Managing Business Reputation Risk
MANAGING BUSINESS REPUTATION RISK
Darrell Smith CFE, ARM, CIM, FCSI
East Coast Fraud & Risk Management Group - www.eastcoastfraud.ca
Most organizations don’t give much thought to their business reputation until something goes wrong. One of the reasons is that a business’s reputation is difficult to identify, analyze and put a value on. It is an intangible asset that does not show up on the balance sheet, except perhaps as Goodwill when one company buys another company. Your reputation is what brings customers to you, keeps your customers coming back, and why existing customers will refer friends and family to your business. Your business reputation is one of your greatest assets and if not managed it could be a liability or it could also mean missed opportunities.
According to the Insurance Institute of America, the definition of Reputation Risk is;
“An intangible Asset that relates to an organization’s goals and values, results from behaviors and opinions of its stakeholders and grows over time. It is the comparison between stakeholder’s experiences and their expectations and is the pillar of the organization’s legitimacy or social license to operate. An organization maintains a good reputation when it meets or exceeds stakeholder expectations.
PUTTING A VALUE ON REPUTATION
The first thing you must do is recognize the value of your reputation. Intangible assets in some organizations can represent 50% or more of a company’s total value. While there are several ways of valuing reputation risk, such as the Fair Market Value approach, which would assign a value if put on the market and the Cost Approach which is the amount the organization invested to acquire their reputation. Risk Managers prefer the Income Approach which puts a current value based on discounted cash flows, the reputation would earn in a given period of time. By recognizing the value of your reputation, it allows you to think of it as an asset. If damaged it can cause a loss of key stakeholders, but there is also an upside that you can take advantage of opportunities to add value to your reputation. As an example the tainted Tylenol crisis in 1982, had Johnson & Johnson develop tamper proof pill bottles that are now used globally.
IDENTIFY KEY STAKEHOLDERS
You should identify your key stakeholders and rate them based on importance, because each stakeholder’s expectations may be different. I use a rating system with a base of 100 and assign each stakeholder points based on their importance. Stakeholders can be classified as external and internal. Internal could be management, employees, and Board Members, while external could be customers, suppliers, shareholders, and government regulators.
SOURCES OF RISK TO REPUTATION
Sources of risk to reputation can include the following;
1. Deliver on Customer Promises: Is the company (non-profit or government entity) delivering high-quality, competitively priced goods and services?
2. Regulatory and Legal Compliance: Is the company seen by its stakeholders and the public as law abiding and comply with all laws and regulations?
3. Communication and Crisis Management: Does the company have an effective communications plan to manage stakeholder expectations? Are they transparent in their business dealings?
4. Financial Performance and Long-Term Investment Value: Does the company have a steady record of financial performance and are they a good long-term investment?
5. Corporate Governance and Leadership: Does senior management and the Board of Directors lead by example and set an appropriate tone at the top.
6. Corporate Social Responsibility: Is the company considered by its stakeholders a good corporate citizen and does the company minimize the negative impact and maximize the positive impact of its activities on the environment and society as a whole?
7. Workplace Talent and Culture: Does the company recruit high quality employees and treat them well? Does the corporate culture motivate employees to take pride in their work?
IMPLEMENTING A RISK MANAGEMENT PLAN FOR REPUTATION RISK
Identify, Analyze and Prioritize Reputation Risks: Identify the key drivers of risk by reviewing past incidents and future risks. Analyze those risks based on tangible losses or gains to reputation and put a priority on each one. As an example an investment firm that has numerous compliance issues with advisors recommending high risk investments, could result in loss of clients and assets, regulatory fines, a criminal investigation or class action lawsuit.
Develop and Implement a Risk Response: To implement a risk response to a specific reputation risk, it depends on the source of the risk, whether the risk is a threat or an opportunity, the risk appetite of the organization and whether the risk can be mitigated and the total cost of mitigating the risk (ROI).
Monitor the Results: After the risks have been identified, analyzed and prioritized and risk responses have been developed and implemented. The risks should be monitored by management for any changes in the risk frequency or severity and take appropriate action. The objective is early detection and immediate treatment.
To effectively manage your reputation, recognize reputation as an asset, that like any other asset there are risks that may affect it and there are also opportunities that allow you to improve your reputation. Many companies actually seek out risk to maximize profits and gain a competitive advantage over their competitors.