Gauging the Impact of Reputational Risk

The following article is part of a continuing blog series that will explore ideas, concepts, discussions, arguments and applications associated with the field of enterprise and strategic risk management.

In my previous article, I made the point that the public discussion of reputational risk lacks a set of common standards or definitions. This lack of consistency allows organizations to interpret or define the concept of reputational risk in very different ways. For some, reputation is beginning to be viewed as something like the “risk of risks” in the same way people are starting to discuss the concept of the “internet of things.” I questioned whether reputation or brand is actually a risk or a residual event stemming from other extenuating risk domains or actions.

Upon further reflection and discussions with academics and risk professionals who are thinking carefully about this issue, I would go further now to suggest that reputation or brand risk involves perceived or real human behaviors that are, to some extent, measured against societal, economic or moral standards. The adherence or deviation from established standards generates the basis for the risk, and the variability from the standard influences the duration of the outcome.

The bigger question is: What impact does reputational risk have on economic performance when possibly mitigated by the existence of a robust enterprise or strategic risk management methodology? Is the data available to see the “correlates” between a reputational risk event that trigger or influence operational key process indicators like EBIT, ROA, ROE and share price (public or private)?

What we do know from the Aon 2015 Global Risk Management Survey is that business leaders are concerned about reputational risk in general and the possible linkages with other hazard and operational risks within their organizations.

The respondents to the survey said that they worried that a reputational risk event would significantly impact financial performance.

reprisk1If reputation/brand risk was identified as a precipitating event, the respondents identified regulatory change, increasing competition, talent retention, cash flow/liquidity and share price volatility as “follow on” risk consequences. In effect, reputation/brand risk might constitute a “gateway” risk, where other related “follow on” risk consequences are triggered and serve to increase the overall volatility/impact of the reputation event.

Another way to view the data is to see what events could trigger a reputation event.

reprisk2In this case, the survey respondents identified nine non-correlated risks that could precipitate a reputation/brand event. Here social media plays an important role. The speed by which information, accurate or not, is transmitted, consumed and iterated across the nine risk categories may have a material impact on the basis and duration of the reputation/brand event. There is also an error component associated with social media. How many times have we witnessed an initial media report of a brand damaging event that turns out to be prematurely reported and the facts distorted, only to be corrected in a later reporting cycle?

Next up: Fat vs. thin tail distributions.

Defining Reputational Risk

The following article is part of a new blog series that will explore ideas, concepts, discussions, arguments and applications associated with the field of enterprise and strategic risk management.

One of the more striking conclusions contained in Aon’s 2015 Global Risk Management Survey is that damage to reputation and/or brand was considered by the survey cohort to be the most significant risk to the enterprise. The survey was conducted in Q4 of 2014 and received input from over 1,400 respondents coming from both the private and public business on a worldwide basis.

The “Top Ten” most identified risks included:

  1. Damage to reputation/brand
  2. Economic slowdown/slow recovery
  3. Regulatory/legislative changes
  4. Increasing competition
  5. Failure to act or retain top talent
  6. Failure to innovate/meet customer needs
  7. Business interruption
  8. Third-party liability
  9. Computer crime/hacking/viruses/malicious codes
  10. Property damage.

The survey results should not come as any real surprise given the number of sensational news stories coming from around the world that highlight potential or real reputational or brand problems. We have witnessed data breaches ranging from credit card identity theft in consumer retail, to serious product recall notifications in the food and beverage industry, to product performance/ warranty failures in the automotive arena, as well as “hints of reputational quality,” defined as “trust” in the early stage politics of the presidential selection process involving private vs. public use of email servers. There is little doubt that news, sensational or not, impacting reputational or brand, will continue for some to come. The real question is: Should anyone care?

Defining reputational/brand risk is hard to accomplish:

Based on some additional research done by my colleague Sylvesto Lorello, reputational risk is not a new concept, but it arguably has no established or universally agreed upon definition. Academic and business thinking about this subject continues to evolve. Within the insurance underwriting community that I have been in touch with, reputational or brand risk is being compared in scope to contingent liability risks, but with a serious caveat: the basis of the risk is highly variable and the duration of the risk event/loss event is difficult to pin down economically.

The concept of reputation and brand for example, are notably absent from the 2004 framework for enterprise risk management proposed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). It is also overlooked in the Basel II international accord for regulating bank capital, which was also issued in 2004.

A lack of common standards or definitions of reputational risk mean that companies perceive it in different ways. Some risk practioners are beginning to view reputation as a “risk of risks” similar to the dialogue surrounding the “internet of things/objects.” Interestingly, an emerging dialogue is developing around whether reputation or brand is actually a risk or a residual event stemming from other extenuating risk domains or actions.

The ISO 31000 (2009)/ISO Guide 73:2002 definition of risk is the “effect of uncertainty on objectives.” In this definition, uncertainties include events (which may or may not happen) and uncertainties caused by ambiguity or a lack of information.

The U.S. Federal Reserve in 1995 defined reputational risk as “…the potential that negative publicity regarding an institution’s business practices, whether true or not, will cause a decline in the customer base, costly litigation or revenue reductions. In this case, the definition points to the potential for hard data from which basis and duration can be calculated.

Definitional issues aside, eventually societies will develop benchmarks with which to measure reputational or brand acceptability. One way of thinking about this approach is shown in the following exhibit.

UntitledHere we ignore some of the more difficult definitional discussion around a combined reputation/brand perspective, and limit our view to reputation alone. From a practical early stage standpoint, an entities reputation could be view from potential threat and potential impact perspective. On the threat side, it may be possible to segregate threats into four categories:

  • Risk to reputation stemming from employment activities;
  • Risk to reputation coming from product or customer issues;
  • Risk to reputation derived from governance; and,
  • Other less easily classified risks to reputation.

