The lack of a structured discipline to manage reputational risk is now affecting some companies' ability to conduct business, which is why many are moving quickly to establish governance groups that demonstrate their commitment to business ethics.
Reputational risk often results from operational, credit, or market-related events - such as participation in a major syndicated credit loss or extreme levels of exposure to certain countries. But being in a troubled industry or having business partners (including outsourcers) with bad reputations can also pose a risk. Damage can result from perception, not just reality, and once the perception has been impaired it is difficult to fix.
Reputational damage can be easy to spot. Lack of operational controls at Allfirst Financial Inc. led not only to a writeoff of hundreds of millions of dollars, but also to its sale at a depressed price by its parent organization to eliminate the negative association. The market impact of South American businesses damaged the image of FleetBoston Financial Corp. as a major international player. And consolidation execution by First Union Corp. led to the loss of retail clients and was a major factor in its decision to abandon the name following its acquisition of Wachovia Corp.
Unfortunately, risk was not mitigated in advance of these events.
If reputational risk is not properly managed, the consequences can include:
- Reduced revenue, increased expenses (including lawsuits and settlements), and liquidity issues.
- Lower securities prices, reduced agency ratings, and unavailability of investor funding.
- Deterioration in partnerships and relationships with suppliers and customers.
- Inability to attract and retain high-quality employees.
The strongest defense against reputational damage is a corporate culture that emphasizes ethics, disclosure, and communication. Such a culture is not easily established or changed. There is a series of actions that can be quickly implemented to drive the cultural change, but they must be pursued with dedication for extended periods to become ingrained in the company.Designating a senior executive to be responsible for reputational risk, or adding reputational risk to a committee's responsibilities, will make a public statement about the importance a company puts on dealing with this issue. However, these actions are only the first steps in mitigating exposure before it occurs.
Companies can benefit from a "culture test" review, in which their practices are compared to stated policies. The objective is to identify mixed messages being conveyed to employees that increase reputational risk.
And though reputational risks can be described, quantifying them is a daunting task but just as important as other risk assessments. For example, a major credit loss may be calculated and accounted for through normal financial reporting. However, the additional reputational loss can only be estimated. How many clients left or never brought their business to the bank because of the perception that the loan process was out of control? This is what financial institutions are trying to calculate.
Polls and surveys can help. The time and cost required to conduct them generally restrict their use to large, high-impact situations. On the other hand, the ever-changing mores of the public can also make the value of the results short-lived.
Quantifying risks with precision is less important than identifying them and estimating the general magnitude of their impact. As companies become more aware of reputational risk, their tasks will get incorporated into analyses and processes that gauge their reputational impact. And over time, both the risk-management culture and the ability to quantify reputational risk will grow, and the processes will become routine.
