reputational risk report

A p r i l 2 0 1 4

SPONSORED BY

2 StrategicRisk www.strategic-risk-global.com reputational risk report

introduction

forewordreputational risk is growing and, as an intangible risk, it presents a particularly thorny challenge. StrategicRISK has surveyed its audience of european risk managers to find out more. our analysis looks at some of the proactive ways people are managing this risk, and scopes out what risk managers are still unsure about.

it is early days: the onset of social media and proliferation of global supply chains are still relatively new, and both play their part in the rise of this exposure. What we know is that the cost of a damaged reputation can be high.

primark is paying out £6m this year to victims of the rana plaza factory disaster. it is a tragic story for the 1,100 workers who lost their lives when the Bangladeshi factory building collapsed in april 2013.

it was also a blot on the reputations of the european retailers linked to the factory. primark knows it: the fact that its statement about the latest compensation award is on

the section of its website marked “ethical trading” tells us so. in paying out this large sum, primark is making clear to anyone who will listen that it is doing the right thing by the workers and their families, and is hoping to clear its brand name of any link with unscrupulous traders.

primark stresses that “within a week of the collapse”, it had “committed to paying long-term compensation to the workers of [supplier] new Wave Bottoms, as quickly as possible”, adding “since then, we have been working to enable the payments to be made.”

supply chain is just one source of reputational exposure. poor product design is another. toyota recalled 31,000 uk registered cars in February, because of a problem with their inbuilt computer which meant that they might just stop; a poor advert for the world’s largest car-maker.

and Barclays offers a cautionary tale about the perils of weak governance. the bank was

publicly decried for raising bonuses in January, fined £290m in 2012 for liBor fixing, and has pegged its total bill for mis-selling ppi at £4bn. the payouts may have been demanded by the regulator, but such sums are also a part of Barclays’ public rehabilitation. a new, five-point programme for cultural change, including far-reaching staff training, was launched with a fanfare in February, with the aim of restoring public confidence in the bank.

and that’s not to mention the horsemeat scandal which, when it hit the headlines in January 16, 2013, dragged the good names of tesco, Dunnes stores, aldi, lidl, and iceland through the mud.

these are just some of the stories of reputation damage sustained by organisations in the past year or two. this report sets out to understand this growing risk, and to offer insights on current practice in management and mitigation.

backgroundStrategicRISK’s readers agree 100% that reputational risk is on the rise. a glance at the newspaper headlines of the past year confirms it — from morally toxic supply chains to faulty product design to failed governance, the reputations of organisations are taking a beating.

the positive story is that ideas about how best to protect reputation are starting to take shape. Best practice in managing and mitigating reputational risk is being formulated; in this report, StrategicRISK identifies what is being done, and scopes areas for further investigation.

The respondenTsin order to better understand how risk managers perceive and deal with reputational risk, StrategicRISK conducted a survey of its readers between January and March 2014. survey responses were 15% from manufacturing, and 15% retail; 12% from financial services; 8% from law firms, leisure firms, oil and gas, transport, food & drink, clothing companies; and 4% from engineering, local government, and consultants.

in size terms, 35% of respondents were from organisations of more than £800m annual turnover, 50% from companies with a top-line of £15m to £800m, and 15% from firms with sales of £15m or less.

www.strategic-risk-global.com StrategicRisk 3reputational risk report

introductionsponsoreD BY

a global supply chain makes it very hard to

anticipate where a reputation issue

could arise

business of respondenTs

execuTive summaryStrategicRISK’s research highlights an apparent contradiction when it comes to reputation risk: although 83% of respondents agree that reputation is a company’s most important asset, when asked “is reputation risk the biggest threat to your business”, just 8% said yes.

Flip the latter result, and 92% of risk managers surveyed don’t rate loss of reputation as the biggest threat to their organisation — which begs the question, what is?

to explain the apparent contradiction between the high value of reputation and the lack of fear of losing it, we can look at the answers to two further questions. First, 73% of respondents consider reputational risk to be consequential, the result of another, identifiable risk; and second, that among these known risks, supply chain was the one most likely to be rated as “the biggest reputation risk that your company faces”.

one respondent explained it thus: “a global supply chain makes it very hard to anticipate where a reputation issue could arise.” a known unknown, if you like.

such contradictions and uncertainties are threaded throughout the three main areas of questioning in the survey: scoping reputational risk; quantifying the exposure; and managing/ mitigating it.

take the issue of which individuals within an organisation ought to be responsibile for reputation risk. While 58% of those surveyed said that the Ceo was responsible, of those polled, 71% believed that risk managers ought to be. But, when asked what measures were taken to manage or mitigate the risk, it turns out that the communications function is in the driving seat: most respondents, 36%, said no specific measures were taken (a finding that probably ought to set alarm bells ringing in itself), and of those who did report some activity, 29% said that it was managed by the press or communications team.

