Reputation: Risk of Risks

Reputation: Risk of risks

An Economist Intelligence Unit white paper sponsored by Ace, Cisco Systems, Deutsche Bank, IBM and KPMG Reputation: Risk of risks

About the research

Reputation: Risk of risks is the fourth in a series of reports from the Economist Intelligence Unit’s Global Risk Briefing, a research programme targeted at senior executives responsible for managing corporate risk. Alasdair Ross is the author of the report, and Gareth Lofthouse is the editor. The Global Risk Briefing is sponsored by Ace, Cisco Systems, Deutsche Bank, IBM and KPMG. The research for this paper is based on a survey of 269 senior risk managers, as well as in-depth interviews with executives. The Economist Intelligence Unit bears sole responsibility for the content of this report. Our thanks to everyone who shared their time and insights in this report.

Whilst every effort has been taken to verify the accuracy of this information, neither The Economist Intelligence Unit Ltd. nor the sponsor of this report can accept any responsibility or liability for reliance by any person on this white paper or any of the information, opinions or conclusions set out in the executive survey.

Executive summary

rotecting a firm’s reputation is the most channels, increased scrutiny from regulators and important and difficult task facing senior risk reduced customer loyalty cited as three issues that Pmanagers, according to a new report by the expose companies to increased reputational risk. Four Economist Intelligence Unit. In a survey of 269 senior out of five executives say threats to their corporate executives, reputational risk emerged as the most reputations have increased significantly over the past significant threat to business out of a choice of 13 five years. categories of risk. Fully 84% of respondents felt that risks to their company’s reputation had increased ● Companies struggle to categorise and quantify significantly over the past five years. reputational risk. Fully 62% of companies say This report, which is sponsored by Ace, Cisco reputational risk is harder to manage than other types Systems, Deutsche Bank, IBM and KPMG, sheds light of risk. Problems in managing reputational risk include on the role of the risk manager in protecting corporate confusion over how it should be categorised; the lack reputation. The findings are drawn from a global of widely-accepted techniques to quantify such an survey of senior executives, of which 36% are from amorphous risk; and the fact that there is no formal companies in the financial services sector. Respondents ownership of reputational risk, with responsibility from 18 other industries also participated in the survey. spread amongst a wide range of business managers. The report’s main findings include the following: ● Compliance failures are the biggest danger. ● Reputation is a prized, and highly vulnerable, Threats to reputation come from many sources. corporate asset. Reputation is one of the most Companies worry particularly about exposure of important corporate assets, and also one of the most unethical practices, and about failing to deliver difficult to protect, according to executives in the minimum standards of service and product quality to survey. In the Economist Intelligence Unit’s Risk customers. However, the biggest threat to reputation Barometer, a regular feature of the risk programme’s arises from compliance failures, with 29% of quarterly surveys, reputational risk emerges as the companies citing failures to meet regulatory or legal main concern for the majority of risk managers—ahead obligations as a major source of reputational risk. of regulatory risk, human capital risk, IT network risk, and market risk and credit risk. This preoccupation ● CEOs are the top risk managers when it comes to with reputational risk stems primarily from the fact reputation. Everyone from the board down to ordinary that executives now see reputation as a major source employees has a role to play in guarding the of competitive advantage. But changes in the business company’s reputation. Ultimately, however, the CEO is environment have also made companies more regarded as the individual with primary responsibility Published vulnerable to reputational damage, with the for managing reputational risk by most executives in December 2005 development of global media and communication the survey. The chief executive is expected to set high

2© The Economist Intelligence Unit 2005 Reputation: Risk of risks

ethical standards, and to co-ordinate the or worse, and 44% say they are adequate. To improve organisation’s response to reputational threats. By their performance in these areas, organisations must contrast, the chief risk officer has a more technical learn how to communicate with customers and the role, attempting to quantify or prioritise potential media when things go wrong. Companies that have a threats to corporate image, and policing risk policies communications strategy that enables them to to make sure they are properly enforced. respond quickly and effectively to “bad news” events, and which address issues openly and proactively, often ● SMEs lag behind on reputational risk. Bigger emerge with their reputations in tact and even companies undertake more reputational risk enhanced. Those that don’t may suffer heavy and, in management activities. For instance, four-fifths of some cases, irreparable damage. respondents from organisations posting revenue in excess of US$10bn have implemented processes for The governance scandals of recent years have crisis management, compared with just one-half for reminded companies of the value and vulnerability of companies with revenue of US$1bn or below. Only half corporate reputation. Incurring reputational damage of SMEs formally monitor external perceptions of their can be fatal. By contrast, companies that establish a companies, versus 61% of larger companies. robust reputation have a strong competitive advantage when it comes to attracting and retaining ● Communication is the key to crisis management. customers and talented employees. Reputation is Crisis management is the area where companies feel therefore an asset that needs to be nurtured and their capabilities are weakest when it comes to protected, but as this research shows, many managing reputational risk. Only 10% say they are companies still lack strategies and organisational excellent at managing crises; 11% admit they are poor structures to ensure this happens.