These categories appear for graphical purposes as if they are mutually exclusive, but in reality, there are good examples of causal overlap that increased risk volatility and severity. Recent oil spills and automobile product failure/recalls are enduring situations where more than one causal category created a economically catastrophic reputational problem.

On the other side of the graphic we outline the potential impacts to reputation coming from the threat categories. Again, while not mutually exclusive or exhaustive, the impact areas include:

  • Customer base
  • Financial valuation
  • Brand and media
  • Staf
  • Other less easily defined impacts.

Coming next, who are the stakeholders and how might one approach measuring reputational risk.

What to Do About Reputation Risk

Of executives surveyed, 87% rate reputation risk as either more important or much more important than any other strategic risks their companies face, according to a new study from Forbes Insights and Deloitte Touche Tohmatsu Limited. Further, 88% say their companies are explicitly focusing on managing reputation risk.

Yet a bevy of factors contribute to reputation risk, making monitoring and mitigating the dangers seem particularly unwieldy. These include business decisions and performance in the following areas:

Financial performance: Shareholders, investors, lenders, and many other stakeholders consider financial performance when assessing a firm’s reputation.

Quality: An organization’s willingness to adhere to quality standards goes a long way to enhancing its reputation. Product defects and recalls have an adverse impact.

Innovation: Firms that differentiate themselves from their competitors through innovative processes and unique/niche products tend to have strong name recognition and high reputation value.

Ethics and integrity: Firms with strong ethical policies are more trustworthy in the eyes of stakeholders.

Crisis response: Stakeholders keep a close eye on how a company responds to difficult situations. Any action during a crisis can ultimately affect the company’s reputation.

Safety: Strong safety policies affirm that safety and risk management are top strategic priorities for the company, building trust, and value creation.

Corporate social responsibility: Actively promoting sound environmental management and social responsibility programs helps create a reputation “safety net” that reduces risk.

Security: Strong infrastructure to defend against physical and cybersecurity threats helps avoid security breaches that could damage a company’s reputation.

But brand crises make headlines with increasing frequency, and companies are laying responsibility at the feet of the C-suite, particularly chief risk officers. Deloitte reports that respondents considered the primary responsibility to rest with: the chief executive officer (36%), chief risk officer (21%), board of directors (14%), or chief financial officer (11%).

What can they do? The study offered these key points to consider when crafting a crisis management plan:

  • Don’t wait until a crisis hits to get ready. Monitoring, preparation and rehearsal are the most effective ways to get ready for a crisis event. Organizations that can plan and rehearse potential crisis scenarios should be better positioned to respond effectively when a crisis actually hits.
  • Every decision during a major crisis can affect stakeholder value. Reputation risks destroy value more quickly than operational risks.
  • Response times should be in minutes, not hours or days. Teams on the ground need to take control, lead with flexibility, make decisions with less-than-perfect information, communicate well internally and externally, and inspire confidence. This often requires outside-the-box thinking and innovation.
  • You can emerge stronger. Almost every crisis creates opportunities for companies to rebound. However, those opportunities will surface only if you’re looking for them.
  • When a crisis seems like it’s over, it’s not. The work goes on long after you breathe a sigh of relief. The way you capture and manage data, log decisions, manage finances, handle insurance claims, and meet legal requirements on the road back to normality can determine how strongly you recover.

But the real objective should be preventing these potential crises to begin with. Deloitte recommends exploring the possibilities of “risk sensing” – using real-time data to monitor the issues that might impact a company’s reputation:

Crisis management for C-suite executives

Check out the infographic below for more insights from the Deloitte Reputation@Risk survey:

Deloitte Reputation@Risk Global Survey

Cyberbreach and Reputation Woes Hack Away at Bottom Line for 44% of Financial Firms

According to the 2015 Makovsky Wall Street Reputation Study, released Thursday, 42% of U.S. consumers believe that failure to protect personal and financial information is the biggest threat to the reputation of the financial firms they use. What’s more, three-quarters of respondents said that the unauthorized access of their personal and financial information would likely lead them to take their business elsewhere. In fact, security of personal and financial information is much more important to customers compared to a financial services firm’s ethical responsibility to customers and the community (23%).

Executives from financial services firms seem to know this already: 83% agree that the ability to combat cyber threats and protect personal data will be one of the biggest issues in building reputation in the next year.

The study found that this trend is already having a very real impact: 44% of financial services companies report losing 20% or more of their business in the past year due to reputation and customer satisfaction issues. When asked to rank the issues that negatively affected their company’s reputation over the last 12 months, the top three “strongly agree” responses in 2015 from communications, marketing and investor relations executives at financial services firms were:

  • Financial performance (47%), up from 27% in 2014
  • Corporate governance (45%), up from 24% in 2014
  • Data breaches (42%), up from 24% in 2014

Earning consumer trust will take some extraordinary effort, as a seemingly constant stream of breaches in the news and personal experiences have clearly made customers more skeptical of data security across a range of industries. When asked which institution they trust more with their personal information and safeguarding privacy, today’s consumers ranked traditional financial institutions—including insurers—higher by a wide margin over new online providers, but a larger percentage of consumers do not trust any organization to be able to protect their data:

  • Bank/brokerage, insurance, or credit card company (33%)
  • U.S. Government (IRS, Social Security) or U.S. Postal Service (13%)
  • Current healthcare company (4%)
  • Online wallets (PayPal, Google Wallet, Apple Pay) (4%)
  • Retail chain or small businesses (4%)
  • All other (3%)
  • None of these organizations or companies can be trusted (39%)