Risky business: measuring and managing reputational risk

February 2022  |  COVER STORY | RISK MANAGEMENT

Financier Worldwide Magazine

February 2022 Issue

As American polymath Benjamin Franklin wrote, “It takes many good deeds to build a good reputation, and only one bad one to lose it”.

In a corporate context, the long-term fortune of any company is built on its reputation. The stronger the reputation, the higher the likelihood of success. Conversely, the weaker the reputation, the lower the chances of success. Ergo, attaining and maintaining a solid reputation is of paramount importance.

Such matters are in the realm of reputational risk. By definition, reputational risk refers to the potential for negative publicity, public perception or uncontrollable events to have an adverse impact on a company’s reputation, thereby affecting its revenue.

And while still a relatively new concept – extant for a decade and only seriously examined over the last two to three years – reputational risk has grown in prominence alongside the emergence of a variety of reputation-threatening scenarios. The Alva White Paper ‘The Complete Guide to Reputation Risk’, outlines which risks are most typical for companies, described below.

First, regulation breaches. Failing to keep up with changes in laws and regulations can lead to an unintentional breach, at worst breaking the law. Any breach will remain a matter of public record and these tend to have a snowball effect in terms of media reporting.

Second, cyber attacks. Data breaches leading to the loss of sensitive client information, or system shutdowns caused by hackers, will elicit a name for poor security and unreliability. Companies can spend years trying to rebuild their reputation following a cyber breach.

Third, C-suite actions. The chief executive and board of directors are figureheads, and any wrongdoing will leave a lasting taint. Research by Weber Shandwick found the reputation of a company’s leader is the fourth most important factor in determining that of the company as a whole.

Fourth, employee misbehaviour. If employees are involved in misconduct, present a poor impression to clients, fail in their function or are seen to criticise workplace practices, it will have an impact.

Fifth, bad reviews. Poor reviews from product or service users, employees or industry experts will impact income. According to research by Apex Global Learning, there is an 18 percent difference in revenue between three-star reviewed businesses and those rated five-star.

Finally, social media posts. A casual tag on social media can tie a company into a thread it would rather not be associated with. Worse still, mistaken identity with a similar sounding miscreant can easily happen and be hard to expunge.

“Before computerisation, the internet, social media and smart phones were ubiquitous, an incident that could cause reputation damage was often contained to local media,” observes Craig Rowe, chief executive and founder of ClearRisk. “The spread of the damage was slow and not far reaching. Reputational damage is a product of the severity of the underlying incident and the velocity and breadth of the spread of information about that incident.”

Game-changer

Further complicating the risk landscape in recent years has been the emergence of the global coronavirus (COVID-19) pandemic, a game-changer that has significantly upped the ante for companies’ reputational risk practitioners.

“The reputational risk landscape has changed dramatically following the emergence of the COVID-19 crisis,” concurs Shahar Silbershatz, chief executive of Caliber. “The pandemic tipped the balance of importance from competency, reflecting elements such as product quality and reliability, to character, how a company and its management behave.

“The growing trend of corporate activism is another development and brings a new challenge to the reputational risk landscape: companies are expected to take a stand on matters of public policy,” he continues. “But this is a double-edged sword: taking a stand can alienate some audiences and thus constitute a risk, but not taking one can do the same.”

Also significant is the reality that reputational risk is generally underestimated and inadequately managed by the majority of companies. “At the core of the problem is that reputational risk is not a direct exposure,” says Mr Rowe. “It is an outcome or consequence of another risk-related incident and potentially the greatest impact to a company.”

Adding to the likelihood and impact of an incident is today’s confluence of technologies and pressing global issues – a perfect storm for reputational risk. Indeed, the digital world of the internet, social media and smart phones, combined with risks such as climate change, political instability and cyber risk have converged to create vulnerabilities for every sector and company.

“Ultimately, it is the public and media who shape the reputational risk agenda,” asserts Jordan Greenaway, managing director of Transmission Private. “So, the best way to understand the changing reputational landscape is to look at where the public are increasingly focusing their attention, how their expectations are changing and what behaviour exposes companies to reputational risk.”

Measuring risk

Companies that fail to adequately define their reputational risk will consequently find it difficult to measure said risk, leaving them open to multiple damage scenarios. Thus, the ability to identify risks and how they are evolving, as well as to calculate the negative impacts they pose, is essential.

“It is not possible to mitigate or manage reputational risk within a business if there is no clear way to measure it in the first place,” contends Mr Greenaway. “Too many companies kickstart sweeping new programmes to get a handle on reputational risk, yet have not established basic metrics to assess and monitor their risk.”

As noted by the Alva White Paper, one of the key methods for measuring reputational risk is through a dedicated risk assessment, which can help draw a baseline for where a company sits within the perception of its stakeholders, as well as make a comparison with direct competitors, comparable organisations and the sector as a whole.

Moreover, by gathering data from social media, print news, online and broadcast channels, companies can listen and analyse the thoughts and feelings of their different stakeholders. “Using machine learning and connected intelligence tools, companies will be able to mine this rich data stream to identify sentiments and topics that pose potential risk,” states the White Paper.