Introduction

he most valuable asset in the capitalist economy ● Whose experience? An organisation’s reputation is not cash, stock or buildings, but trust. This was resides with a wide range of interested parties. Most Tthe case in the days when banks competed with important are the customers and investors, who each other to disperse their un-backed notes among between them provide the wherewithal that allows the an ill-protected public. It is even more so today, with organisation to function. At a second tier, regulators dizzying volumes of assets zinging daily through are key, setting and enforcing standards. Employees’ international financial markets faster than legal motivation feeds into productivity and service quality, confirmation can be provided. Thus, although a and they are the human face of the organisation. The shortage of cash can bring a company to its knees, it is general public may be affected by the organisation’s more frequently a loss of reputation that deals the actions, directly or indirectly, and may respond final blow. unfavourably if they feel their interests to be It is curious, then, that while tools and techniques prejudiced. These groups are neither mutually proliferate for managing monetary risks, the art of exclusive nor independent of each other. Indeed, the protecting reputations is poorly developed and feedback mechanisms between them require special understood. Most respondents to our survey agree attention from the guardians of reputation. that reputation is a primary asset of their organisation, and that the risks facing reputation have ● What experience? The face that an organisation grown in recent years. However, they also shows varies from stakeholder to stakeholder. acknowledge that reputational risk is harder to Employees focus on pay and work conditions, and on manage than other sorts of risk, largely because of a the availability of training and opportunities for lack of established tools and techniques and confusion advancement. Such matters are only loosely correlated about who is responsible. with the quality of service provided to customers. The In short, reputation is an increasingly critical asset, experience of the latter may come via an but protecting it is one of the risk manager’s toughest intermediary—a retailer or business partner, for jobs. Why? To start answering this central question, a instance—whose own standards of delivery impinge on definition of reputational risk needs to be established. the impression formed by the customer, potentially to The most popular is some form of the following: the detriment of the organisation. Investors may be focused more closely on shareholder value than on the Reputation declines when experience of an organisation quality of service being provided to customers, two falls short of expectation. factors that once again may be correlated only loosely. The regulator, meanwhile, may be scrutinising the But this apparently straightforward description hides organisation to ensure from a compliance perspective. a wealth of subtlety. In all cases, there may be a difference between what the organisation does and how its actions are

4© The Economist Intelligence Unit 2005 Reputation: Risk of risks

perceived. Reputations are as vulnerable to How signiﬁcant a threat do the following risks pose to your perceptions of failure as to failure itself. company’s global business operation today? (index score, where 100 = highest)

● Reputational risk (eg, events that undermine public trust in your products or brand) Which expectations? If a stakeholder’s experience 52 of the organisation falls short of expectation, it will Regulatory risk (problems caused by new or existing regulations) 41 downgrade its opinion. But how were these Human capital risks (eg, skills shortages, succession issues, loss of key personnel) expectations formed? Were they unrealistic to start 41 IT network risk (eg, network security breaches, IT systems failure) with? Did they reflect factors beyond the 35 Market risk (risk that the market value of assets will fall) organisation’s control, created perhaps by price- 32 gouging competitors or by shifting social attitudes to Credit risk (risk of bad debt) 29 matters such as environmental protection and Country risk (problems of operating in a particular location) equitable trading practices? Is an organisation being 22 Financing risk (difficulty raising finance) castigated because the sector in which it operates is 21 under a cloud, or because it is being associated with a Terrorism 19 lawbreaking peer? Organisations may be punished not Foreign exchange risk (risk that exchange rates may worsen) because of any failure on their part, but simply 18 Natural hazard risk (eg, hurricanes, earthquakes) because they are being held to the wrong standard. 18 Political risk (danger of a change of government) 18 All these considerations greatly complicate the task of Crime and physical security 15 those whose responsibility it is to build, maintain or Source: Economist Intelligence Unit, 2005 repair reputations. The responses to our survey, and the anecdotal evidence we have gathered, suggest that although risk managers are aware of the threats, recent years. Respondents identify the growing role of their responses vary widely from sector to sector, and reputation as a source of competitive advantage as the from firm to firm. factor most likely to focus management attention on reputational risk. The development of global Priority No 1 media/communication channels as a disseminator of reputationally sensitive information is rated second. Respondents to the regular Risk Barometer section in The regulator comes next, with the imposition of the survey place reputational risk clearly at the top of higher standards of governance in the wake of the risk managers’ list of priorities. With an index score of high-profile market failures of the past decade. 52, reputational risk is perceived as substantially more Customer power—their readiness to switch supplier— significant than regulatory risk and human capital is fourth in the list, ahead of governments’ greater risk, both of which score 41. IT network risk, which propensity to intervene in defence of the public comes next, scores 35, while the risk management interest. staples of market risk and credit risk score a modest 32 “It’s a buyers’ market,” says Derek Mander, head of and 29, respectively. finance & risk management for Bank of Ireland There are several reasons why reputational issues Securities Services. “In the past, if we failed to meet have become more of a focus for risk managers in our service standards, we would sit down with clients

How large an impact is each of the following factors likely to well, then hopefully our reputation stays where we like have in prompting an increased focus on reputational risk within your company? it.” Aegis is a media group, whose companies are (index score, where 100 = highest) engaged in everything from traditional media to

Reputation is becoming a key source of competitive advantage as products/ Internet and billboards, as well as media research. services become less differentiated 59 Mr Beale finds it a “struggle” to think of what Faster dissemination of ‘bad news’ through global media/ additional actions could be taken that are not already communication channels 51 covered by good overall risk management. However, Higher standards of governance imposed by regulators he emphasises that Aegis does spend time and energy 43 Customers readier and more able to switch suppliers than ever making sure that the perception of the company is 39 good. “We carefully consider who says what,” he says, Increased willingness of governments to intervene in business on issues of public concern and thought is given to the potential impact of actions 33 on clients and employees. Since other executives Customers‘ increased focus on buying from ethical suppliers 26 describe these activities as the fundamentals of Increased targeting of companies by pressure groups 24 reputational risk management, it appears that much of Other the confusion here arises simply from definitions. 19 Source: Economist Intelligence Unit, 2005 Doug Gafner, director of risk management at Hilton Hotels, considers reputational risk to be “more about getting everything else right” than a unique issue. and reach a solution. Now, clients are more likely Hilton, for example, does not buy brand risk simply to change service provider.” insurance, even though it is one of most trusted These changes in the business environment are brands in the US. driving most risk managers to see reputational risk as At the other extreme comes Dr Guruswami a critical issue. There is less agreement on how it Raghavan, professor of finance at the SDM Institute should be addressed, or even whether it exists as a for Management Development in Mysore, India. separate category of risk. The division between those “Reputational risk is the starting point for all risk,” he respondents considering it a category of risk in its own explains. “If you have no reputation, you have no right and those who view it as arising from a variety of business.” Companies that see their brand as their other risks is virtually half-and-half. Nevertheless, primary asset tend to treat reputational risk as an most companies in the survey see reputational risk as a issue in its own right, and devote special resources to problem in need of its own, special solutions. Roughly managing it. three-quarters of companies disagree with the The potential of relatively minor failures of risk statement, “A well-run business doesn’t need to invest control to rebound on reputation means that, at the extra resources into guarding against reputational very least, risk managers must be aware of how an risk.” event might damage the company’s image. But these Ian Beale, risk manager at Aegis plc in London, issues may also require a specific response. Many kinds focuses on reputation and on the perceptions of of risk, in addition to the narrow threat they pose to investors, clients and employees, but does not the business operation, have a reputational element manage reputation as a specific risk. “We concentrate that must be managed separately, whether by on the root causes,” he says. “If these are managed managing stakeholder expectations via corporate

