REPUTATION AT RIsk - ACE Group

REPUTATION AT RiskACE EUROPEAN RISK BRIEFING 2013

REPUTATION AT RISKeffective in each of these areas. There areno magic solutions. Nevertheless, at ACE, webelieve that there are effective steps that canand should be taken.In our view, companies can do more to evaluateand systematically track the perceptions of theirmain external stakeholders – whether theseare customers, the media, pressure groups orregulators – helping them to gain valuable insightinto potential trends and problems. Meanwhile,our own experience worldwide tells us that betterpreparation and more regular testing of crisisresponse plans allows for a faster responsewhen disaster does strike – a vital componentof restoring reputation in the age of socialmedia. Finally, our research does not identifyany easy solution for quantifying the financialimpact of reputational risk, but by applying a‘reputational lens’ to a range of more ‘traditionalrisks’, companies can perhaps better evaluate thereputational consequences of action or inaction.Andrew KendrickPresidentACE European GroupInsurance is not a panacea for the fast-evolvingworld of reputational risk. Nevertheless, webelieve there is much that insurers and brokerscan do collectively to help their clients. Thiscould include the evolution of new more holisticinsurance solutions that involve the input of crisisand PR specialists. More generally, it shouldinvolve professional risk engineering to improverisk management processes and governance. Lastbut certainly not least, it might be through helpingclients manage those more ‘traditional risks’ betterto reduce the likelihood of a reputational eventhappening in the first place. We hope you findthe research as interesting as we did and we lookforward to working with you to help you understandand manage this important area of reputational risk.03

executivesummary1. Reputation is a company’sgreatest asset – and it isincreasingly at risk.Four out of five executives believe that reputation is theircompany’s most valuable asset. However, they believe theyare facing a rise in the risks associated with reputation – notleast as expectations around corporate behaviour change,fuelled in part by the recent financial crisis and heightenedpublic scrutiny of business. In addition, they say the speed atwhich reputational threats emerge is increasing. Two-thirdspoint to social media as a key factor behind this.2. Reputational risk isespecially difficult to manage.Nine out of ten respondents agree that reputational riskis more difficult to manage than any other risk category.It can emerge from anywhere within the company or itssupply chain, making it difficult to predict. It is seen asdifficult to quantify and is generally less well understoodthan more traditional and more tangible risks. At thesame time, more than two-thirds of companies believeinformation and advice about how to manage reputationalrisk is hard to find, compounding the sense of uncertaintyand confusion about how best to manage it.3. Globalisation andregulation are the biggestsources of reputational risk.Our survey respondents are particularly concerned abouttwo trends that are influencing reputational risk levels.The first is their expanding global footprint and supplychain, which accounts for three of the top five concerns.The second relates to the increasingly dynamic andchallenging regulatory environment, which accounts for theother two top five worries. With compliance now seen asa core competence in many industries, failure to manageregulatory change effectively will inevitably lead to seriousreputational damage.04

REPUTATION AT RISK4. Companies must get betterat measuring and managingexternal perceptions.This report shows that only a quarter of companies areconfident about how they evaluate the strength of stakeholderrelationships that form a crucial foundation for reputationalrisk management. Just over one in five companies thinkthey are very effective at measuring external perceptions ofthe company. Measurement can be complex and requirescommitment from across the business, but it need not beimpossible. Companies can start by engaging in more frequentdialogue with stakeholders to understand their views andmonitoring the external environment more systematicallyto identify the emerging reputational threats that put theirrelationships at risk.5. Companies mayunderestimate the challengesof crisis management.Companies feel confident about their ability to handle andrecover from a crisis. Almost four in ten respondents say thattheir company is very effective at crisis management, and32% believe they are very effective at restoring reputationfollowing a risk event. However, the time that companies haveto respond to a crisis has fallen from weeks and months tohours and minutes. Today, few companies get a second chanceand our results suggest companies may underestimate thechallenge of dealing with a crisis in “faster than real time”.6. From an insuranceperspective, two-thirds ofcompanies feel inadequatelycovered for reputational risk.Many executives interviewed for this report believe thatreputational risk is difficult to insure. At the same time, somesee considerable potential for insurers and brokers to providemore help. An increasing number now offer practical crisismanagement support as part of the insurance product. Morebroadly, they have a valuable role to play in helping companiesmanage the more “traditional” risks effectively in the firstplace, so the risk of reputational damage is reduced. Theinsurance market can also help them to apply a “reputationalrisk lens” to each of these risks, enabling them to see thingsmore clearly from the external perspective that is so crucial toa company’s reputation.05

EVERYTHINGAT STAKEThe rising importance ofreputational riskCaught in the headlightsThe speed with which reputational risks canemerge to damage companies is now extraordinary.In a non-stop, globally connected business world, aproblem can arise in a distant part of the business,spread virally through social media and escalateinto a full-blown crisis in an instant. Companiesneed to be quick and agile to respond.The increased prevalence of reputational risksgoes hand in hand with a more intense publicscrutiny of company behaviour generally. The risingimportance of corporate sustainability has placedpressure on companies to demonstrate strongethics and changed expectations around how theyare meant to behave.Companies can no longer ignore the demandsof those who are not shareholders; instead, theymust balance the needs of a broad range ofstakeholders, including the public, their employeesand the communities in which they operate, if theyare to protect their reputation effectively. In thewords of Warren Buffett: “We must continue tomeasure every act against not only what is legal,but also what we would be happy to have writtenabout it on the front page of a national newspaper.”One risk manager interviewed for this report believesthat the change in attitudes towards business hasbeen enormous in the wake of the financial crisisand, as he puts it, there is a sense that everyone isscrutinising and watching each other.Reputational capitalThere is no question that reputation is criticalto the long-term health of any company. In fact,four-fifths of senior executives questioned forthis report regard their reputation as their mostsignificant asset (see chart 1).A reputational risk event can have severe financialconsequences for the affected company. Negativemedia attention, perhaps related to a productrecall or major accident, can quickly lead to lostsales, which affects liquidity. At the same time,investors and banks may take fright, withdrawingaccess to capital and placing additional strain onthe balance sheet. In the longer term, reputationalrisk can cause even greater damage as companiesseek to rebuild brands and restore stakeholderconfidence. Future earning streams are thereforedependent on a good reputation, which is also amajor source of competitive advantage.There are many examples that show how quicklyand easily corporate reputations that tookdecades to build can be undone by a disaster.Among the more well-known, experts attributeArthur Andersen’s demise in 2002 to irreparablereputational damage in the wake of bad publicityrelating to the Enron scandal. More recently, BPsustained significant damage to its reputation inthe wake of the Deepwater Horizon explosion inthe Gulf of Mexico in 2010.“ The increased prevalence ofreputational risks goes handin hand with a more intensepublic scrutiny of companybehaviour generally.”The corollary of this is that that companies withstrong reputations should benefit in terms of shareprice performance and customer trust (see thevalue of reputation overleaf). A good reputation alsohelps companies to deal with future crises becauseit creates a reserve of goodwill (often called“reputational capital” or “reputational equity”) thatcan help the business to withstand future shocks. 1Good reputational risk management, therefore,is not just about responding well to a crisis. It isabout protecting and, where possible, building thecorporate reputation every day.06

