risk mitigation approach. The 2024 Airvo voluntary recall due to a speaker defect demonstrated that the materialisation of a product quality risk resulted in reputational damage, financial losses estimated around NZ$12 million and operational impacts in identifying and physically collating affected products globally (Fisher & Paykel Healthcare Corporation Limited, 2024; Radio New Zealand, 2024).

It is evident that F&P has clear definitions of their strategy and risk exposures. However, there is limited evidence to show that identified risks and their controls are directly influencing company strategy. This observation is supported by the lack of risk appetite specifications, risk prioritisation and a decision making process for strategic and operational matters in F&P. Using the 2024 Airvo recall as an example, having a clear financial risk threshold of say NZ$8 million would have guided additional layers of scrutiny in quality testing and assurance to reduce the odds or limit the scale of a potential product recall. Alternatively, a prioritisation of recall risk could lead to additional resources directed into development of a robust product tracking and monitoring system to ease recall operations. 

Lacking clarity in risk appetite and risk prioritisation can lead to decisions being made under ambiguity. Over time, the compounding impacts of such decisions will reduce F&P’s ability to cope with uncertainty or optimise risk-return tradeoffs. 

Synthesis

Drawing insights from earlier discussions, F&P currently has the following governance aspects that has potential for further strengthening:

• Consolidate enterprise risks that are currently segmented at a functional level
• Specify risk appetite clearly across all risk categories
• Balance risk management focus between compliance and business/operations 
• Integrate risks with strategy and decision making

In the next section, the discussion will focus on actionable steps to strengthen the above aspects, enhancing F&P’s risk governance to achieve strategic and operational objectives.

Risk Strategy & Recommendations 

Integrating Risks with Strategy and Decision Making

Although strategy and risk identification has been achieved by F&P, public disclosures show limited evidence that these aspects are integrated to influence decision making around market expansion, product development or resource allocation. It is recommended that F&P utilises risk adjusted evaluation criteria to guide risk embedded decision making into their governance and operational processes. This aligns with enterprise risk management principles, which emphasise that risk management should be integrated with strategy-setting and performance to support informed decision-making (COSO, 2017; ISO, 2018). Examples of such criteria are shown in Table 2 below.

Table 2. Recommendations on suitable risk adjusted evaluation criteria for F&P adoption.

The development and adoption of risk adjusted evaluation criteria will ensure that strategic and operational decision making systematically integrates risk considerations. In the short term (<12 months), the Board Secretary can work with Board committees and relevant business functions to develop suitable criteria for the Board’s approval for establishment. In the longer term (>12 months), all project proposals ought to be accompanied with an established set of risk assessment criteria for the Board’s approval, inculcating a risk intelligent culture within F&P.

Consolidating and Strengthening RCM

To address the current functional segregation of risks across F&P’s Board committees, actions to consolidate enterprise risk views are recommended. This can be achieved by establishing an integrated enterprise risk register, collating and reporting all risks systematically to the Board for oversight. This can be done routinely through Board meeting agenda and papers, or using an online risk dashboard that is continuously monitored and updated. In addition, specifying the assurance method for each risk is key to aligning with the Three Lines of Defence model. The goal is to consolidate assurance activities across internal, external and regulatory audits onto a single platform with the enterprise risk register. It allows assurance gap identification for swift mitigations by the Board, reducing the dependency of the Board on management narratives and curated reports.

In the short term, it is recommended that the Board Secretary could drive the above initiatives by working with both risk committees and audit functions to pool together information and activities to draft the enterprise risk and assurance register for F&P. The Secretary then plays a key role in ensuring the integrity of that risk register and tabling it to the Board for effective challenge and oversight.

Defining Risk Appetite and Risk Prioritisation 

To enhance the effectiveness of risk-strategy integration and the proposed enterprise risk register, the establishment of a comprehensive risk appetite framework is essential. In addition to the clear financial thresholds that F&P already has, appetites should be quantified specifically for product quality, patient safety, regulatory compliance, supply chain disruption and cybersecurity. The list is not exclusive, but these are identified as critical to F&P’s current strategy. To guide this development, F&P can refer to the risk impact matrix in Image 2 as a template. Clear quantitative and qualitative thresholds must be developed within the short term to swiftly establish the risk appetite framework for F&P, enabling consistent and transparent decisions.

Subsequently, risk prioritisation can be facilitated using the enterprise risk heat map example shown in Image 3 based on overall risk significance to F&P. This will help the Board visualise risk impacts and prioritise mitigation measures, influencing decision making processes. Risk prioritisation can be enhanced further by analysing potential risk interactions, using the risk interaction matrix shown in Image 4. 

The 2024 Airvo recall demonstrates how a product quality risk materialised other risk impacts for F&P. Understanding risk interactions can enable efficient resource allocation to implement and synergise controls for risks with cross functional impacts. The establishment of the risk heat map and interaction matrix is also recommended to be led by the Board Secretary and set up in the short term. The longer term responsibility of continuous monitoring and updating will fall on the Board committees overseeing their risks.