6© The Economist Intelligence Unit 2005 Reputation: Risk of risks

communications or by establishing processes for Do you view threats to your company’s reputation as: quickly addressing crises when they arise. (% respondents) In some areas, the reputational aspect of a specific A category of risk in its own risk can be the predominant threat, and recognising right 52 this may call for a tougher response than might Something that arises as a consequence of a variety of otherwise have been adopted. For instance, when other risks 48 selecting business partners or, in the case of a bank, major depositors, due diligence should weed out those whose financial backgrounds suggest an unacceptable likelihood of business interruption or default. But it may also uncover unsavoury facts about the potential partner, which, although not reflecting directly on Source: Economist Intelligence Unit, 2005 their financial health, reveal a character with which the organisation may prefer not to be associated. financial cost [of legal sanction] is high, but the The business of choosing your trades is familiar to opportunity cost [of losing business because of a bad Nedia Miller, owner and founder of Miller CTA, a reputation] is even higher.” In this context, Ms Miller commodities trading adviser specialising in “crude oil believes in the importance of personal ethics in and all the products”. In designing hedging strategies protecting a firm’s reputation. New rules and guidance for major clients there is broad scope for unethical introduced since Enron’s collapse may help in the behaviour. “I’ve given up large clients rather than short run, “but unless there are ethics, it won’t work cross the line and risk my reputation,” she says. “The for long”.

intrusive role of those charged with sufficiently flexible to overcome Regulation meets policing the proper functioning of the occasional shortfalls in service. “The reputation market economy. “The intentions are marketplace will eventually realise that good: it is an attempt to exorcise the over-emphasis on individual risk issues is decline of corporate values and to an inefficient way of dealing with them, improve the public trust in corporate and place more emphasis on bilateral Our survey respondents are more or less business and the market economy.” relationships,” he says. unanimous in considering that reputa- But has the pendulum swung too far? He blames over-zealous regulators. “A tional risk has risen sharply in recent For Mr Mander of Bank of Ireland lot of what we’re doing is driven by years. Securities Services, the answer is an regulatory requirements rather than best The reasons are many, but high- emphatic “yes”. The unforgiving focus on practice,” he explains. However, he profile market failures such as those that failures to meet standards is forcing acknowledges that with new measures brought down Enron and Worldcom are a organisations to dedicate valuable such as the Basel II revised international big part of the story. “Regulators are resources to protecting reputation, capital framework still in the pipeline, it regulating more,” says Mr Damasceno at rather than on establishing relationships will be some time before the pendulum ABN AMRO, pointing to the increasingly with clients and customers that are reverses its swing.

The relationship with stakeholders is in itself a The cost of reputation potential source of business failure. This is reputational risk pure and simple, and managing it Whether organisations are altogether comfortable implies both an awareness of how stakeholders feel with modern definitions of reputational risk, there is about the organisation and a capacity to respond little doubt about the potential costs of failure to get when the feedback is bad. Judy Larkin, director and to grips with it. Companies found reputational co-founder of Regester Larkin, a consultancy problems to be the most costly in financial terms, specialising in reputational risk, emphasises this relative to a series of other risks. Among those who aspect. With a “more intrusive media, organisations had faced reputational problems, 28% described the must focus resources and time” on monitoring their financial toll as major. Loss of key skills and talent, the environment. next most severe problem, caused a major financial hit In short, black-and-white descriptions of for only 18% of those affected (although it is worth reputational risk as either discrete or dependent miss noting that 52% identified this as a source of minor the point. Reputational risks can be viewed as losses, making it the leading cause of financial losses independent in their effect on the organisation, but among the sample overall). dependent in that reputational damage usually The results reflect the manner in which damage to reflects a failure to deliver products and services as reputation can be more costly than the direct impact promised. There is also scope for managing reputation of the events that caused it. “The conventional areas as a separate facet of the organisation, by surveying of risk are like the visible part of an iceberg,” says Dr stakeholder opinion and adjusting the corporate Raghavan. “Reputational risk is the larger part below message to address shortfalls. the surface.”

the ethical investment market and the Accountability Campaign at Friends of the Ethical business NGOs seeking to enforce ethical gover- Earth, a UK pressure group. “The nance. potential of socially responsible Among the former is Wayne Hawkins, a investment is probably overdone. It is board member of Hunter Hall, a more interesting to see how mainstream Two fairly recent developments in the pioneering ethical investment firm based investing is getting more responsible,” business environment, customer demand in Australia. His main interest is in he maintains. In this, he believes the for ethical products and the rising influ- safeguarding the company’s own good trends are firmly in favour of the activists. ence of pressure groups, are both signifi- name. “An ethical fund manager lives or For instance, he identifies a growing cantly increasing firms’ exposure to dies by their reputation,” he says. realisation that more environmental reputational risk, according to at least For pressure groups, the challenge is regulation and legal obligation is on the one-quarter of respondents. This may be to put the values of specialised funds way. “It is a train that is coming.” of some encouragement to a couple of such as Hunter Hall’s into general Companies that are ahead of the trend, groups whose activity revolves around practice. The point is made by Craig the “forward thinkers”, will be the the growing importance of reputation: Bennett, head of the Corporate beneficiaries.

