Reputation Risk Management

While the impact of traditional risk events is substantial, the impact from a reputation risk event can be even more damaging and it can take companies years to rebuild deteriorated reputations.  Organizations’ focus on their reputations has been increasing in recent years due to many factors:

• There is a growing importance of difficult-to-value intangible assets making investor perceptions more important,
• The communications revolution makes information immediately and widely available,
• More complex supply chains that use outsourcing increase the risk of damage to reputation by third party actions,
• There are changing public expectations of companies, and

• More active and sophisticated advocacy organizations have greater influence on business decision making.

Organizations with strong reputations can reap many benefits such as increased market value, stronger sales, an increased ability to attract talented employees, less community resistance and fewer regulations, a more favorable legal environment, and the benefit of the doubt when negative events occur.  This provides sufficient incentive for companies to want to manage their reputation risks successfully. 

The Importance of Reputation

An online survey was conducted by The Conference Board Reputation Risk Working Group in 2008 of 148 executives in different countries and industries to gather opinions regarding the state of reputation risk management in their organizations.  The importance of reputation risk is evident among those surveyed as 74% believe their company’s reputation has a high impact on stock price, and 82% of respondents indicate they are making a substantial effort to manage reputation risk.  Increasing resources are being devoted to reputation risk with about two-thirds of respondents indicating spending on reputation risk management has increased in the past three years and will continue to increase during the next three years.  Overall, 61% of those surveyed consider their companies very effective in managing reputation risk.

When asked about the most significant reputation risks, respondents rated product and service quality and safety as the highest concern (50%), with security and privacy of customer and employee information (48%) and financial performance (42%) close behind.  These risks represent traditional risk events and emphasize the importance of considering the secondary costs of events such as impact to reputation.  However, there are many additional reputation risks that are unrelated to the direct business risks managed by most risk management programs and companies. 

One way to manage some of these risks is preventative; by building a strong reputation, a company can absorb some of the potential negative reputation impact from a risk event.  Reputation risk management may be dependent on the location of a company as opinions about reputation risks differ significantly in the United States and in Europe.  For example, Americans believe more strongly that reputation has a high impact on stock price, while Europeans consider environmental impacts a more significant reputation risk than Americans. 

Making Reputation Concerns Part of Overall Risk Management

Organizations may be increasingly concerned with reputation risk management, but they have not necessarily integrated these concerns into their risk management programs as 24% of respondents indicated their reputation risk management process was a stand-alone process.  Furthermore, 74% of respondents have corporate communications playing a key role in overseeing reputation risk and only 42% have the enterprise risk management (ERM) or risk management group holding key responsibility.  This indicates that companies view reputation risk as more of a communications issue than a key consideration in business decisions. 

For a reputation risk program to be successful, senior leadership must be involved which seems to be occurring as 86% of respondents said their CEOs are very involved in managing reputation risk.  Even though there is senior leadership involvement, it seems that reputation risks may not be well-integrated into business decision-making as only 62% said their company included a detailed consideration of reputation when developing strategy, with even lower numbers considering reputation when entering a new market or developing new products or services.  Furthermore, only 39% of respondents said their business units were actively involved in managing reputation risk.

In efforts to assess and manage reputation risks, respondents reported the most significant challenge is assessing the perceptions and concerns of stakeholders (59%).  The main ways companies currently assess reputation risks are by engaging with stakeholders (78%), monitoring the content (77%) and volume (76%) of media coverage of the company, and monitoring performance against external ratings or benchmarks (76%).  However, companies vary in what they take into account when determining reputation risk.  Over half of respondents assess the reputation of their overall industry, but few assess their company’s reputation in individual countries or regions (38%) or for subgroups such as demographic groups of consumers (34%). 

One good way for companies to assess reputation risk is by considering gaps in the views of employees and other stakeholders, which 62% of respondents reported doing.  There are different methods and models for measuring reputation and one, the Reputation Institute’s RepTrak™ model, analyzes corporate reputation on twenty-three specific attributes over seven dimensions of performance, products and services, innovation, workplace, governance, citizenship, and leadership.

As new media outlets continue to emerge, more sophisticated media monitoring is also being developed.  Companies are starting to analyze media coverage to gain insight into its impact on stakeholder attitudes and to gain a factual basis for risk assessment.  However, many companies (56%) are still not using these sophisticated methods, possibly due to their cost or because they are not seen as a priority.  In addition to traditional media outlets, there is a proliferation of social media that allows information about companies to be widely dispersed in a short amount of time.  Companies are not yet viewing these blogs and social networking sites as having much impact on corporate reputation, with only 10% actively participating in social media.

Crisis management is another common reputation risk management activity, with 42% of respondents using it extensively.  There are several crisis management principles that appear to be widely accepted as important in most situations: stakeholder emotions are legitimate, demonstrating empathy is important, responsibility should be taken sincerely, the CEO is the public face of the company and should address crises, any underlying problem leading to the crisis needs to be addressed, and crises should be planned for and the plan should be tested.

Key Recommendations

There are several key recommendations companies can follow to help manage reputation risk.  Companies should have actively involved boards of directors that see the connection between strategy and its impact on both reputation and value.  Organizations should also demonstrate to the leaders and management teams in business units the impact of their actions on reputation. 

Reputation risk management should be integrated with ERM or other risk management programs in the organization.  The value of reputation should be quantified to enable management to improve decision making regarding resource allocation to reputation risk management and to calculate a return on investment for those efforts.  Employees should be used as corporate ambassadors to understand potential gaps in reputation.  Organizations should develop an understanding of and build relationships with key stakeholders.  Social networking and new media sites should be taken seriously and potentially monitored and engaged in to assess and influence stakeholder perceptions.  Additionally, crisis management should be enhanced to take into account stakeholder emotions.