It’s Time for Boards to Assess Reputational Risk Systematically

March 14, 2018

It may seem a tough season for reputations – Equifax, Adidas, Uber, Facebook – but in truth the tough season for corporate reputational risk has no end.

Reputational crises occur daily. Some are legitimate, some contrived. Some are self-inflicted, some externally generated. Some reasonably foreseeable, others sudden and unpredictable. Some have a long half-life; others are one-awful-day events. Some crises reveal a serious systemic weakness, a failure to prepare, poor judgment, or improper or illegal conduct. Others may be simple bad luck. 

They have this in common: They are amplified instantaneously. They are major, costly distractions for organizations. And they almost always inflict financial damage. 

A mishandled crisis can destroy shareholder value, sometimes more quickly than management failures, shakeups or poor financial performance. They erode shareholder, consumer, public, political, and media confidence in competence, alertness or honesty of management and the viability of the brand. They impair employee recruitment and extinguish business opportunities that quietly go elsewhere for fear of association with controversial organizations. In major non-profits, unforeseen or poorly managed crises put donor, government and foundation support at risk.

As a matter of corporate governance, it’s time for the independent audit committees of public companies and major non-profit institutions to commission annual corporate reputational audits by qualified independent assessors alongside the financial and operating audits that are conducted routinely.

The audits should examine (1) the universe of potential, knowable and reasonably foreseeable risks and the degree to which management proactively recognizes and mitigates potential reputational risks and has in place truly adequate safeguards to limit risks and manage them effectively; (2) the extent to which the organization is engaged in conduct or in lines of business or activity that are likely to give rise to reputational challenges, and (3) the potential short- and long-term costs of reputational damage, both incremental and cumulative. 

Adverse events occur in organizations of every size and type. Decisive leadership, thorough preparation and strong cultures and values often are the differentiators between organizations that successfully navigate crises or even leverage them, to enhance the reputation of the organization and those that are slow to react, unprepared, indecisive or unfit for the task. In short, in a crisis the win goes to leadership. 

The best-led organizations:

• Recognize and closely manage reputational challenges and liabilities;
• Triage reputational risk on a continuum from ordinary and insignificant to extraordinary and existential;
• Build and support internal systems that surface bad news quickly and widely;
• Establish issue and risk management protocols internally to monitor and mitigate reputational risk on an ongoing basis;
• Engage people throughout the organization in spotting risks and helping to eliminate them;
• Identify and cultivate credible relationships with stakeholders and potential sources of attack;
• Develop clear guidelines for management and decision-making during a crisis.

The boards of public and private organizations have an important oversight role to play as well to protect shareholder value and charitable missions. They can begin to discharge that responsibility by commissioning annual reputational risk assessment and audits of management conduct and preparedness. Directors should never be surprised by a reputational risk that was foreseeable and manageable. 

CEOs must manage crises, but boards must ensure the company leadership is well prepared and capable of prudent battlefield calls.

Does your organization or board assess reputational risk annually?