8© The Economist Intelligence Unit 2005 Reputation: Risk of risks

How much damage have the following events inﬂicted on your company’s ﬁnancial performance in the past? (% respondents) Major Minor Non/negligible Loss of reputation 28 36 36 Loss of key skills and talent 18 52 30 Employee fraud 15 35 50 Loss/theft of intellectual property 14 39 47 IT failures or electronic security breaches 10 40 49 Damage to physical infrastructure 7 36 57 Source: Economist Intelligence Unit, 2005

On the other side of the coin, those looking for Danger points investors are likely to find good reputation a key factor in attracting suitors. “Confident investors will pay a For most risk managers, it is the failure to comply with higher price for a piece of the action,” says Jonathan regulatory or legal obligations that represents the Clare, chief executive at Citigate Dewe Rogerson, a biggest threat to reputation. This is supported by the London-based public relations company specialising in relatively prominent position of the regulator as a financial and corporate communications. “If companies driver of board-level focus on reputational risk, get their PR right, it will reduce the cost of capital.” indicated above. Second on the list of potential sources Financial services and energy sector companies of reputational damage is failure to deliver minimum appear to be most exposed to major financial damage standards of service and product quality to customers— through reputational risk. Other industries feel less although the gap is small. The risk that unethical exposed in this regard. For instance, more than one- practices in the organisation will be exposed is placed third of government/public-sector respondents third, once again by a narrow margin. Security breaches identified loss of key skills and personnel as having figure quite prominently, as do failures of crisis resulted in major financial losses. Among this group, management and risk by association with third parties. reputational damage has resulted in major losses for Failure to hit financial performance targets scores only one-tenth. Since there is little reason to suppose only modestly. Given the importance of investors that public organisations incur less reputational risk among organisations’ stakeholders, and the focus in than private ones, the implication is that they are less modern investing on shareholder value, the relatively susceptible to reputational damage. In professional lowly position of meeting market expectations appears services, reputational damage is the biggest single odd. It may reflect the fact that organisations perceive cause of major financial loss, but loss of key skills and this to be a financial risk rather than a reputational personnel runs it a far closer second than in the other one, although modern risk management theory would industries surveyed. suggest that they should consider the reputational facet of financial performance more seriously.

emerged. Although first-year lectures research-intensive institution. We School for scandal were stuffed, attendance soon dropped concentrated on attracting more funding off. The financial problems persisted, and and higher-level faculty,” Mr Lackey says. now the University was saddled with an The students that did make it in were A decade ago, faced with a financial unenviable reputation into the bargain. better treated. Student services— squeeze that threatened its survival, Car- The first challenge was one of everything from food to buildings—was leton University in Ottawa picked a strat- recognition: “We asked students why revamped. egy designed for a quick increase in they weren’t coming to Carleton,” writes The University is now clawing its way enrolments, the main pillar of which was Mr Lackey. It quickly became obvious that back up the national rankings—and to lower entry requirements. It was not the institution’s poor reputation was reputational risk has fallen from first subtle: “We took students that probably putting off the better candidates. place to third on the annual risk report. would not have made it into other uni- Once the reputational problem had The Carleton case is a study in what versities,” says Tony Lackey, manager, been added to the risk matrix—it happens when the reputational aspects risk and insurance. The institution picked immediately rose to the top of the list in of a strategic decision are not properly up the nickname, “Last-chance U”. the annual report prepared for senior understood. “We were in financial trouble Enrolments responded, and funding, a management—the remedies were more and we went downmarket,” explains Mr function of student numbers, rose straightforward. “We raised entry levels Lackey. “Nobody had tied the accordingly. But problems quickly and worked to turn ourselves into a reputational impact into funding.”

The anecdotal evidence is that many do, and that financial sector are separated out from the rest. share price is perceived as a key way of gauging the Regulatory and legal non-compliance receive value of reputation. Mr Mander of Bank of Ireland particular emphasis from financial organisations, Securities Services points out that the bank is presumably reflecting both the intensity of sectoral particularly vulnerable to anything that depresses the regulation relative to other industries and the key role share price. It has escaped the consolidation of the that legal compliance plays in popular perception of sector so far, but a reputational crisis would leave it banks, pension funds, insurance companies and the “wide open to takeover”. like. Standards of service sink to fourth place for this At the lower end of the scale, it is more interesting sector, below both exposure of ethical practices and to look at the weight of respondents identifying security breaches—again, public trust in honest reputational impact as minor. This suggests that, in service appears to be the key, rather than public general, both labour unrest and environmental perception of the quality of that service. breaches are considered unlikely sources of In contrast, those in other sectors place the risk of reputational damage. It should be noted, however, failing to deliver minimum standards of service and that if more environmentally-sensitive industries product quality to customers as the principal threat to (such as oil, mining and timber) were represented in their reputations. Failure to comply with laws or the survey this issue might be more highly ranked as a regulations is a rather distant second, closely followed source of reputational risk. by the exposure of unethical practices. Towards the The list of priorities changes when results for the bottom of the list, non-financial sector respondents

