Reputational Risk: A Company's Most Valuable Asset

“It takes 20 years to build a reputation and five minutes to ruin it. If you think about it, you’ll do things differently.” – Warren Buffet, US investor, business man and philanthropist

As senior executives begin to embrace the need for implementing effective risk management strategies, many have ignored what may well be the most potent risk an organisation can face: the risk to its reputation.

Reputation is a company’s number one asset. Studies have found as much as 50% of a company’s share price is derived from its brand, goodwill and value in the minds of customer. A recent Harvard Business Review article, ‘Reputation and Its Risks’ by Robert G. Eccles, Scott C. Newquist and Roland Schatz pointed out, “In an economy where 70% to 80% of market value comes from hard-to-access intangible assets such as brand equity, intellectual capital and goodwill, organisations are especially vulnerable to anything that damages their reputations.”

Due to its imprecise nature, reputation is one of the most difficult assets to quantify, hardest to protect and manage. Nonetheless, in this era of corporate scandal, malfeasance, and heightened risk to corporate reputations, managing reputational risk is vital.

At the beginning of 2007, TJX Corp. and JetBlue, two companies with stellar reputations, found themselves in the midst of corporate crises. Mid-January, TJX was forced to acknowledge that hackers had breached its data security systems, stealing nearly 46 million customer credit card records from its popular TJMaxx, Marshall’s and HomeGoods stores. The breach – the biggest credit card heist ever committed – was reportedly due to TJX’s lax internal security measures. Almost immediately, a flood of negative publicity was followed by a drop in the stock price, class-action lawsuits and regulatory investigations. The cost to address this breach could reach upwards of hundreds of millions of dollars.

A few weeks later, severe weather in the northeast wreaked havoc with air travel. JetBlue experienced a level of chaos unfamiliar in the discount airline’s short history. Several of its planes were stuck on runways at JFK International Airport in New York with hundreds of passengers left stranded onboard, some for up to 10 hours. JetBlue canceled hundreds of flights that week. JetBlue’s share price dropped 5% in the week after the crisis and the company suffered the humiliation of losing its BusinessWeek top customer satisfaction position on the cover of the 5 March issue.

The contrasting responses to their respective crises spoke volumes about each company’s preparedness for bad news. Though it had evidence of the data breach in December, TJX didn’t acknowledge the problem until much later. A public statement was issued, but the blogosphere was quickly buzzing with the perception that the company’s reaction was too little, too late. JetBlue’s CEO, David Neeleman, conversely, took immediate public responsibility for the company’s failure and promised to address the internal systems that had caused the failure. JetBlue made phone calls to all of the inconvenienced passengers and offered personal apologies.

What the TJX and JetBlue cases illustrate is the urgent need to make reputational risk a top priority in any company’s risk management efforts. The lesson is clear: managing reputational risk is something that must be done effectively before crises hit. Even with its quick response, JetBlue might have avoided some or all of its failures had it considered the full scope of the risks to it reputation beforehand. Understanding the consequences is one thing, finding proactive solutions to mitigate the problem beforehand is quite another.

What Can You Do?

Despite its potential impact, there are few guidelines for managing reputational risk. With the volumes of literature circulating about risk management, there is rarely a word to be found in any of these reports about handling the risk to reputation. I believe that managing reputational risk is not only feasible but that such management can be leveraged to generate value creation. Whereas regulatory compliance may be more prescriptive and tactical, managing reputational risk is broader more strategic, involving a process, cycle of vigilance, insight and action. To that end, establishing a reputational risk profile and framework for managing risk, creating adequate policies and procedures throughout the organisation is essential. An effective reputational risk management framework can be broken down into three core areas: identify and assess, manage and mitigate, monitor and report.