REPUTATION AT RISKChart 1: Please indicate whether you agree with the followingstatements:% who agree or strongly agreeReputational risk is more difficult to managethan any other specific risk category92Reputation is our company’s mostsignificant asset81We monitor and measure our reputation onan ongoing basisWe find it difficult to quantify the financialimpact of reputational risks on our business7777Information and advice on managingreputational risk is difficult to come byWe feel inadequately covered for ourreputational risks from an insurance perspective6668Ultimate responsibility for reputational risklies with the CEO/managing directorSocial media has greatly exacerbated the potentialfor reputational risks to affect our company5656The value of reputationA company’s reputation forms part of its intangible assets, whichinclude brand, human capital, goodwill and knowhow. As such, it hasa value as part of the company’s market capitalisation and is animportant reason why companies that, on the face of it, should beworth similar amounts can differ so widely. Some estimates say thata company’s reputation for being able to deliver growth, attract topDamage to existing customer relationshipstalent and avoid ethical mishaps can account for up to 70% of the gapbetween book value and its market capitalisations. 2Loss of earningsFall in share price/valuationReputation also has a significant impact on investor behaviour, whichNegative drives media valuations. coverage Research by Ernst & Young suggests that about35% of investment decisions are based on factors such as reputationAbility to form new customer relationshipsand image. It can take years, even decades, to develop a company’sreputation and it can disappear quickly.Litigation2933353Negative brand perception26The impact of trust factors and perceptions on corporate reputationcan be seen in the 2011 Edelman Trust Barometer. According to thisLoss of key staff/ability to recruit employees8study, more than half of a company’s stakeholders will believe positiveinformation about a trusted company after hearing it once or twice.Only one out of four stakeholders will believe negative information aboutthe company after hearing it one or two times. The results are verydifferent, however, when it comes to distrusted companies. Here, 57%of stakeholders will believe negative information after hearing negativeinformation about the company once or twice. Just 15% will believepositive information after hearing the negative information. 3Industrial equipment and manufacturingCommunications13.2%11.4%07Financial services11.4%

A POORLYUNDERSTOODRISKA lack of definitionReputational risk is not a new concept, but ithas no established definition and thinking on thesubject is still evolving. It is, for example, notablyabsent from the 2004 framework for enterpriserisk management proposed by the Committeeof Sponsoring Organisations of the TreadwayCommission (COSO). It is also overlooked in theBasel II international accord for regulating bankcapital, which was also issued in 2004. 4is effective at quantifying the financial impact ofreputational risk.Experts on reputational risk managementcertainly acknowledge that it is difficult to quantifyreputational risk. However, one measure that issometimes used is the difference between theimmediate costs of a crisis versus damage to afirm’s market capitalisation. As a rule of thumb,in the period following a crisis event, any lossesin shareholder value beyond general marketfluctuation, which cannot be accounted for byfinancial costs from the event itself, may beconsidered pure reputational losses. 5A lack of common standards or definitions ofreputational risk mean that companies perceive itin different ways. Many view reputation as a “riskof risks”. Others do not even classify it as a riskcategory, but instead see it as an impact.“Most things with a high level of risk severity thataffect large organisations can have an impact ontheir reputation,” says Julia Graham, Chief RiskOfficer of DLA Piper. “I think that a negative effecton reputation is a consequence of something goingwrong and therefore a consequence of risk ratherthan a risk itself. Businesses take years to buildtheir reputation and can damage it by single orrepeat actions in a very short space of time.”Measuring impact is a particular challengeIs it possible to quantify reputational risk, bothin terms of the severity and likelihood of the risk,but also in terms of its financial impact? Given thedegree of importance that companies now attach tothis issue, this is an interesting question. The realityis that the tools and methods required to quantifyreputational risks are still evolving.Not surprisingly given the complexities outlinedabove, risk managers in the survey admit thatthey struggle with this issue. For example, only28% of our respondents believe their company“ Reputational risk is the potentialthat negative publicity regardingan institution’s business practices,whether true or not, will cause adecline in the customer base, costlylitigation or revenue reductions.”US Federal Reserve, 1995.”08