10 © The Economist Intelligence Unit 2005 Reputation: Risk of risks

score environmental breaches as a minor threat to How are we doing? reputation—but, as would be expected, give it more emphasis than financial sector respondents. Reputation is a dynamic asset, changing as Do these conclusions support the proposition that organisations present new services and products in new reputational risk management is an issue distinct from markets, being held to changing criteria and facing simply ensuring that the first-tier risks are properly unforeseen challenges. This suggests that there is a role covered? Only to a point. Although first-tier risk issues for risk managers both in maintaining and protecting predominate in the list, a couple with a more direct the organisation’s standing with its stakeholders, and impact on reputation are prominent among managers’ in repairing its good name when events conspire to concerns. On the one hand, the importance of being damage it (see box: How to manage a crisis). perceived as ethical, in particular, is arguably more a It is the latter that receives most attention from risk reputational issue than one of fundamental risk managers, with 64% of respondents saying they plan management. On the other, one of the issues most and document processes for crisis management. closely associated in the public mind with reputational However, monitoring perceptions also figures standing, being seen to address issues of public prominently, with 53% reporting that external concern such as climate change, is relegated to the perceptions of the company are regularly measured. bottom of the list of priorities. Once again, in the vein of preparation and early warning, 50% train their employees to identify and To what extent are the following actions a source of reputational risk for your organisation? manage reputational risks (a low number, considering (% respondents) the prominence all respondents give to the issue) and Major Minor 47% systematically track reputational threats. Non-compliance with regulation/legal obligations 66 The most revealing split in these responses is 53 Exposure of unethical practices according to the size of the organisation. Not 58 52 surprisingly, there is a general trend for those with Security breaches (eg, sensitive data leaks, hacking of customer financial data) more revenue to undertake a greater number of these 57 43 activities: 80% of respondents from organisations Failure to deliver minimum standards of service and product quality to customers 47 62 posting revenue in excess of US$10bn have Poor crisis management implemented processes for crisis management, 40 41 compared with just 53% for sub-US$1bn companies Failure to hit financial performance targets 34 (although in both cases this is the most widely 25 Risk by association with suppliers, partners, alliances, etc with poor reputations employed strategy). 34 36 Monitoring outside perceptions of the organisation Failure to address issues of public concern pro-actively (eg, climate change) 14 appears to be something of a luxury, with 61% of the 24 Environmental breaches bigger organisations carrying this out, compared with 14 25 51% of the smaller organisations. GE Healthcare is one Labour unrest such company, large in its own right but also a 11 18 subsidiary of a true global giant. This is reflected in the Other 4 9 breadth of its efforts to monitor and manage Source: Economist Intelligence Unit, 2005 stakeholder perceptions. “We monitor how the

commitment to fix the problem, and lay Citigate Dewe Rogerson. “Then you have How to manage out in detail what it will do. to convince customers and investors that a crisis 3. Control—if the company is at the you have a solution to the problem.” centre of a major crisis, the leading Mr Jackson of Fordham University figures in the company need to show that summarises it thus: “Be humble, disclose, What should a company do when faced they are in control of the situation and apologise, resolve to change things, be with bad news that could hurt its reputa- are working with any relevant authorities systematic.” He advises above all against tion? to ensure it won’t happen again. treating the problem as a cosmetic issue, If a crisis has already broken, there is Companies “have limited time” to start which people will immediately see not much room for manoeuvre. First, this communication, otherwise other through. He warns that “[superficial according to Ms Larkin of Regester organisations will assert their own change] makes people even more angry”. Larkin, the company needs to “fix the agendas. If they can communicate Ragnar Lofstedt, professor of risk problem” that caused the reputational quickly, those running the business may management at Kings College London, issue. At the same time, it needs to get stakeholders to give them the benefit takes a more strategic approach. “The “communicate very quickly”. This of the doubt and have time to do response depends on the nature of the communication must have three something about the problem. threat,” he says. “You need to judge how elements, or three “C”s: “If the reality is bad, it’s essentially a much trust the public has in you and in 1. Concern—the company has to matter of making people important to the your attacker.” If you are trusted more, acknowledge that something has gone company understand the issue, and to he suggests, fight back. He believes that wrong and express regret and concern. demonstrate that the company is levels of trust are the key, rather than the 2. Commitment—it must express a listening”, says Jonathan Clare of details of the case.

organisation is perceived with stakeholders, we lobby, biggest threat to reputation today,” she says. She says we establish relationships with the media, and we that you can be doing everything right, but if people advertise our philanthropic efforts,” reports Steven don’t think you are you still have a problem. Ms Larkin Kay, the company’s process and crisis manager. is “surprised that some [business] sectors still don’t The company’s diversity and size give it an acknowledge the impact of public perception”, and important role in major disasters such as the therefore pay insufficient attention to reputational hurricanes that hit the US Gulf coast and the Asian risk management. tsunami. The diversified group can supply a range of However, it is difficult to satisfy the demands of every vital supplies and services, such as fresh water, power group of stakeholders. As Kevin Jackson, professor of and medical equipment. These are opportunities for business ethics at New York’s Fordham University, puts the company to be seen in the best light, but these it: “You are never going to be able to please everybody.” operations must be undertaken carefully, since they Mr Jackson, author of a book, Building Reputational could be construed as exploiting misfortune to gain Capital, points to the example of HB Fuller, a large US- business advantage—having the opposite reputational based manufacturer of adhesives and other chemicals. effect to that desired. The company worked hard to build a reputation for This focus on perception is where many companies corporate responsibility, but nevertheless took a big hit fall down, according to Ms Larkin. “Perception is the a decade ago for not seeming to do enough about glue

12 © The Economist Intelligence Unit 2005 Reputation: Risk of risks

sniffing in Latin America. Varghese’s team is now looking at managing such risks Among smaller firms, no strategy is pursued by more systematically. substantially more than one-half of respondents, A consultant is being taken on to benchmark the while, among the larger, only three are carried out by current risk status. “We’re identifying where we stand less than one-half. with stakeholders, including banks, regulators, A typical example of a firm seeking out a strategy customers and shareholders,” says Mr Varghese. “Then for managing reputational risk is Gulf Finance House we’ll assess how to address areas of weakness, and BSC, based in Bahrain, that offers Islamically how to manage a crisis should it arise.” structured financial services for regional investors. Mr Varghese takes a crumb of comfort from the The bank did not have a risk management strategy at knowledge that he is not alone in his quest for a all until 18 months ago, when it appointed Silvan reputational risk management strategy. “We all feel Varghese as head of risk management. At the time, more comfortable with tangible risks that we can protecting the bank’s reputation was considered a count,” he says. matter for the communications function. Mr Interestingly, in light of popular perceptions of the