Identify and Assess

Smart companies start by creating a baseline assessment of their reputational risks, by canvassing the perceptions of all relevant stakeholders and communities affected by the organisation. Internally, a company must identify and maintain a specific focus on key aspects of the business that affect reputation:

• Operational risk and control self-assessments in order to monitor key processes, reduce surprises and unexpected losses, and rate reputational exposure.
• A best practice risk and control assessment process can help identify and prioritise key risk areas, reduce the likelihood of unexpected losses and ensure appropriate controls are in place to minimise exposure.
• Compliance assessments that ensure that management has signed off on financial reporting controls, privacy regulations and other regulatory demands.
• Non-compliance with key regulatory concerns leads to fines and penalties with direct financial impact, plus the associated media exposure and reputational damage it brings.
• Internal policy reviews that ensure that everybody within the organisation, top to bottom, is aware of all policies.
• A culture of compliance and an explicit understanding of the organisation’s ‘tone-at-the-top’ can help foster an environment that reduces fraud and promotes ethical behaviour.
• Vendor management policies and assessments that take into account all the risks inherent in the company’s supply chain.
• A company cannot outsource its risks. If a key supplier delivers faulty parts that go into a core product, your reputation is on the line.
• Marketing surveys, customer satisfaction surveys and other polling measures to determine public perception.
• Reputation is ultimately what is perceived and believed by others. That perception is dynamic and an organisation must keep tabs on the reality of the reputation.
• Investor relations actively connecting to the investor community and analysts to create confidence in the company’s financial transparency.
• Institutional and individual investors alike recognise well-managed companies that understand the value of excellent reputation.
• IT governance and IT risk management assessments and policies.
• Information technology is at the core of nearly every corporation. While it adds a tremendous amount of indispensable value, it also poses a high degree of risk.
• IT disaster recovery, crisis management plans, and business continuity assurance must all be in place to prevent the occurrence of, and minimise the impact associated with, events related to IT systems.

The assessment process should be coordinated for consistency, shedding light on interdependencies and hidden risks, helping to prioritise and focus mitigation efforts.

Manage and Mitigate

The assessment results can directly influence the development of risk management policy. However, to make this a living, breathing policy, the effort needs, visibility, penalties for failure to comply, guidelines for implementation throughout the organisation and a means to systematise it through technology. Designating an individual (such as the chief risk officer) to monitor and manage the company’s reputation is an important first step. This individual must report directly to the CEO, for a top down approach, and be charged with the task of communicating vulnerabilities associated with a company’s brand and identify potential weaknesses in the very fabric of the organisation. At this point, the management of risk should ultimately rest with the business personnel that manage the processes, who have real knowledge and are best suited to implement mitigation strategies and manage the risks going forward.

Monitor and Report

Gathering and aggregating key reputational risk indicators (KRRIs) must be an ongoing process overseen by the CRO in order to keep senior management and the board connected to the effort. KRRIs can have an impact on reputational risk, as they can help alert the CEO early to potential risks, well before damage is done to the brand.

Such criteria may include: What are the macro and micro economic conditions in which a company is operating? Is inflation up, the price of materials rising, unemployment dropping? What are key industry trends? Once the data is gathered, analysed and dissected, decision support dashboards can be generated and used to assess gaps in control, which forms a cyclical process.

Conclusion

Quantifying reputational risk may still be more art than science but companies shouldn’t be discouraged from actively pursuing a risk management plan. Hard numbers aren’t required to understand the realities of perception in this information drenched world. With the Internet, news cycles are instantaneous and events, positive and negative, are discussed so quickly globally that an organisation cannot afford to remain reactionary.

Such a task can be accomplished with the right technology. An integrated ERM technology platform can gain true visibility into the risks across an organisation. Perhaps more challenging is translating the intelligence that is gathered by the ERM technology into action that has a positive enterprise-wide impact. Some companies that suffer serious financial penalties recover their shine over time but negative perceptions can dog them for years or, in the worse case scenario, end in bankruptcy. Building reservoirs of goodwill is admirable but, as Warren Buffet pointed out, a reputation is a fragile thing, easily and quickly damaged if not carefully managed and protected.