By Rob Starr, Big4.com Content Manager.
Henry Ristuccia, Global Governance, Risk and Compliance leader, Deloitte Touche Tohmatsu Limited, helps us understand the disconnect between professed confidence in reputation and lack of confidence in the ability to protect it.
Why does overall confidence decline when it comes to protecting against and responding to reputation risks?
In terms of protecting against reputation risks, many companies particularly lack confidence
when it comes to risks that are beyond their direct control. For example, a third-party vendor in a foreign country engages in activity that violates the Foreign Corrupt Practices Act, or an unforeseen hazardous situation arises with a product. Companies can screen and provide training to vendors and take steps to confirm the safety of all product components, but there is still a measure of uncertainty that may undermine confidence.
In terms of responding to reputation risks, lack of confidence can stem from the potential impact of the event. The ripple effects from incidents that undermine a company’s reputation can take on a life of their own, especially given today’s digital world. Recent history has shown that such incidents can not only bleed into other aspects of a company’s operations with potential for significant financial ramifications and loss of brand value, but can also shift an entire industry, with investigations and increased regulations.
Can you define these reputation risks?
Reputation risks are many and varied, driven by a wide range of other risks that must all be actively managed. According to the survey, risks related to ethics and integrity, such as fraud, bribery, and corruption, top the list. Next come security risks, including physical and cyber breaches, which are particularly top-of-mind given recent massive incidents. Product and service risks are another driver of reputation risk, related to safety, health, and the environment. Third-party relationships are a rapidly emerging risk area, with companies increasingly being held accountable for the actions of their suppliers and vendors.
How can these risks negatively affect companies?
Our survey respondents who had experienced a reputation risk event reported that reputation issues have the biggest impact on revenue and brand value. Loss of revenue was ranked highest by companies in the consumer and industrial products and energy industries. Loss of brand value was cited as the key impact in the life sciences and technology industries. Other negative outcomes include being subject to regulatory investigation, loss of customers, and lower stock price.
What needs to be done?
You don’t want to wait for a reputation event to occur and then scramble to respond. Leading companies address reputation risk as an ongoing strategic issue, recognizing that managing reputation risk requires constant vigilance. More and more companies are investing in crisis management to stay ahead of major threats and respond quickly and appropriately should a threat become reality. They’re using simulations and risk sensing technologies to assist in identifying and preparing for strategic risks and developing their capabilities for rapid response, including honing their ability to communicate effectively before, during, and after a reputation event occurs.
What are the other takeaways from the survey?
Clearly, responsibility for reputation risk resides with the board and C-Suite — for more than a third of our survey respondents (36%), the CEO bears primary responsibility; followed by the Chief Risk Officer (21%). How companies deal with that responsibility varies; some form a specific reputation risk committee, some manage it through the compliance function, others make it the responsibility of leaders at the function or business level.
Customers were considered the most important stakeholders for managing reputation risk. Given the increasing influence of social media and the instant nature of global communications, managing customer expectations and perceptions is critical to success. An event can have a positive or negative effect on reputation — if a company exceeds expectations, its reputation can be enhanced; if it falls short of expectations, its reputation can be damaged. Knowing what customers expect, and matching company performance to those expectations, determines whether value is created or destroyed.