Which of the following activities does your organisation take to manage reputational risk? Please check all that apply. More than US$10bn revenues (% respondents) Less than US$10bn revenues Less than US$1bn revenues (1) Rank Processes for crisis management are planned and documented (1) 80 (1) 59 (1) 54 External perceptions of the company are regularly measured (among customers, media, pressure groups, etc) (2) 61 (2) 52 (3) 51 A broad programme for corporate social responsibility to address possible sources of reputational risk is developed (3) 61 (6) 35 (5) 31 Reputational threats are systematically tracked (4) 56 (4) 45 (4) 46 Employees are trained to identify and manage reputational risks (5) 54 (3) 50 (2) 53 A cross-functional team handles reputational threats and crises (6) 54 (5) 35 (6) 30 The risk function’s remit now covers key reputational threats and challenges (7) 46 (7) 31 (6) 30 Standards on environmental, human rights and labour practices are set publically (8) 22 (8) 30 (8) 26 Relationships and trust with pressure groups and other potential critics of your firm are established (9) 17 (9) 24 (9) 25

Source: Economist Intelligence Unit, 2005

modern risk environment, companies of all sizes agree although 32% consult them at least once a year. Local in the low priority they give to buzz issues such as and international NGOs are also sidelined, ignored by establishing relationships with pressure groups and 32% and 42%, respectively. Once again, however, a setting out public standards on environmental, human substantial minority do seek out their opinion on a rights and labour practices. regular basis. Again, sectoral splits reveal some interesting Matter of opinion variations. Customer opinion is generally given the highest priority, but this is not the case in the energy When it comes to reputation, all opinions matter, but sector, where the powerful influence of regulators sets do some matter more than others? Our survey suggests a premium on their views of the organisation. In this strongly that they do. group, 45% continuously monitor regulator opinion, Of all respondents, 60% test the perceptions of and a further 35% do so at least once a year. Customers customers at least quarterly, and 40% say they do so and government are next on the list, but political continuously. Only 4% say that they have never taken activists and NGOs are consulted rarely, if at all. the pulse of customer opinion. Regulators’ views are In the financial sector, customers and the regulator also sought relatively frequently—at least quarterly by are polled systematically—at least once a year by 80% 51%, although only 23% say they continuously survey in the case of the former and by 75% in the case of the regulator opinion. The influence of the media on latter. But the frequency of monitoring varies sharply, organisations’ reputation is also recognised, with 58% with customers courted more assiduously; 45% of saying they test opinion among this group at least respondents say they monitor customer opinion once a year. constantly, but only 26% monitor the opinion of the Political activists are ignored by 46% in our sample, regulator.

How often do you test perceptions of your company among the following corporate stakeholders? (% respondents)

Continuously At leastonce At least four Once a year Only occasionally Never a month times a year in the past Customers 40 6 14 20 16 4 Regulators 23 9 19 18 16 14 Media groups 18 10 14 16 19 24 Government 15 7 14 17 24 23 Local non-governmental organisations 7 6 11 15 27 32 Political activists/pressure groups 5 5 7 15 23 46 International non-governmental organisations 5 4 8 16 25 42

Source: Economist Intelligence Unit, 2005

14 © The Economist Intelligence Unit 2005 Reputation: Risk of risks

Which of the following have major responsibility for managing Who’s in charge? reputational risk within your company? Please check as many as apply. If reputational risk lies somewhat apart from (% respondents) quantifiable first-tier risks such as credit risk, market CEO/President/Chairman risk and network risk, is there a danger that it is 84 Board of directors disregarded, and whose job is it to ensure that that 42 Chief risk officer (CRO)/Head of risk management does not happen? Asked to locate responsibility for 39 managing reputational risk, respondents give a clear Head of business units 39 picture of the hierarchy. Communications manager At the top of the reputational risk team is the CEO, 35 CFO cited by 84% of respondents as the person with 33 primary ownership of this area. Companies appear to Compliance officer 33 believe that only the chief executive can take ultimate Chief operating officer responsibility for ensuring that all parties are working 28 Marketing manager in unison to protect reputation and manage crises. The 24 Head of country operations CEO is also charged with sensing external perceptions 23 of the organisation, a role backed up by the Brand manager 13 communications function. Interviewees also Media agency emphasised the importance of the CEO’s role in setting 11 Other the right tone and standards of conduct to protect and 5 enhance the company’s reputation. Responsibility is Source: Economist Intelligence Unit, 2005 also shared more broadly among the board of directors as a whole, but only by 42% of respondents. emphasise the importance that all staff members are Only 39% of respondents identify the CRO or head aware of their part, and play it fully. According to Artur of risk management as bearing major responsibility. Damasceno, vice-president of audit at ABN AMRO, Significantly, the heads of business units are given “[reducing reputational risk] starts with your personal equal weighting. In contrast to the CEO’s role, the example as an employee and a citizen… Everybody CRO’s chief area of responsibility is a more technical should be involved [in protecting reputation], one, focused on attempting to quantify threats to otherwise it would not be sustainable.” reputation and policing systems to make sure they are The CEO’s role in leading this “reputational team” properly enforced. This is an obvious enough division seems pivotal, but some companies reveal doubts of labour according to expertise. As Ken Akoundi, about whether anyone is investing sufficient time and senior vice-president for risk management (CRO) at resources into reputational risk management in Optima Management in New York, puts it, “A lot of practice. One response in the survey that is these senior people do this more based on years of particularly revealing is the high level of concern experience than on a model or framework. My job is expressed by executives about the fact that no one has about creating the framework.” taken formal responsibility for reputational risk. This While the role of standard-bearer for the brand is considered a major obstacle to effective risk belongs to the CEO and the board, many risk managers management by 39% of respondents, making it one of