More work is needed to clarify when and how different teams should be involved in proactive and/ or reactive activity. another way of putting this is, where does risk management end, and reputation management begin?

there is a lack of ideas, too, about how to quantify the risk. this has a negative effect in terms of management/ mitigation: if an organisation is unable to put a figure on a potential loss, then deciding what resource is needed to manage or mitigate the risk is a tall order. a surprising 77% of risk managers consider it impossible to quantify reputational exposure. of those willing to take a punt, some suggested watching share price movements, and others, loss of future business.

risk managers are still finding out how to manage this growing risk. this report identifies strengths and weaknesses in current practice, and identifies some areas for further investigation.

4 StrategicRisk www.strategic-risk-global.com reputational risk report

survey respondents are unanimous in saying that “the threat of reputational damage is increasing”. this is, as it turns out, a curious result. analysing the full data, a picture emerges of lack of consensus on definitions and current practice, and gaps in knowledge. and yet, all agree that it is definitely a growing threat. How so?

the probable answer is twofold: first, that cases of loss of reputation keep on coming (see Foreword); and second, that lack of knowledge and of risk

management activity increases the likelihood, and fear, of an incident occurring.

results show that there is scant agreement on where to look for, or what constitutes, reputational exposure. this may be partly a result of the wide variety of organisations surveyed (see The Respondent, page 2), but it also appears to reflect general uncertainty about, and lack of experience with, this risk.

a large majority, 81%, agree that reputational risk is

consequential, but asked what the biggest reputation risk is, answers were disparate: the most commonly-named was supply chain (22%); explaining why, one respondent wrote, “it affects both short-term sales, and long-term external perception”. second most-cited was “too many to list”, 18%, followed in joint third-place by compliance, and fraud, both at 12%. other risks named, by 5% of respondents each, were: quality control, loss of life to client, catastrophic event

analysis1repuTaTional risk

www.strategic-risk-global.com StrategicRisk 5reputational risk report

eXpert VieW

leading to major loss of life, environmental incident, customer dissatisfaction resulting in bad press, and data breach.

if risk managers differ in their opinions about what this risk is, then they’re unlikely to be on common ground in terms of where to look for it. asked which stakeholders have most influence over reputation, again, responses were spread out. the biggest group, 28%, thought that customers were the most influential. suppliers, employees, and the media were level

pegging in terms of their perceived influence over reputation, at 19% each. the smallest proportion of respondents, 15%, opted for the general public as having most influence.

analysis

Although 83% of respondents said that a company’s reputation is its most important asset, 92% do not believe that reputational risk is the biggest threat. These statistics perhaps reflect the idea that many risk managers do not perceive reputational risk as a risk in its own right, but as a consequence of other risks.

In areas such as quality assurance, the risk of a product default is an important driver for potential reputational damage. But equally, if businesses are trying to achieve another goal, it is a reputation for reliability. There is no surer way to damage reputation for reliability than a failure to provide products and services to the market because of an unplanned interruption.

The Japanese tsunami in 2011 is a good example both of how reputational risk is a subset of another risk, and how an unforeseen disaster can halt the supply of a multitude of products, resulting in significant aggregate economic loss, with reputation damage to many companies and indeed reputation enhancement to others. In a globalised world, the impact of a natural disaster is further compounded as companies outsource to high-risk areas. In the last three decades, the number of loss-relevant events rose from 400 a year to more than 1,000.

An example of the scale of loss in a complex global supply chain environment was when a Japanese manufacturer’s largest supplier suffered a fire that destroyed hundreds of important machines. The supplier provided 90% of the manufacturer’s cost-efficient brake proportioning valves, and the incident halted production across 18 of the company’s automotive plants within hours. Ultimately, it caused an estimated 1% per-day loss to the country’s industrial output, with an overall loss estimated at $195m and 70,000 units of production. Considering an upside example, some companies get back into business quicker than their competitors, and gain a market edge as a result – as happened within the semiconductor industry following the Thai floods. The only conclusion to draw is that companies that are well risk managed will withstand losses better than those that are not.