REPUTATION AT RISKPoint of impactWhether or not companies can find robust toolsto actually quantify the impact of reputational risk,it is highly instructive to look at the areas wherereputational risk is likely to have the greatestReputational risk is more difficult to managethan any other specific risk categoryReputation is our company’s mostsignificant assetWe monitor and measure our reputation onan ongoing basisWe find it difficult to quantify the financialimpact of reputational risks on our businessInformation and advice on managingreputational risk is difficult to come byWe feel inadequately covered for ourreputational risks from an insurance perspectiveUltimate responsibility for reputational risklies with the CEO/managing directorSocial media has greatly exacerbated the potentialfor reputational risks to affect our companyimpact. For companies in our survey, there aretwo core areas of concern. The issue executivesfear most is the potential impact on customerrelationships. Over half worry about the damagereputational risk would have on their carefullycultivated existing relationships, while a third areworried about the effect it would have on theirability to form new customer relationships.Chris McGloin, Vice President of Risk Managementand Insurance at Invensys, agrees that customerrelationships are a fundamental consideration. “Nomatter where you sit in the supply chain, if you area global brand, then the face of your brand to thecustomer is of paramount importance,” he says.“Even if you are just a supplier to a customer witha global brand, then that customer is relying uponyou. If you fail to deliver, you can expect that todamage the relationship seriously.”Mr Nornes, Executive Vice President at Aon, notesthat in business to consumer sectors, it can takea very long time to restore a damaged reputationand, in some cases, it may never be possible. “Ifyou’ve lost that connection with the customer in92the consumer space, it’s really hard to rebuild thatreputation,” he says. 8177The other core area of concern is doubtless closelylinked, but can be separately categorised as77financial damage. Fully 43% of companies worryabout the loss 68 of earnings from reputational riskand 39% about the impact on the share price (see66chart 2). Such losses could arise for any numberof reasons, ranging from the loss of customer56business as mentioned above, to governmentsand regulators 56 taking a less sympathetic view ofa firm’s activities in important markets. In each ofthese areas, reputational damage can have a veryreal impact on a company’s future performanceand competitive position.Chart 2: Which of the following potential impacts of reputational risk would cause you greatestconcern as a business?% respondentsDamage to existing customer relationships57Loss of earnings43Fall in share price/valuation39Negative media coverage35Ability to form new customer relationships33Litigation29Negative brand perception26Loss of key staff/ability to recruit employees809

Between US$500m (€385m)and US$1bn (€775m) 33%Ability to form new customeLitigationNegative brand perceptionLoss of key staff/ability to reUK15.4%Benelux (1)15.2%Quantification of reputational riskremains elusiveSwitzerland15.4% Although most senior executives recognise thatreputational risk poses a serious potential threatto their company, quantifying the impact remainsan inexact science. More than three-quarters ofthe respondents agree that they find it difficult toSouthern Europe (3)15.4% quantify the financial impact of reputational riskon their business. Interestingly, our research alsosuggests that the ability to quantify this impactvaries with size. In particular, once a companygrows and becomes more complex, this becomesan even more difficult task.The cost of reputational damage:% who feel very effective at quantifying the financial impact ofreputational risk35%30%25%20%15%10%5%0%Reputational risk events clearly have an impactthat is quantifiable, in part at least. If a company,say, commits fraud and this is brought to light, itsmarket value is almost certain to fall as investorsstart to question the quality of management andthe risk of further revelations. There may also befines to pay, which will also have a direct financialimpact on the value of the company.Yet this immediate loss is just one aspect of80the broader financial impact caused by thedamage 70 to reputation. Potential customers 68% maybe discouraged from doing business with the60company. Investors may be deterred from buying49%the 50 company’s shares in the future. Regulators may10403029%37%40%32%Small companies (US$250m – US$500m)Mid-sized companies (US$500m – US$1bn)Large companies (over US$1bn)24%France15.4%Germany15.4%MENA (2)7.8%impose a heavier compliance burden, and suppliersmay be more reluctant to extend favourable creditterms or even do business with the company.Moreover, individual risk events that causereputational damage can vary widely, and thereis a limited amount of publicly available data onwhich to base measurement. The reputationaldamage also needs to be placed in context – doesit come after a run of events that have affectedthe reputation of the firm; how well did thecompany respond to the crisis; and how quicklywas it able to reassure stakeholders that theunderlying problems have been addressed? All ofthese factors will affect the extent of the loss.These subtleties mean that quantification ofreputational risk will inevitably rely on a numberof assumptions, and that could generate a falsesense of precision, leading companies to rely onestimations that may ultimately turn out to bewide of the mark.Despite the difficulties of quantifying the impactof reputational risk, some companies, particularlythose in consumer-facing sectors such as retailbanking or fast-moving consumer goods, aredeveloping ways of tracking and measuringreputation itself.Media clippings services, which collect mentionsof companies in the press, radio and otherchannels, have long been available. Today, however,the approach is much more sophisticated.Data analytics tools can track mentions of thecompany across traditional and social media, anduse algorithms to identify and track positive andnegative perceptions of the company. This evenallows companies to measure the effect of anew announcement, such as the launch of a newproduct, or compare reputation in two differentmarkets. By understanding more about how theyare perceived, companies are in a better positionto target resources towards activities that willimprove reputation and scale back thosewhere damage could potentially be caused.Industrial equipment and mCommunicationsFinancial servicesEngineering and constructioTravel and transportationLife sciencesMedia and entertainmentOil and gasProfessional servicesRetailAutomotiveUtilitiesReal estateBuilding materialsHealthcareConcerns about poor emploaround the worldHeightened focus on fraud ain foreign market subsidiarieDifficulty keeping pace withDifficulty managing productpractices across extended sCorporate governance failurfinancial or reporting irregulaAggressive tax avoidance/tabusiness environmentIncreasing stakeholder and mof business practicesConcerns about failure to proHigh-profile product recall inIncreasing corporate social r