the biggest barriers to managing reputational risk to monitoring threats to reputation, only 51% successfully. It suggests that satisfaction with the describe their capabilities as good, while 34% describe current allocation of responsibility is not high. them as adequate and 15% as poor—more than for any other area. Room for improvement The difficulty of controlling risks to reputation arising from third-party partnerships is reflected in The lack of consensus regarding reputational risk the relatively low level of satisfaction expressed with management strategies and the shortage of capabilities to ensure ethical practices throughout the established tools for the job are reflected in the patchy supply chain. This is a particularly elusive area of risk levels of satisfaction expressed by risk managers in management. Damage to the reputation of a business their efforts in this area. More than 60% appear happy partner, adviser or auditor can be transferred to the with their communications with customers, and this organisation by simple association, and is less easily matches the priority given above to monitoring repaired than the cost of an unpaid bill or an unmet customer opinion. A further 33% consider their contract. “If their reputation is good, mine is probably capabilities in this area to be adequate, and only 7% good too,” says Dr Raghavan. class them as poor. When it comes to communicating The lowest level of confidence, despite the with other stakeholders, the level of satisfaction is emphasis given to it in other questions, concerns the markedly lower: 48% declare good capability, 38% capability to manage crises. Here, those judging their adequate and 13% poor. This implies that the lower position as excellent (10%) are outweighed by those frequency with which opinion is monitored among who say they are poor (11%) in this area. these groups, as indicated above, is not through lack Opinion is divided over whether reputational risk of desire among risk managers. can be quantified. Just over one-half of respondents Substantial confidence is expressed in believe it can, compared with one-quarter who think it organisations’ ability to enforce strong controls on cannot. It would be reasonable to expect that those governance and compliance. However, when it comes most confident in their ability to express reputational

How would you rate your company’s capabilities in the following areas? (% respondents) Excellent Good Adequate Poor Very poor Communicating with customers 19 41 33 6 1 Enforcing strong controls on governance and compliance 17 40 36 6 1 Monitoring threats to reputation 12 39 34 13 2 Ensuring ethical practices throughout the supply chain 14 35 40 9 1 Communicating with external stakeholders (other than customers) 11 37 38 13 Crisis management 10 34 45 10 1

Source: Economist Intelligence Unit, 2005

risk in numbers would be from industries such as used as a guide to the allocation of resources. The finance, where a quantitative approach to risk principle appears sound, but is dogged by difficulties, management is well established. In fact, this is not the such as the lack of a database of reputational losses case. In financial services, 30% consider reputational against which judgments can be benchmarked and the risk unquantifiable, a larger percentage than in the difficulty of separating direct losses from the less overall sample. In contrast, within the energy sector foreseeable indirect ones (a regulatory sanction is two-thirds felt they could quantify reputational finite; the reputational fallout is not). Mr Jackson of threats. Only one in ten said they could not. Fordham University suspects that reputational risk Practice suggests that, although methodologies for cannot be measured, and denounces “a faction of quantifying reputational risk have been put forward, empirically minded researchers who want to make it none has won general acceptance. Methods centre on [reputational risk] as scientific as possible”. Even so, business managers estimating the losses that would many risk managers are attempting to at least occur in the event of a service failure that rebounded prioritise, if not precisely quantify, the various threats on reputation, normally by ranking them on a simple against their companies’ reputations. numerical scale. The results can be consolidated and

Conclusion reputational risk team include the chief risk officer, who tends to be more focused on the more technical Opinion is divided as to whether reputational risk is a task of monitoring, mitigating and, where possible, category of risk in its own right, or merely the quantifying reputational threats. Communications, consequence of a failure to manage first-tier risks. service and sales staff are involved in mitigating the Whatever position companies take on this, almost all reputational fallout of everything from a negative executives agree that corporate reputation is a hugely news story to a break down in customer service. Above valuable asset that needs to be protected. It is also all, good companies create a culture where employees clear that serious reputational damage can occur take responsibility for enhancing corporate reputation simply as a result of perceived failures, even if those through their everyday activities. Responsibility for perceptions are not grounded in fact. Understanding corporate reputation, and the threats that can how different aspects of an organisation’s activities undermine it, extend from top to bottom in today’s impinge on stakeholder perceptions is therefore a vital organisations. aspect of protecting a company’s reputation. Currently, many companies feel that their There are three distinct tasks to managing capabilities in managing reputational risk leave much reputational risk: establishing reputation to begin room for improvement, but the high rewards of success with, maintaining it through the rough and tumble of should provide strong motivation for progress in this business operations, and restoring it when it has been area. Incurring reputational damage can be fatal, but damaged. The latter two, especially, call for very establishing a robust reputation can provide a strong different actions (and actors). Whereas establishing competitive advantage. A good reputation strengthens and maintaining reputation may be considered a market position, reduces the price of capital and matter of successful risk control in other areas, increases shareholder value. It insulates the brand, reputational repair clearly cannot. permits higher prices and helps to attract top talent. It Reputational risk can arise from almost any protects public companies from unwelcome takeover business failure. As such, it is too important and wide- bids, arms them for M&A forays of their own, and raises ranging to belong to any individual or department. the potential returns from share offerings. In times The CEO plays the vital co-ordinating role, but must when the issue of trust is under particular scrutiny, also personify the values and conduct that ensure a these are prizes well worth attaining. company’s good standing. Other members of the