Managing Present and Emerging Risks

F&P has demonstrated strong regulatory compliance, product quality and operational reliability. However, these are focused on risks in the immediate term. Striving for business sustainability and resilience, emerging risks need to be identified and managed systematically. For F&P’s growth strategy, the following emerging risks significantly hinder progress if not managed adequately:

• Cybersecurity (European Union Agency for Cybersecurity [ENISA], 2023; World Economic Forum, 2023). Increasing digitalisation of medical products and administrative services raises susceptibility of cyber attacks and jeopardising sensitive patient information.
• Supply chain disruption (McKinsey & Company, 2020; World Economic Forum, 2023). Heavy reliance on key manufacturing locations and suppliers creates vulnerability to country specific trade agreements, geopolitics and material price fluctuations.
• Evolving regulatory environment (European Commission, 2017; U.S. Food and Drug Administration, 2023). New developments from the scientific community can heavily influence current regulations in the medical industry. Fast changing consumer demands can easily outpace the adaptation of established clinical practices and product specifications.

The unpredictability and speed of onset for these emerging risks could lead to detrimental impact to F&P’s strategy, if they are not identified and monitored proactively. Leveraging on earlier recommendations, emerging risks can be tracked using the integrated enterprise risk register, prioritised through a risk interaction matrix and heat map. Both Board committees are encouraged to dedicate resources to regularly scan the market for new and developing risks, conduct risk workshops for brainstorming or even engage external specialist stakeholders at the forefront of research and development space. These proactive activities can be coordinated by the Board Secretary in the short term, with the goal of strengthening inhouse predictive risk capability and processes in the longer term.

Conclusion

F&P currently demonstrates strong structural governance and regulatory compliance. There is opportunity to integrate risks into strategy to improve F&P’s ability to anticipate change, maintain their economic moat and continue serving their patients through quality products and clinical practices. Collectively, the phased recommendations are intended to systematically develop a holistic and integrated RCM, strengthening F&P’s risk governance over time.

Reference

ASX Corporate Governance Council. (2019). Corporate governance principles and recommendations (4th ed.).https://www.asx.com.au/content/dam/asx/about/corporate-governance-council/cgc-principles-and-recommendations-fourth-edn.pdf

Chartered Governance Institute of New Zealand. (2024). Risk and compliance management workbook.

Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise risk management: Integrating with strategy and performance.https://www.coso.org/Documents/2017-COSO-ERM-Integrating-with-Strategy-and-Performance-Executive-Summary.pdf

European Commission. (2017). Regulation (EU) 2017/745 on medical devices.https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017R0745

European Union Agency for Cybersecurity (ENISA). (2023). Threat landscape for the health sector. https://www.enisa.europa.eu/publications/enisa-threat-landscape-for-the-health-sector

Fisher & Paykel Healthcare Corporation Limited. (2024). Voluntary recall of Airvo 2 and myAirvo 2 devices. https://www.fphcare.com/au/corporate/news/fy24/fph-voluntary-limited-recall-of-airvo2-myairvo2/

Fisher & Paykel Healthcare Corporation Limited. (2025). Annual report 2025.  https://www.fphcare.com/globalassets/documents/investor-centre/annual-reports/fph-annual-report-2025.pdf

Institute of Internal Auditors. (2020). The three lines model: An update of the three lines of defense.https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated.pdf

International Organization for Standardization. (2015). ISO 14001: Environmental management systems—Requirements with guidance for use. https://www.iso.org/standard/60857.html

International Organization for Standardization. (2016). ISO 13485: Medical devices—Quality management systems—Requirements for regulatory purposes. https://www.iso.org/standard/59752.html

International Organization for Standardization. (2017). ISO 20400: Sustainable procurement—Guidance. https://www.iso.org/standard/63026.html

International Organization for Standardization. (2018). ISO 31000: Risk management—Guidelines.https://www.iso.org/standard/65694.html

International Organization for Standardization. (2019). ISO 14971: Medical devices—Application of risk management to medical devices. https://www.iso.org/standard/72704.html

KPMG. (2022). MedTech regulatory trends report. https://kpmg.com/xx/en/home/insights/2022/03/medtech-regulatory-trends.html

McKinsey & Company. (2020). Risk, resilience, and rebalancing in global value chains.  https://www.mckinsey.com/capabilities/operations/our-insights/risk-resilience-and-rebalancing-in-global-value-chains

Morningstar. (2024). Fisher & Paykel Healthcare Corporation Ltd (FPH) company profile.https://www.morningstar.com/stocks/xnze/fph/quote

NZX. (2023). NZX corporate governance code.https://www.nzx.com/regulation/nzx-rules-guidance/corporate-governance-code

PwC. (2023). Global risk survey 2023: Risk perspectives in a changing world.https://www.pwc.com/gx/en/services/risk-consulting/global-risk-survey.html

Radio New Zealand. (2024). Breathing devices recalled by Fisher & Paykel Healthcare.  https://www.rnz.co.nz/news/business/512892/breathing-devices-recalled-by-fisher-and-paykel-healthcare

U.S. Food and Drug Administration. (2023). Overview of device regulation.   https://www.fda.gov/medical-devices/device-advice-comprehensive-regulatory-assistance/overview-device-regulation

World Economic Forum. (2023). The global risks report 2023. https://www.weforum.org/reports/global-risks-report-2023/