And when weighted sentiment measures are applied, companies can build a picture of the biggest risks they face, prioritised by current impact and severity. This process allows companies to create a risk management programme, which will improve risk identification, inform strategic decision making, improve crisis management and assist mitigation of specific risks.

Additional ways of measuring reputational risk include 360-degree sentiment monitoring for the company’s brand and its key executives to understand how they are perceived on a real-time basis. “This will give executives a proxy to better understand when their reputational risk is on the rise, and trigger them to investigate what is going wrong when it is moving in the wrong direction,” explains Mr Greenaway.
Companies can also measure reputational risk ‘straight from the horse’s mouth’ as it were, by simply asking key employees, such as project leads and heads of departments, on a regular anonymised basis to provide their own subjective assessment of the potential for their organisation to become embroiled in a reputational crisis.
“Many senior employees will have an intuitive sense of the culture within the company, as well as the likelihood of that giving rise to a reputational crisis, even if they cannot articulate exactly what they expect to go wrong,” adds Mr Greenaway. “This can be a very valuable and important ‘temperature check’.”

Even so, while risk measurement techniques have been around for a long time, the difference today is the unpredictability of an incident’s impact. “Take COVID-19: most companies had pandemics in their plans, but few planned for the unprecedented global economic impact that resulted,” says Mr Rowe. “Reputational risk measurement needs to be embedded as a top priority in company culture through policies, education, repetition and incentives.”

Managing risk

Once the difficulties involved in measuring reputational risk have been overcome, the next challenge is to implement a company-wide programme dedicated to safeguarding reputation – a programme that incorporates the views of a multitude of key stakeholders.

“The first core challenge is to get everyone to take the process seriously,” suggests Mr Greenaway. “Some executives, employees and departments still see reputation as something that is ‘woolly’ and ‘intangible’, rather than something that genuinely threatens the financial position and integrity of the company.”

To address this issue, ClearRisk recommends that companies implement six steps to help them manage the myriad reputational risks they face, as outlined below.

First, make reputational risk part of strategy and planning. It is important to recognise the impact reputation can have on success. Companies should investigate weaknesses and determine relevant reputational attributes within the company. They should brainstorm potential scenarios that could damage public perception.

Second, control processes. Standardisation, technology, policies and procedures reduce the likelihood and severity of events that could cause reputational damage. By focusing on consistently supplying quality products and services, it is much less likely that there will be a harmful mistake.

Third, understand that all actions can affect public perception. The board and top management must recognise the importance of reputational risk management, and middle managers must lead by example to promote positive messages to key stakeholders.

Fourth, do not try to set expectations too high by promising offers that cannot be achieved. This will backfire when a company becomes known as an organisation that cannot live up to its word. Learn what customers, shareholders and employees expect from the organisation and management, and strive to satisfy these conditions.

Fifth, in all situations, it is key to consistently send out positive communications. Over time, this will build a company’s reputation in the public mind, lessening the impact of future damages. Always inform customers and employees what is happening and that incidents are being responded to.

Finally, if the worst happens, a company must be prepared to respond quickly and appropriately. Every minute that goes by can be crucial and reduce the respect the public has for a company and its managers. Without effective reputation management, it may take a long time for a company to recover from an otherwise minor incident.

Essentially, the six-step approach is designed to forestall inertia and a lack of information. “I doubt that most employees and stakeholders of most companies understand what reputational risk is, its potential causes and impact, or their place in preventing it or responding to an incident,” suggests Mr Rowe. “It is incumbent on the board and C-suite to set the tone from the top and show through strategic priorities and resource allocation how important and potentially impactful reputation damage can be.

“The best way to engage staff and all stakeholders is through information,” he continues. “Good data collection and analysis presented as relevant and clear information is the best way to get buy-in. Software systems that track and measure the impact of incidents are critical to this effort. Leadership and all staff need to know how many incidents and near-misses happen, and what can be done to reduce their frequency and mitigate the potential impact.”

Evolving risk landscapes

In a post-pandemic world, there can be no excuse for lackadaisical attitudes toward reputational issues. Quite simply, with no guaranteed way of covering all eventualities, companies’ attitude to risk must mature toward a fuller understanding that reputation is the most valuable of assets.

In the view of Mr Rowe, issues such as sustainability, diversity, equity and inclusion (DEI), misinformation, and political uncertainty and unrest will culminate to create new categories of risk for companies to tackle. “The magnitude of reputational damage resulting from these risks will skyrocket,” he foresees. “In addition, cyber risk is going to get a lot worse as more and more of our day-to-day activities are dependent on technology.

“The internet of things, automation, artificial intelligence and an ever-increasing dependency on technology and connectivity for everything will create a very vulnerable and fragile global infrastructure,” he continues. “Organisational positions and actions related to DEI, global warming and sustainability, as well as the widening political divide, will have an enormous impact on reputations.”

However, despite these challenges, there is room for optimism. “Companies’ corporate affairs teams, who are typically in charge of reputation management, are gradually getting better at analysing large amounts of data to draw relevant insights and inform activities that reduce risk and boost reputation,” opines Mr Silbershatz. “This trend of being data-driven, and increasingly using real-time data as well, will continue and will form the basis for successful reputational risk management.”

© Financier Worldwide

BY

Fraser Tennant