About the survey How large an impact is each of the following factors likely to have in prompting an increased focus on reputational risk A total of 269 senior risk managers participated in our within your company? (Index score, where 100 = highest) survey on risk and reputation. The survey was Reputation is becoming a key source of competitive advantage as products/ conducted in October 2005, and our thanks are due to services become less differentiated all those who shared their time and insights. 59 Faster dissemination of ‘bad news’ through global media/ communication channels 51 Higher standards of governance imposed by regulators How signiﬁcant a threat do the following risks pose to your 43 company’s global business operation today? Customers readier and more able to switch suppliers than ever (Index score, where 100 = highest) 39 Increased willingness of governments to intervene in business on issues Reputational risk (eg, events that undermine public trust in your products or brand) of public concern 52 33 Regulatory risk (problems caused by new or existing regulations) Customers‘ increased focus on buying from ethical suppliers 41 26 Human capital risks (eg, skills shortages, succession issues, loss of key personnel) Increased targeting of companies by pressure groups 41 24 IT network risk (eg, network security breaches, IT systems failure) Other 35 19 Market risk (risk that the market value of assets will fall) 32 Credit risk (risk of bad debt) 29 To what extent are the following actions a source of reputational risk for your organisation? Country risk (problems of operating in a particular location) 22 (% respondents) Financing risk (difficulty raising finance) Major Minor 21 Non-compliance with regulation/legal obligations Terrorism 66 19 53 Foreign exchange risk (risk that exchange rates may worsen) Exposure of unethical practices 58 18 52 Natural hazard risk (eg, hurricanes, earthquakes) Security breaches (eg, sensitive data leaks, hacking of customer financial data) 18 57 43 Political risk (danger of a change of government) 18 Failure to deliver minimum standards of service and product quality to customers 47 Crime and physical security 62 15 Poor crisis management 40 41 Failure to hit financial performance targets 34 Do you view threats to your company’s reputation as: 25 (% respondents) Risk by association with suppliers, partners, alliances, etc with poor reputations 34 36 A category of risk in its own Failure to address issues of public concern pro-actively (eg, climate change) right 52 14 24 Something that arises as a Environmental breaches consequence of a variety of 14 other risks 48 25 Labour unrest 11 18 Other 4 9

How often do you test perceptions of your company among the following corporate stakeholders? (% respondents)

Who is primarily responsible for the following activities? (% respondents) CEO CRO CFO Communications Other role (eg, PR, Quantifying threats to reputation marketing) 23 39 10 16 12 Ensuring controls are systematically enforced 34 28 15 5 17 Developing strategy on reputational risk 43 26 6 17 8 Crisis management and repairing damage once done 55 18 5 12 9 Ensuring effective co-ordination between different functions 55 17 8 12 8 Eyes and ears of the company on reputational threats 47 15 2 32 4

Do you agree or disagree with the following statements? (% respondents)

Agree Disagree Neutral Corporate reputation is one of the primary assets of my firm 90 4 6 The risks involving an organisation's reputation have increased significantly over the past five years 84 7 10 Reputational risk is harder to manage than other forms of risk 62 28 10 My firm is proactive in enhancing and protecting its reputation 62 16 22 It is impossible to quantify the impact of reputational risks 27 52 21 Our programme for corporate social responsibility is reputational risk management by another name 25 34 40 My firm usually thinks about its reputation only when things go wrong 25 66 8 A well-run business doesn t need to invest extra resources into guarding against reputational risk 17 73 10

Which of the following have major responsibility for managing How would you rate each of the following as an obstacle to reputational risk within your company? managing reputational risk in your organisation? Please check as many as apply. (% respondents, major obstacle) (% respondents) Lack of established tools and techniques to manage reputational risk CEO/President/Chairman 44 84 No one has taken formal responsibility for reputational risk Board of directors 39 42 Poor co-ordination between the board, risk function, corporate communications, etc Chief risk officer (CRO)/Head of risk management 32 39 Poor communications with external stakeholders Head of business units 27 39 Too many reputational threats to manage Communications manager 22 35 Management is too internally focused/unaware of external perceptions CFO 21 33 Weak governance/internal controls Compliance officer 20 33 Chief operating officer 28 Marketing manager 24 Head of country operations 23 Brand manager 13 Media agency 11 Other 5

In which region are you personally based? What is your primary industry? (% respondents) (% respondents)

Financial services 37 North America 31 Professional services Latin America 3 14 Energy and natural resources Eastern Europe 4 10 IT and Technology Middle East & Africa 8 7

Asia-Pacific 28 Government/Public sector 5 Western Europe 26 Education 4 Manufacturing 4 Consumer goods 3 Transportation, travel and tourism What are your organisation’s global annual revenues? 3 (% respondents) Automotive 2 Construction and real estate 2 $500m or less 49 Telecoms 2 $500m to $1bn 12 Agriculture and agribusiness 1 $1bn to $5bn 19 Chemicals 1 $5bn to $10bn 5 Entertainment, media and publishing $10bn or more 16 1 Healthcare, pharmaceuticals and biotechnology 1 Logistics and distribution 1 Retailing 1

Which of the following best describes your title? What are your main functional roles? Please choose no more (% respondents) than 3 functions. (% respondents) CEO/President/Managing director 18 Risk Risk manager 62 18 Strategy and business development CRO 34 14 General management SVP/VP/Director 32 12 Finance CFO/Treasurer/Comptroller 30 9 Information and research Other manager 12 7 Marketing and sales Board member 10 6 Customer service Head of Department 10 5 IT Other C-level executive 10 5 Operations and production Head of Business Unit 9 3 Legal CIO/Technology director 4 1 R&D Other 3 2 Procurement 2 Human resources 2 Supply-chain management 1 Other 6

24 © The Economist Intelligence Unit 2005 LONDON NEW YORK HONG KONG 26 Red Lion Square 111 West 57th Street 60/F, Central Plaza London New York 18 Harbour Road WC1R 4HQ NY 10019 Wanchai United Kingdom United States Hong Kong Tel: (44.20) 7576 8181 Tel: (1.212) 554 0600 Tel: (852) 2585 3888 Fax: (44.20) 7576 8476 Fax: (1.212) 586 1181/2 Fax: (852) 2802 7638 E-mail: [email protected] E-mail: [email protected] E-mail: [email protected]