Kumar’s document explained that while the company had slashed production costs and used the cheapest ingredients in those markets, it submitted data from the drugs that had been made for more regulated markets, a dangerous bait- and- switch that concealed the low quality. The report also noted that active pharmaceutical ingredient (API) that failed purity tests had been reblended with good API until it met requirements.

The report noted the “non- availability” in India and Latin America of validation methods, stability data, and bioequivalence reports. In short, Ranbaxy had almost no method for confirming the content of drugs in those markets. For example, the data collected by Thakur’s team showed that of the 163 drug products approved in Brazil since 2000, almost all had been filed with phony batch records and stability data that did not exist.

The report noted that in a majority of regulatory filings, Ranbaxy had “intentionally misrepresented” small research and development batches (some two thousand doses) as exhibit batches one hundred times the size, and then deceptively performed crucial tests for bioequivalence and stability on the smaller, easier- to- control batches. The result was that its commercial- sized batches had not actually been tested before being sold, putting millions of patients at risk.

In an email to Tempest marked “confidential” accompanying the report, Kumar noted that lack of adherence to regulation was only part of the problem. “It appears that some of these issues were apparent over a year ago and I cannot find any documents which sought to address these concerns or resolve the issues.” In closing, he made clear that his ultimate loyalties lay not with the company but with the truth. “I can not allow any information to be used for any dossier unless fully supported by data,” he wrote, adding: “With your permission, I would like to take advice from legal counsel in London as to my current responsibility and indemnity with respect to the above issues.”

In response, Tempest assured Kumar that the company would do the right thing.

Though the picture was grim, Kumar confided to Thakur that he believed he could fix the problems, if given the authority.

Thakur’s findings were not news to Ranbaxy’s top executives. Just ten months earlier, in October 2003, outside auditors started investigating Ranbaxy facilities worldwide. In this case, the audits had been ordered up by Ranbaxy itself. This was a common industry practice: drug companies often hired consultants to audit their facilities as a dry run to see how visible their problems were. If the consultants could find it, they reasoned, then most likely regulators could too.

The fact- finding mission by Lachman Consultant Services left Ranbaxy officials under no illusion as to the extent of the company’s failings. At Ranbaxy’s Princeton, New Jersey, facility, auditors found that the company’s Patient Safety Department barely functioned and training was essentially “non- existent.” The staff had no written protocols for investigating patient complaints, which piled up in boxes, uncategorized and unreported. They had no clerical help for basic tasks like mailing out the patients’ samples for testing. “I don’t think there’s the same medicine in this medicine,” was a common refrain from patients. Even when there were investigations, they were so perfunctory and half- hearted that expiration dates were listed as “unknown,” even when they could easily have been found from a product’s lot number.

*****

After weeks of exhaustive research, Thakur brought his team’s preliminary findings on the Latin American, Indian, and ROW (rest of the world) markets to his boss, Raj Kumar.

It was 7:30 a.m., the time Kumar usually got to work, and they met in his office. The hallways were still quiet. Thakur placed some preliminary spreadsheets in front of Kumar. They showed that numerous drugs had never been tested properly, if at all, and had no underlying data to support the company’s claims. Kumar perused them in silence. “This can’t be right,” he finally said. It seemed impossible that Ranbaxy had filed dossiers on drugs the company hadn’t actually tested. Kumar had never heard of anything like it. “You must have missed data.”

“We’ve looked, and it doesn’t exist,” Thakur insisted.

“You have to go back and check again,” Kumar asserted. “This has got to be wrong.”

To Kumar, the only plausible explanation was that Thakur had either overlooked existing test results or misinterpreted the results he’d found. Otherwise, there was no precedent for what Thakur had uncovered. In the coming weeks, Kumar sent him back to check and recheck so many times that finally Thakur organized a meeting with the team so that Kumar could hear from them directly.

They, too, had been stunned by their own findings and remained at a loss for how to think about what they’d found. “Corruption to me was more Enron, more how you fudge earnings,” Dinesh Kasthuril recalled. Venkat Swawinathan had expected “nepotism and inefficiency.” But doing things that jeopardized people’s lives was another thing altogether.

Once Kumar heard from each member of Thakur’s team, it finally sank in. The company was committing fraud and potentially harming patients on a global scale. He distilled the information into a four- page report for the CEO, Brian Tempest. Though blandly titled “Inadequate Dossiers filed in various countries for various products” and written in the gray lingo of corporate quality assurance, the report was explosive. It laid bare systemic fraud in Ranbaxy’s worldwide regulatory filings. “The majority of products filed in Brazil, Mexico, Middle East, Russia, Romania, Myanmar, Thailand, Vietnam, Malaysia, African Nations, have data submitted which did not exist or data from different products and from different countries.” 

An audit of Ranbaxy’s main U.S. manufacturing plant, Ohm Laboratories in New Jersey, found that the company, though required to report adverse events to the FDA, rarely did so. There was no system to capture patient complaints after hours, and no global medical officer to ensure that any potential negative consequences for patients were being monitored. The consultants from Lachman urged Ranbaxy to address these problems globally. Ranbaxy’s initial reaction to the findings was to question the number of hours, and the resulting invoice, that Lachman had sent for its work.

The picture was not a lot rosier overseas. At a plant called Mohali, in India’s northern state of Punjab, auditors found so little control of records that twenty people were authorized to change test results. Over 120 different batch records had been reprinted, which Ranbaxy claimed was due to faulty dot matrix printers that had not been replaced. If the goal of good manufacturing was total control, this was about as wild and careening a picture as one could get.

The head of Lachman later sent a top company official a wide- ranging plan for corrective action. Among the suggestions was to establish a training program for workers, including a module entitled “Creating a Culture of Trust, Ethical Behavior, and a ‘Quality First’ Mindset.” But Ranbaxy refused to implement the proposed ethics training after a company executive deemed it unnecessary.

At 8:30 a.m., the heat already stifling outside, Dinesh Thakur looked around the conference table at his six project managers and saw tired faces. Some had left their homes hours earlier to beat rush-hour traffic and arrive on time. They knew the meeting was important, but didn’t know its agenda. Thakur was about to give his team one of the stranger tasks in the annals of corporate due diligence, but had decided in advance to keep the true reasons for it to himself.

“We have a new assignment from Dr. Kumar,” he began. “He wants to know if we can substantiate all of the data that we have provided to various countries. This is a retrospective review of our portfolio, and he wants to know how confident we are about the information we have provided to various regulatory agencies in the last twenty years.”

The members of his team looked surprised, yet the assignment fell within their wheelhouse. Their job was to map all of Ranbaxy’s data, so it was only logical to find out if it was accurate first.

Thakur directed their attention to a large whiteboard where he’d drawn a graph. On the vertical axis were all the regions of the world where the company sold its drugs. On the horizontal axis were myriad questions. What products were on the market? When were they registered? Where were the actual dossiers used to register the products? Where was the supporting data? How many batches were sold in that market? What facility manufactured them?

Thakur assigned each of his staffers a region of the world. He directed them to compare the company’s raw manufacturing data for the drugs in those markets against the claims made in submissions to regulators. Did the data match up, or were there any discrepancies? Did the submissions comply with local regulations?

A picture of the company’s entire operations had never been pieced together before. Until then, Ranbaxy had been partitioned. Specific groups worked on product development for different regions, but almost never met to compare notes. No one had a complete picture of how— or even where— the company’s drugs were approved. But Thakur had directed his team to make a multidimensional assessment that spread across the entire globe and stretched back years.