WORKS:
<?php

        $department = null;
        $stmt = $db->prepare("INSERT INTO product (department) VALUES (?)");
        $stmt->bindParam(1, &$department);
        $department = 'test1';
        $stmt->execute();

?>

DOESN'T WORK:

<?php

        $department = null;
        $stmt = $db->prepare("INSERT INTO product (department) VALUES (?)");
        $stmt->bindParam(1, $department);
        $department = 'test1';
        $stmt->execute();

?>