The second major source of reputational risk relatesto the heightened focus on fraud and corruptionin foreign subsidiaries. There is no country in theworld that Transparency International considers“very clean” with a perfect score of 100 on itsCorruption Perceptions Index. But as companiescome to rely more and more on emerging marketsfor both demand and supply, they inevitably findthemselves operating in countries where fraudand corruption are more significant problems thanthey may be used to in their home markets. Thecleanest ranked emerging market on the CorruptionPerceptions Index is Chile, in 20th place, but amongthe countries below 100th place, all are classified asemerging markets. 6of reputational risk. This is a particular concernfor manufacturing and production companies inthe survey, where only 30% feel very effectiveat managing supply chain issues leading toreputational risk.Higher concern about this issue in manufacturingand production companies is understandable giventheir increased reliance on external productionpartners and suppliers when bringing their productsto market. “Efficiency has been the watchwordfor supply chain management in recent years,”says Mr Nornes. “But managers need to think abouthow these cost savings might increase risk-takingin the system.”“ Compliance has taken on anew importance for manycompanies and they aremore aware of the link totheir reputation.”The new regulatory paradigmDealing with fraud and corruption risks has nowbecome a major board-level challenge for manymultinationals. Investors, regulators and otherstakeholders are increasingly seeking evidencefrom companies that they are managing theserisks appropriately. In some jurisdictions, suchas the UK, company directors can also be heldpersonally responsible if they are found to havecollaborated or consented to bribery by companyexecutives in overseas markets.Managing these challenges across highly complexglobal supply chains has become a major sourceDealing with regulation is part and parcel of doingbusiness. But as companies continue to globalise,and as governments seek to impose strictercontrols on corporate behaviour in the wake ofthe financial crisis, the perception among manycompanies is that the regulatory environmenthas become more difficult than ever to manage.Compliance has taken on a new importance formany companies and they are more aware of thelink to their reputation.From a reputational risk perspective, compliancefailures send out a message that companies maybe failing to manage the broader risks to thecompany. “For most companies, the regulationsthat they need to observe should be consideredcore to the industry in which they operate,” saysAlex Wittenberg, a Partner at Oliver Wyman andhead of consulting firm’s Global Rick Center. “Ifyou fail to meet regulatory requirements, then it’sgoing to have a disproportionate impact on thereputation of the firm if you breach or mismanagea core risk.”12

REPUTATION AT RISKJohn Harris, Group Head of Insurance and RiskManagement at the Wood Group, echoes thisperspective. “Regulatory problems leave you opento allegations of wrongdoing and, in the currentenvironment, the media and the public think theworst,” he says. “If a company hasn’t complied,then the public and the media assume it’sbecause they’re avoiding compliance. They can’tsay ‘we just didn’t understand’ because theyare supposed to understand regulation, howevercomplex it is.”Nevertheless, with more products reachingmore customers, the total number of recallsglobally remains high. This implies that companiesneed more robust and well-developed crisismanagement plans specifically designed toenable a quick and effective response to aproduct recall issue.Recall riskProduct recall is also seen as an important sourceof reputation risk by one out of five respondents.This is understandable, given how commonplaceproduct recalls are, as well as the considerabledamage they can cause to corporate reputations.The damage is increased because, in many cases,the product recalls are driven by health and safetyconcerns that affect the general public.To take just one industry affected by productrecalls, automotive manufacturers regularly have toput in crisis management procedures to mitigatethe reputational damage caused by productrecalls. Toyota received widespread negativeattention when it had to recall 8 million cars dueto a sticky accelerator back in 2009 and 2010. 7Although this was one of the more sizeable eventsto hit a single company, product recalls still occurquite frequently in the industry.“ Product recall is also seenas an important source ofreputation risk by one outof five respondents.”Recent examples in 2013 include Toyota, Nissan,Honda and Mazda, recalling 3.4 million vehiclesbecause of a problem with their airbags. 8Research suggests that improvements in qualityassurance processes, the introduction of advancedtechnologies and increased government regulationswill lead to a substantial reduction in crises relatedto product quality. 913

25%20%15%10%5%24%AutomotiveUtilitiesReal estateBuilding materialsHealthcare0%Reputation by region: A north-south divideMid-sized companies (US$500m – US$1bn)on reputational risk?The survey reveals some striking differencesbetween respondents from the UK, France,Germany (grouped for the purposes of thisanalysis as northern Europe) and Beneluxcountries, compared with those from southernEurope (Italy and Spain) and MENA and Turkey.Culture and the value of reputation% respondents who strongly agree that reputation is their company’smost significant asset80706050403020100Respondents from all countries think reputation isan important asset. But this is particularly markedin the MENA countries, where 68% of executivesstrongly agree with this notion. Almost half ofexecutives from southern Europe also stronglyagree, versus a significantly smaller proportion(40%) of executives from northern Europe.This difference most likely comes down tocultural perceptions. Southern Europeancountries 60 are also especially sensitive to the riskof damage to customer relationships caused 52 byreputational 50 issues.On 40 potential sources of reputational risk facing36their companies, the southern European andMENA 30 executives in the survey are particularlyconcerned about keeping up with the pace ofregulatory 20 change (43% cite it as a top concern).One issue in faster-growing markets such as Turkeyor 10 MENA is the speed of implementation of newlegislation. Emerging market regimes, generally,014Small companies (US$250m – US$500m)Large companies (over US$1bn)37%BeneluxNorthern Europe40%4449%Southern EuropeMENASmall companies (US$250m – US$500m)Mid-sized companies (US$500m – US$1bn)Large companies (over US$1bn)68%may implement change rapidly or unexpectedly,which can make it harder for businesses toanticipate developments and to remain compliant.By contrast, northern European companies mayhave had greater past experience of multinationalbusiness and of managing multiple complianceprogrammes, and these issues may be a morefamiliar challenge.For northern European respondents, pooremployment conditions around the world areviewed as a key source of reputational risk. Thisis particularly notable for Benelux executives,51% of whom worry about this issue. This mayreflect these countries’ greater integration intoglobal markets, in terms of their supply chains andtrading links.When it comes to managing reputational risk, thenorthern European executives acknowledge it is adifficult area, but they tend to be more confidentin their capabilities. For example, half of them(49%) say their companies are very effective atidentifying threats to reputation, whereas only34% of southern European and 44% of MENAexecutives feel the same degree of confidence.Similarly, 36% of northern European executives saythey are very effective at managing reputationalrisk across the supply chain, but only 26% ofsouthern European executives feel the same.Interestingly, although they place great valueon reputation, only 32% of southern Europeancountries strongly agree that they monitor theirreputations on an ongoing basis. This compareswith 40% in northern Europe and as many as 47%in Benelux who do so.Overall, it is the northern European countries thatseem to have been more active in developingstrategies to manage reputational risk. It is clear,however, that companies from all regions have along way to go in tackling this issue.Concerns about poor employmaround the worldHeightened focus on fraud anin foreign market subsidiariesDifficulty keeping pace with reDifficulty managing product qpractices across extended supCorporate governance failuresfinancial or reporting irregularAggressive tax avoidance/taxbusiness environmentIncreasing stakeholder and meof business practicesConcerns about failure to protHigh-profile product recall incIncreasing corporate social reexpectationsConcerns about discriminatioIncreased attention on executiInstilling a culture of reputatiothroughout the companyIdentifying threats to reputatiCrisis managementPutting in place governance smanage reputational risksEnsuring that reputational risacross the entire supply chainRestoring reputation followingQuantifying the financial impaMeasuring external perception