However, no clear mitigation strategies emerged from this survey. What it did show however was a clear disparity in who is responsible for managing the risk. An overwhelming 57% said the chief executive was responsible, while 37% said it was a board-level issue and only 12% said it currently lay with the risk manager. Regardless of who owns the risk, companies must take a joint-management approach to reputational risk.

We fervently believe that companies that seek market-leading loss prevention advice will be far more likely to implement effective solutions. If they do all that, companies that suffer from an incident will recover comparatively well and prove themselves to be resilient in a complex supply chain environment – gaining credit for their recovery plans, and finding their reputations considerably enhanced.

peter solloway, vice president – regional sales managernorthern and central europe and chemical in emea

sponsoreD BY

building a resilient brand

>>

The threat of reputational damage is increasing

76%24%

83%17%

analysis

6 StrategicRisk www.strategic-risk-global.com reputational risk report

social media

responsibiliTy

2 3it’s reasonable to assume that customers top the list at least partly because of their use of social media, through which they’re able to publish their views of brands. However, while 54% of risk managers identified social media as “more of a threat than an opportunity”, nearly a third, 27%, admitted to not knowing if their organisation took a proactive or reactive approach to social media as a reputation management tool (42% said proactive, 31% reactive).

in a situation where customers are perceived as the stakeholders representing the most threat to reputation (and where there is little

articulation of risk beyond the catch-alls “supply chain”, or “fraud”), it is surprising that 23% of organisations surveyed had no social media policy in place; and, more eyebrow-raising still, that 15% of respondents did not know whether such a policy existed.

on a more positive note, 62% of risk managers surveyed report having a social media policy. and, in terms of attitudes to social media, a more nuanced view — that social media is both an opportunity and a threat — was backed by 31%, while 15% saw social media as a positive opportunity for reputation management.

The media makes it very easy for negative and slanderous headlines to spread around the world, thus damaging a company’s brand. Indeed, recent headlines have brought to the fore just how important it is for companies to manage reputational risk, and part of a good strategy for resilience, is a robust and holistic risk management approach.

Businesses should consider that brand damage is an outcome of other risks. To try and pigeon-hole reputational risk, viewing it as a risk in its own right, makes it more difficult to manage, because ultimately it is an intangible risk and one that is difficult to quantify. Instead, I would strongly advocate that businesses take a holistic, enterprise-wide risk management approach, and in doing so, they are in a better position to elicit a positive brand image for their company.

Building resilience can only be possible if risk managers seek to really understand their company’s risk landscape, they have conducted a full and comprehensive risk assessment, and they have prioritised their risk areas. Once they have done that, it becomes easier to identify where reputational risk could emerge. Supply chain is one area where companies could sharpen up on their mitigation strategy. In an extended supply chain environment, the real problem arises from the fact that businesses are reliant on outsourced, third party suppliers. Risk managers need to understand where their suppliers are located, assessing whether those areas are vulnerable to natural disasters, also asking about work and safety conditions. All these aspects could severely harm their company’s brand. The Rana Plaza building collapse in Dhaka, Bangladesh is a good example of how outsourcing could possibly lead to negative reputational consequences.

An extension of that are natural catastrophe events. Take the recent flooding in the UK this winter. The media covered these events extensively and in the case that a business failed to provide products or services, would have resulted in some form of brand damage, as we’ve seen in other case studies, most notably the Thai floods in 2011. Cyber also poses huge reputational risk. There have been many examples of data breach, data theft or hacking, prompting onlookers to question the company’s reliability, and security.

No doubt, building resilience against a risk that is intangible and is a subset of many other risks is difficult. But fully understanding your risk portfolio by conducting a thorough risk assessment, and thereafter prioritising them, will help you build a robust strategy for mitigating reputational damage.

russell kirby, assistant vice president account engineering group manager

sponsoreD BY

www.strategic-risk-global.com StrategicRisk 7reputational risk report

eXpert VieW

a holistic enterprise-wide approachlet’s back up a little: if there is scant agreement on where the risk resides within organisations, does the risk management community at least have a common view as to the general characteristics of this risk?

Half of respondents agree that it’s a strategic risk; and, accordingly, 57% report that the Ceo is responsible for its management (31% said the board, 12% said risk managers). But, 46% of respondents say that it’s a strategic and operational risk combined, suggesting that lines of management responsibility may need more work in order for the appropriate person to be in the driving seat at the right moment.

poll results show that 71% of risk managers believe they ought to be responsible for managing reputation risk (27% said they shouldn’t, and 2% weren’t sure).