0%Small companies (US$250m – US$500m)Mid-sized companies (US$500m – US$1bn)REPUTATION AT RISKLarge companies (over US$1bn)MANAGINGREPUTATIONAL68%RISKs807060Three complicating factors5040 Risk professionals 37% are nearly unanimous thatthey face particular challenges in managing30reputational risk. Among our respondents, 92%20 either agree or strongly agree that reputational riskis more difficult to manage than any other specific10risk category (see chart 1).040%49%Large companies Benelux with their Southern high-profile Europe brandsfeel particularly Northern Europe vulnerable MENA in this regard: 52% ofexecutives from companies with over US$1bn inannual revenues agree strongly that reputationalrisk is the most difficult risk to manage, versusonly 36% who felt as strongly on this issue fromsmall companies (under US$500m).The larger the brand, the bigger the problem:% that strongly agree that reputation is the most difficult category ofrisk to manage60504030364452There are various reasons why reputational riskis so difficult to manage and our research pointsto key factors:• First, reputational risk can come from a widerange of different sources – both within thecompany and across the broader supply chain,making it harder to track.• Second, as noted above, companies alsofind it difficult to define, or even categorise,reputational risk, and there remainsdebate among risk managers about whetherit is a distinct risk category or merely aneffect of other risks, and therefore how bestto manage it.• Third, advice about how to manage reputationalrisk is scarce – almost 70% agree thatinformation and advice on managing reputationrisk is difficult to find (see chart 1).• Fourth, reputational risk is also difficult tomeasure. More than three-quarters of therespondents agree that they find it difficult toquantify the financial impact of reputational riskon their business.The Chief Executive of UK risk managementassociation AIRMIC summarises this well.“Organisations are good at being very preciseabout the value of their brands,” says Mr Hurrell.“Reputation is much more difficult because it goesbeyond brand, and there is no balance sheet itemthat looks at reputation.”Concerns aaround theHeightenedin foreign mDifficulty kDifficulty mpractices aCorporatefinancial orAggressivebusiness eIncreasingof businessConcerns aHigh-profilIncreasingexpectationConcerns aIncreased aInstilling athroughouIdentifyingCrisis man20100Small companies (US$250m – US$500m)Mid-sized companies (US$500m – US$1bn)Large companies (over US$1bn)Putting inmanage reEnsuring thacross theRestoring rQuantifyingMeasuring15

Healthcare0.2%Three steps to more effective reputationalrisk managementConcerns about poor employment conditionsaround Measure the world external perceptionsHeightened Reputational focus on risk fraud differs and corruption from other risk categoriesin foreign market subsidiariesin that it is defined by external perceptions.Difficulty keeping pace with regulatory changesA company can take steps to enhance its ownDifficulty managing product quality and/or workingreputation but it does not control it. Reputationpractices across extended supply chainsCorporate consists governance of a combination failures leading of to perceptions held byfinancialexternalor reportingstakeholders,irregularitiesincluding the public andAggressive tax avoidance/tax evasion in thebusiness communities environment at large, its customers, suppliers,Increasing politicians stakeholder and policymakers. and media scrutiny This reputation doesof business practicesnot always reflect reality. According to a 2007Concernsarticleaboutin thefailureHarvardto protectBusinesscustomer privacyReview, manyHigh-profile companies product suffer recall from incidents a “reputation-reality gap”.This can go either way of course – a companyIncreasing corporate social responsibilityexpectations may have a reputation that is either better orConcerns worse than about discrimination the underlying the workplace reality. 4Increased attention on executive compensationIt is therefore essential for companies tounderstand how external stakeholders perceivethem. There are now many best-practiceexamples of putting resources into enhancing thisknowledge. Among our respondents, nearly half saythey monitor and measure their reputation on anongoing basis. But this is an activity where manyadmit they struggle – just 25% of companies saythat they are very effective at measuring externalperceptions of their company (see chart 4).Monitoring external perceptions of the companycan be a complex and costly business. To do itproperly, companies need to invest in the staff,41resources and technology that are required. They36need to reach into the full range of channels wheretheir company may be being 25 discussed – in bothtraditional and social media – and they must25also take a global approach, tracking externalperceptions in different 22 markets, because thesecan vary widely. “Global reputation is very difficult21to assess and control,” says Mr Dennery of FERMA.21But there are some relatively simple steps that21any company can take to measure things moresystematically. This 20 might include directly testingthe perceptions of the general public as well as16important stakeholders (for example customers,employees, investors) 15 through surveys, forums andfocus groups. The PR industry provides services to14track positive and negative media coverage. Morerecently, the advent of powerful software to collectand analyse data on social media channels relatingto brand perceptions has created extremely powerfultools that companies can use to understand howtheir brand is perceived at any given time.It is clear that most companies are still developingthese tools, but some industries in the surveyseem to be more active on this issue. For example,almost half of services companies (46%) stronglyChart 4: How effective is your company at managing the following aspects of reputational risk?% who say they are very effectiveInstilling a culture of reputational risk managementthroughout the companyIdentifying threats to reputation46.8%51.1%Crisis managementPutting in place governance structures tomanage reputational risksEnsuring that reputational risks are managedacross the entire supply chainRestoring reputation following a risk eventQuantifying the financial impact of reputational riskMeasuring external perceptions of the company39.2%39.2%35.4%32.0%28.2%25.2%16

Among our respondents, 39% say that they arevery effective at crisis management and 32% thinkthey are very effective at restoring reputation aftera risk event (see chart 4). Most companies have inplace some process to deal with a crisis, but thechallenge today is that the time in which this needsto be implemented has dramatically shortened. “Inthe past, an incident would occur and you wouldhave the luxury of planning a careful message andresponse over a period of weeks or even months,”says Mr Nornes. “Now, if you had a day or two,that’s probably a lot more time than usual.”Companies today therefore need to considervelocity as an important parameter. Technology,and social media in particular, have changed thespeed and power with which reputational damagecan strike. Among our respondents, two-thirdsagree that social media has greatly exacerbatedthe potential for reputation risks to affect acompany (see chart 1).These findings are aligned with other global research.In a recent IBM study on reputational risk, nearlytwo-thirds of study respondents said their companywill focus more on managing its reputation in thefuture, and out of this group of respondents, 43%said the change in focus is driven by the growth oftechnology and social media. 10According to Mr Baud, an effective crisis managementplan will be short and practical, and will identifywho does what, when and where. “A good crisismanagement plan should list the crisis managementteam, as well as internal and external contact details,like direct dials to local emergency services orpublic health protection contacts,” he says. “Mostimportantly, all key people should have full workingknowledge of the plan.” In summary, a good crisismanagement plan will enable the organisation tospring into rapid action when trouble hits.As ever, communication is key and needs to beappropriate and targeted to the needs of differentstakeholders. “Companies need to craft consistentdifferent messages and responses to their variousstakeholders, including customers, employees,shareholders and government regulatory agencies,”says Mr Nornes.Role of the insurance industryAmong the respondents to our survey, 66% saythat they feel inadequately covered for theirreputational risks from an insurance perspective.Undoubtedly, through its underwriting and riskengineering expertise, the insurance industrycan and should play a role in helping a companyunderstand its core risks, first by adequatelyassessing their impact and cost. It can then helpit to apply a reputational risk “lens” to determinewhich risks, if any, could cause long-term damageto the company’s reputation.The potential severity of reputational risk has alsoincreased calls from companies for new insuranceproducts that help to mitigate the potentialexposure. Companies want assurance that, shouldthe worst happen, they have the advice, back-upand financial support to get through the crisis andstart rebuilding their reputation.“Many companies don’t realise that they have acrisis on their hands until it’s too late, and the abilityto influence a situation diminishes exponentiallyover time,” says Mr Baud. “Extensive planning in themonths beforehand and then working hand in handwith the PR team as the issue escalates is the bestway to protect the business.”In recent years, a number of insurers have launchedcertain products that provide cover for reputationalrisk as part of a broader proposition. Manyreputational risk insurance products have grown outof existing cover, related to events such as productrecall. They typically provide cover for financial lossassociated with named risk events that damagereputation, leading to reduced sales and profitability.18

REPUTATION AT RISKProducts may also cover the costs of dealing withthe event, which may include the use of external PRand crisis management teams, and the operationalcosts of addressing the risk event, such as physicallyremoving products from the shelves. Some alsoinclude an advisory component, providing access tospecialist expertise to help companies prepare forand recover from a risk event.“From an insurance standpoint, it’s important thatcompanies can respond quickly,” says Mr Nornes.“What you don’t want is to have an incident occurand then have the company worried about theexpense of dealing with it. You want everyone tofocus on doing the right thing almost instantly, andthat’s where well-designed insurance can providean immediate benefit.”“ The emphasis is on helpingcompanies to respond in away that helps mitigate thedamage early and ideallypreventing reputational riskevents from happening in thefirst place.”Connie Germano, Regional Middle Market CasualtyManager for ACE in Continental Europe, points totwo areas where reputational risk managementplays an integral role in the company’s propositionfor mid-market companies in Continental Europe.The first is product recall, where the insurerprovides 24/7 access, with local languagecapability, to crisis management and PR experts inthe event of contamination or malicious tamperingfor food and drink companies. These services areparticularly valuable for mid-market companies,she believes, that don’t always benefit from thesame infrastructure and consultancy supportnetwork that larger companies have.parties to distribute their product in the US, forexample, face added potential litigation risk,something which ACE automatically covers.Second, reputational risk may be elevated if thecompany is not properly prepared to respond toproduct deficiencies (whether real or perceived)identified in a local market. According to MsGermano, the exporter needs to be certain thatit can respond quickly to an incident – especiallywhen venturing into a new market for the firsttime. ACE’s new proposition therefore providesimmediate crisis support and expenses coverfor companies purchasing a primary casualtyprogramme from the insurer. In the event thatthere is an export incident that is likely to involvethe casualty programme, the policy will providecatastrophe management support from externalexperts up to a certain limit as well as accessto PR expertise.Beyond the immediate crisis response, insurancebecomes more complex. Quantification oflong-term reputational risk damage remainschallenging, which makes it difficult to setparameters around insurance coverage.Reputational risk events can come from anywherein the business, which means that moving beyonda set of named triggers becomes very difficult.It is also hard to demonstrate direct causationbetween a reputational risk event and long-termdamage to financial performance.Ms Germano expects to see further developmentsin reputational risk insurance, but believes that themain emphasis should be on helping companiesto prepare for and prevent reputational riskevents. “The insurance community has becomemore comfortable with reputational risk andthere will continue to be experimentation anddevelopment but, for now, the emphasis is onhelping companies to respond in a way thathelps mitigate the damage early and ideallypreventing reputational risk events fromhappening in the first place.”The other area is export liability, where thecompany is developing a new solution for midmarketfirms exporting products overseas,an area where there is significant potentialreputational risk. First, companies using third19