However despite the results noted above, in a baffling twist, when asked what measures their organisation takes to manage reputation risk, 29% said that responsibility falls to the press and communications teams. While brand management is squarely a pr/ comms job, there does appear a need to delineate roles in a situation where a bit of bad press, or hostile social media chatter, looks like escalating into a serious threat to the business. >>

8 StrategicRisk www.strategic-risk-global.com reputational risk report

analysis

miTigaTion insurance

4 5at the heart of these contradictory notes is the question of quantifying reputational risk. a convincing 77 % of respondents thought it impossible to financially quantify reputational damage. this makes the job of managing, or mitigating, the risk very much more challenging: an inability to scope and quantify a potential loss puts risk managers in a weak negotiating position for the required resources to do the job, and risks ceding responsibility for reputation exposure altogether.

some respondents did articulate approaches to quantifying reputational damage, albeit mostly in ways which measured losses after the event.

several commenters suggested that for listed companies, share price movement after a damaging event, and share price compared to similar companies, is a way of doing it. opinion was divided about using future business loss as a measure, with one respondent suggesting that “tracking business versus previous periods after an incident will give you a reasonable idea”, while another took the opposite view, saying it is “difficult to quantify the value of this, because it is an unknown”.

there appears to be a gap in knowledge when it comes to financially quantifying reputational risk.

www.strategic-risk-global.com StrategicRisk 9reputational risk report

eXpert VieW

sponsoreD BY

The fundamental point that underpins the findings in this survey is the extent to which an organisation trades on its brand. This is important to understanding the survey results. For instance, while 100% of the survey respondents believe that reputational risk is increasing, 92% do not believe that reputation risk is the biggest threat. This could be explained, in general terms, by acknowledging a distinction between how business-to-business (B2B) organisations perceive and handle reputational risk and how business-to-consumers (B2C) manage the risk.

B2Bs will likely have a contract and will have been awarded that contract because of their reputation and ability to perform. In this environment it is more likely that reputation damage will be a consequence of another risk. But in a B2C environment, the equation is quite different. Consumers are actively trading with a company’s brand, so if they are using their brand to influence customer loyalty, then they will proactively guard their reputation. In fact, they will not only guard it, they will seek to enhance it. Reputation management is absolutely central to the success of B2Cs.

There are however lessons to be learnt from the consumer business world that are transferable to B2B organisations. B2B risk managers generally believe that damage to reputation is a consequence of another threat and to some extent, this defines their mitigation strategies. That is not to say that this is the wrong approach. If a risk manager takes the approach that brand damage is a consequence of another risk, then quite rightly they will focus on the management of those threats, be they late delivery or deficit product recalls for example. If a risk manager is focusing on the management of their products then they are in effect taking action to protect their company’s reputation. Those working in the B2B environment may not be managing reputation risk directly but are doing so indirectly by managing other threats.

I would however advise that B2B risk managers take a more proactive role to enhance their company’s reputation. They should pick up the ‘reputational lens’ and look at risks through that lens. Instead of perhaps being reactive, they should ask, if we did enhance our reputation by deliberately taking action, would we actually improve our performance?

Brand managers in the consumer world will generally be proactive on the social media front, using it to track what is being said about their products and services. They would also carry out sentiment surveys to understand how they are being perceived in the market, proactively turning a risk that, on the surface, may appear intangible into a risk that they are able to track and to some extent quantify. These capabilities should more generally be embraced by risk managers in the B2B arena.

paul hopkin, technical director, airmic

The tangible side of reputational risk

Given this lack of credible data, there is a question mark as to whether insurance is the right way to go for this risk at present.

asked if insurers were doing enough to provide sufficient cover and assistance for reputational risks, 38% of respondents said yes, 4% no. the majority, 58%, couldn’t be sure either way, and this was played out in the comments, with one respondent saying “it’s hard to know what more they could do; equally it’s hard to understand how effective policies would be...”, and another adding,

“there’s not much clarity around what policies cover”.

the same question about sufficient cover and assistance from brokers produced the same result: 38% of respondents said yes, brokers are doing enough; 4% said no; and 58% were unsure.

asked for general comments, one respondent summed up the overall picture succinctly: “i’m interested in learning more about how to determine level of risk and what measures should be in place and what controls can be used to minimize/ mitigate it.”