REPUTATIONALGOVERNANCEMind the gapEffective reputational risk management dependson strong governance. Because risks to reputationcan emerge from any corner of the business,companies need robust processes and reportinglines to ensure that key decision-makers areinformed as early as possible about emergingproblems. Among our respondents, fewer thanhalf (39%) think that they are very effective atputting in place governance structures to managereputational risk (see chart 4).Good governance starts with the board andmanagement team. Faced with a more severe riskenvironment, boards are becoming much moreactive in demanding assurance that reputationaloutcomes of risks and events are identified andmeasured. “Boards are requesting a lot moreinformation because they don’t necessarily have theintrinsic knowledge of the business to defend theirdecisions in the same way management would,”observes Mr Wittenberg.The CEO plays a critical role in reputational riskmanagement. Among our respondents, 57% agreethat ultimate responsibility for reputation risk lieswith the CEO or managing director (see chart 1). AsMichel Dennery puts it: “The CEO is the very firstrisk manager of the company.”But companies must ensure that there is absoluteclarity over where exactly the CEO’s responsibilitieslie. A common problem arises when a gap startsto open up between strategy and operations.“Boards and the CEO understand strategic risk andthe consequences of failing to execute effectivelyon strategy, but they may not be close enough tooperations to truly understand the reputationalconsequences of an operational failure,” saysMr Hurrell. “Often, there is a distinct separationbetween the board, which owns strategy, and thebusiness, which owns operations.”This highlights the importance for the CEO to playa co-ordination role in managing reputational risk.He or she should set the tone, lead by example andensure that everyone in the corporate hierarchyunderstands their role in managing reputationalrisk. The CEO may be ultimately responsible forreputational risk, but cannot manage it alone.Effective reputational risk management comes fromcomplete alignment across the entire business andfrom ensuring that every activity is carried out froma risk-aware standpoint.Role of the risk functionThe risk function plays an important part in thegovernance of reputational risk. A key part of itsrole is to serve as the conduit for risk information– collecting it from across the business, analysingit, and ensuring that it is passed onto the boardand management team in the right format andat the right time. “The board wants to knowthat the risk function is helping and supportingthe business in the way risks are reviewed andaddressed,” says Mr McGloin. “It’s about facilitatingcommunication and sharing new information sothe board can take the right decisions.”As the most senior executive in the risk function,the Chief Risk Officer (CRO) must be the “eyes andears of the CEO on reputation risks”, according to MrDennery. The CRO or senior risk officer can help theircompanies understand and define their risk appetite,and then put in place a strategy and efficientprocesses that reflect these attitudes to risk.Although many risk officers perform a veryvaluable role in managing reputational risks,they may be hampered by their position in thehierarchy. “heads of risk, even CROs, report to thefinance director or somebody below the financedirector and, from that position, they are unableto report on problems that come from abovethem, such as those related to culture, ethicsand leadership, which is where the root causes ofmany, if not most, reputational risks can be found,”says Mr Fitzsimmons of Reputability.All about cultureThe culture of an organisation sets the tone forthe way in which reputational risk is managed.20

REPUTATION AT RISKCompanies that develop and embed a strong riskculture, so that every employee understands theimportance of reputation and how easily it can becompromised, will be well placed to identify earlywarning signs and ensure that employees acrossthe workforce act in a way that will support, ratherthan damage, reputation.More than half of the respondents say that theircompany is very effective at instilling a culture ofreputational risk management throughout theircompany (see chart 4). “Leading companies arefocusing on trying to develop a culture of riskmindfulness across the company and embedding itamong the rank-and-file staff,” says Mr Wittenberg.and contractors. There needs to be a commonunderstanding of the risks confronting theorganisation’s reputation so that employees can actas successful “reputational ambassadors.” 3A commitment to quality helps to minimise therisks that can lead to reputational damage. AtAgfa-Gevaert, a company that produces analogueand digital imaging systems, a culture based aroundkeeping standards high and minimising faults,reduces overall exposure to reputational risk andbuilds a culture of excellence across the business.“Every individual in the company is using these skillsto deliver the best possible product,” says JohanWillaert, Corporate Risk Manager at the company.There are various pieces that, together, start tomake up a strong risk culture. First and foremost,a company needs a management team that iscommitted to driving a culture of risk managementthroughout the company. They should set the tonethrough their actions and behaviour, and use thisto embed certain processes and behaviours intothe business that help to support a risk culture.“ More than half of therespondents say that theircompany is very effectiveat instilling a culture ofreputational risk managementthroughout their company.”At HSBC, for example, employees are expectedto live up to certain behaviours and values, andthey will be measured on this in their performancereviews. “Everyone at HSBC is so conscious aboutreputational risk,” says Jeremy Sharpe, GlobalHead of Insurable Risk Management at HSBCGroup. “If you don’t meet the behaviours andvalues of the group, you won’t get a good review.It’s very clearly articulated in the company.”This approach should also extend beyond thecompany into the broader supply chain. In the end,every individual working in or with a company sharesresponsibility for protecting and strengthening itsreputation, from the executive team to suppliers21

CONCLUSIONSCompanies need to put in place a clear framework formeasuring and managing reputational risk.Definitions of reputational risk vary widely, and different companies take a variety of approaches toidentifying, assessing and mitigating the reputational risks they face. This is fine, as long as the companyhas a clear and appropriate framework and approach in place that is well understood across the business.More broadly, taking a multi-disciplinary approach that involves the CEO, PR specialists and other businessfunctions will help to build the broader perspective that is necessary for identifying and managing lessobvious reputational risks.Companies should work harder at measuring how theirreputation is perceived, investing more resources inmeasuring external perceptions to identify trends andpotential problems.Although a company can directly influence its reputation through its actions and behaviour, it doesnot control it. Reputation exists independently of the firm and is determined by the perceptions of awide range of external stakeholders, including customers, the media, pressure groups and regulators.Understanding the interplay between these different stakeholders, and their impact on corporatereputation, is essential. Companies must ensure that they are collecting an “outside-in” perspective onreputational risks to complement their own internal perspective.Companies should sharpen up their crisis managementplans to keep pace with today’s faster-moving world.With the increased velocity of media communications and enhanced business interconnectedness, acompany’s reputation can be made or broken within moments. Speed of response is of the essence,because the ability to influence a crisis situation diminishes dramatically over time. Our research suggeststhat many companies may be over-confident in their abilities to respond to a crisis, and regular reviewand testing – including the incorporation of social media scenarios – will allow a faster response whendisaster strikes.Management teams and boards also need to put in placea culture and processes to minimise the potential for crisesto emerge in the first place.Leadership and tone from the top are critical. Companies that strive for quality, behave ethically and curbunnecessary risk-taking are inherently less prone to reputational risks. Achieving full clarity throughoutthe organisation on corporate culture and values is key to this. Equally, instilling a culture on risk andunderstanding of risk appetite is vital: not every risk can or should be avoided, but companies must beaware of their implications.The insurance market can do more to help companiesmanage reputational risk.The launch of new products that include crisis response assistance in different scenarios is one exampleof how the insurance market can help. More generally, taking a more holistic approach to reputational riskis a trend likely to grow. Where insurers and brokers can arguably help most is in assisting companies totake a “reputational lens” to the traditional risks and evaluating the reputational consequences of actionor inaction in each case.22

Ten steps to managing reputational risk1 Put the CEO in charge of reputational risk.The Chief Executive, together with the board, needs to instil and drive the riskculture within the organisation and demonstrate the right behaviour by example.2 Incentivise employees to guard your reputation.Leading companies are already making an awareness of reputational riskpart of their performance management and employees can make a valuablecontribution as “eyes and ears” of the business.3 Develop an “outside-in” perspective on risk.Apply a “reputational lens” to your key traditional risk categories to helpunderstand how damage to reputation might result if they are not properlymanaged and take steps to close any gaps.4 Value your reputational capital.Although methods of placing a financial value against reputation are still in theirinfancy, getting experts to review the impact of various reputational issues andcommunicating this widely across the company can certainly help drive themessage home.5 Monitor reputation across your markets.Actively listen to your main groups of stakeholders on the issues that affectyour reputation, and learn how to use new tools such as social media to monitorexternal perceptions more systematically.6 Create transparency and accountability.Encourage a sense of ownership for the brand among your employees, andensure that information is not “sanitised” or kept from senior management.7 Communicate your values, then live by them.Reputations are managed through positive actions, not just through defensivemeasures. Make sure there is clear, common understanding about thecompany’s values throughout all levels of the organisation and measure personalperformance against them.8 Plan for the next crisis.The cause of a reputational event may be hard to predict, but identifying theright team and processes to address these issues will help your company handlea crisis faster and more effectively.9 Develop a multi-disciplinary approach to reputational management.The CRO has expertise in risk management, but must work with PR expertsand other stakeholder-facing business functions to protect and enhancesomething as broad as the company’s reputation.10 Learn from others’ mistakes.Many of the major corporate reputational disasters of recent years provide textbook examples and there are many lessons and best practices that can beadopted from their analysis.23

Chief financialofficer 24.9%Chief riskofficer 24.5%REPUTATION AT RISKOther risk executive 0.5%Damage to existing customer relationshipsLoss of earningsRespondents by job title (%)Fall in share price/valuationMore than US$1bn(€775m) 34%Respondents by size of annual turnover (%)395743 Between US$250m(€190m) & US$500m(€385m) 33%Negative Chief operating media coverageofficer 24.9%Ability to form new customer relationshipsRisk and/or insurancemanager 25.2%More than US$1bn(€775m) 34%3335Between US$250m(€190m) & US$500m(€385m) 33%Reputatithan anyReputatisignificanLitigation29We monan ongoiNegative brand perception26We findimpact oLoss of key staff/ability to recruit employees8InformatreputatioChief financialofficer 24.9%Chief riskofficer 24.5%Other risk executive 0.5%Between US$500m (€385m)and US$1bn (€775m) 33%Between US$500m (€385m)and US$1bn (€775m) 33%We feel ireputatioUltimatelies withSocial mfor reputRespondents by company sector (%) Respondents by Country (%)Industrial equipment and manufacturingCommunications13.2%11.4%UK15.4%Benelux (1)15.2%Financial servicesMore than US$1bnEngineering(€775m) 34%and construction11.4%Between US$250m(€190m) & US$500m7.7%(€385m) 33%UK15.4%Switzerland15.4%Benelux (1)15.2%France15.4%Travel and transportation6.3%Life sciencesMedia and entertainmentOil and gasProfessional servicesRetailAutomotiveUtilitiesReal estateBuilding materials6.2%6.2%6.2%6.3%6.2%Between US$500m (€385m)and US$1bn (€775m) 6.2% 33%6.2%6.2%0.5%Switzerland15.4%Southern Europe (3)15.4%Southern Europe (3)15.4%(1) Benelux: Belgium, Luxembourg, Netherlands(2) MENA: United Arab Emirates, Egypt, Bahrain, Saudi Arabia,Pakistan, Turkey(3) Southern Europe: Italy, Spain35%30%29%32%France15.4%Germany15.4%MENA (2)7.8%Germany15.4%MENA (2)7.8%DamageLoss of eFall in shNegativeAbility toLitigationNegativeLoss of kHealthcare0.2%35%25%32%24%UK15.4%Benelux (1)15.2%30%20%29%25%15%24%Switzerland15.4%France15.4%20%10%15%5%10%0%25IndustriaCommun5%Small companies (US$250m – US$500m)

Endnotes1. Louisot & Rayner, Managing Risks to reputation – From theory to practice2. Business Week, What Price Reputation? July 20073. Deloitte, A risk intelligent view of reputation, 20114. Harvard Business Review, Reputation and its Risks, February 20075. IBM Risk Analytics, Reputational risk: crisis and cleanup in the risk society, December 20106. Transparency International, Corruption Perceptions Index, 20127. CNN Money, Toyota recalls total 8.1 million vehicles, February 20108. Reuters, Japan carmakers recall 3.4 million vehicles for Takata airbag flaw, April 20119. CIRANO, Corporate Reputation: Is Your Most Strategic Asset at Risk? April 201210. IBM, Reputational risk and IT: How security and business continuity can shape the reputation and value of your company, 201226