Reputation Risk. Your Name is All You Have

Transcription

1 Reputation Risk Your Name is All You Have

2 Keeping Your Name Out of the Mud

3 Today s Agenda Why Reputation is Important What is Reputation Risk Interdependency of Risks Managing Reputation Risk Crisis Management The Role of Internal Audit

4 Why Worry About Reputation? Part of the format; not a reputation risk

5 It takes twenty years to build a reputation and five minutes to destroy it If you think about that you ll do things differently Warren Buffet

6 Everything you do builds or undermines trust

7 What Can Happen? CPS, Education, and Sheriff Joe

8 Some Numbers You Should Know

9 81% Ace European Risk Briefing

10 2011 8% Global Risk Management Survey 2013 AON Risk Solutions

11 % Global Risk Management Survey 2013 AON Risk Solutions

12 Managing the Risk 56% Global Risk Management Survey 2013 AON Risk Solutions

13 Is it a Big Deal? #4 Global Risk Management Survey 2013 AON Risk Solutions #1Exploring Strategic risk Deloitte

14 NEWSFLASH!! UPDATE!! # #1

15 The Business Case for Reputation

16 Over 80% of market value is derived from intangible assets

17 A decrease in 1 Star Rating can equate to a 10% reduction in revenue

18 An increase in rating by 1 Star Rating can equate to a 5-9% increase in revenue

19 Ultimately, Reputation Affects Public Image Customer Retention Employee Recruitment/Retention Access to Capital/Investors Ability to do Business/License to Operate Third-party Relations Sales/Revenue/Expenses/Profits Shareholder/Stakeholder Value

20 Reputation Risk: A Stab at a Definition

21 What is a risk? If the organization has the general objective Act in an ethical manner, is the following a risk? Act unethically

22 The Definition of Risk The possibility that an event will occur and adversely affect the achievement of objectives COSO Internal Control Integrated Framework 2013 Effect of uncertainty on objectives ISO31000

23 Reputation Defined Reputation is what people expect us to do next. It's their expectation of the quality and character of the next thing we produce or say or do. We control our actions (even when it feels like we don't) and our actions over time (especially when we think no one is looking) earn our reputation. Seth Godin

24 Reputation Defined The emotional connection between stakeholders and organizations The Reputation Institute

25

26 My Definition The potential that an event will impact the organization s reputation in a way that will adversely impact that organization s objectives

27

28 My Definition The potential that an event will impact the organization s reputation in a way that will adversely impact that organization s objectives

29 All Risk Is Reputation Risk

30 Amplifier Risk Reputation risk is an amplifier risk that layers on or attaches to other risks adding negative or positive implications to the materiality, duration, or expansion of the other risks on the affected organization, person, product, or services. The Reputation Risk Handbook Andrea Bonime-Blanc

31 Interdependency of Risks

32 Top Ten Risks 1. Damage to reputation/brand 2. Economic slowdown/slow recovery 3. Regulatory/legislative changes 4. Increasing competition 5. Failure to attract or retain top talent 6. Failure to innovate/meet customer needs 7. Business interruption 8. Third party liability 9. Computer crime/hacking/viruses/malicious codes 10. Property damage Global Risk Management Survey 2015 AON Risk Solutions

33 Reputation Requires Delivery Core Areas Products/Services Innovation Workplace Governance Citizenship Leadership Performance Adapted from Defining and Managing Reputation Risk: A Framework for Risk Managers 2015 AIRMIC

34 Reputation Risk Management

35 Another Number For You 92% Ace European Risk Briefing

36 Why is it So Hard? Difficult to define Some organizations define it as an impact, not a risk Little information on how to manage Difficult to measure Defined by external perceptions

37 Build from the Top Down An appropriate culture and associated processes will minimize the potential for crises to occur in the first place

38 Reputation Risk Management Considerations Tone at the Top Understand Potential Reputation Risks Governance PR & Communications Integration Front Line Integration Crisis Plan Measure Monitor

39 Tone at the Top Culture CEO is in charge Visibly principled leaders who communicate values, then live them Structure Strong and integrated governance Existing risk assessment program Speak-up Culture Encourage early problem detection Hot-line, ethics line, problem resolution method Incentives Values-based assessments and rewards Support employees to guard reputation

40 Auditing Tone at the Top Approaches Entity-wide surveys Structured entity-level interviews Gathered in all conversations Resources Best Practices: Evaluating the Corporate Culture (Roth) Enterprise Risk Management: Achieving and Sustaining Success (Sobel & Reding)

41 Understand Potential Reputation Risks Risk Identification Design system to identify and address areas of potential exposure Understand interdependent risks (fraud, IT, regulatory, financial, etc.) Team integration Cross-functional approach Governance ERM Three lines of defense Use internal and external resources Strategic Integration Strategy will drive reputation; reputation will drive strategy

42 Governance Executive oversight High-level Coordinate with experts Knowledgeable Board oversight Standard discussion in board meetings Built into strategic risk management, annual planning, and long-term strategic planning

43 Board Role and Responsibilities Educate Yourself Chose the governance structure that fits Create a robust intelligence system Hire the right CEO Have a plan for when things go wrong

44 PR & Communications Integration Establish communication plan Part of crisis management Established policies and guidelines PR & communications response teams Identify teams for larger and smaller mini crises. Information on when to escalate Training for all teams

45 Front Line Integration Front-line business teams Supervisors equipped to identify and deal with reputation risk issues Supervisors know what to do Policies and guidelines Addressed in relevant documents, policies, procedures, etc. (e.g. code of conduct, hot-line protocols) Clear and actionable language Accessible Education and training Understanding the basics of reputational risk Sufficient knowledge to recognize potential crises and how to respond Sufficient knowledge to provide input on potential risks Learning from mistakes

46 Crisis Plan Plan integration Reputation risk issues integrated in crisis plan Crisis team in place Crisis management training Rapid deployment force Quickly focus on root cause Necessary internal and external resources Right team for identified root cause Post-event SWOT Debrief and lessons learned Integrating lessons into updates

47 Measure Measure how reputation is perceived externally Sets the starting point Compare as a part of monitoring Measuring the Impact an example Any losses in shareholder value beyond general market fluctuations which cannot be accounted for by financial costs from the event itself are pure reputational losses

48 Monitor Essential to understanding how external stakeholders perceive the organization Monitor on an ongoing basis Monitor across all markets Monitor on a global basis Invest in staff, resources, technology Full range of channels traditional and social media

49 Reputation Analysis GAP Messaging What you say GAP Word of Mouth What people say GAP Perceptions What people see GAP Behavior What you do GAP

50 Crisis Management

51 I want my life back Tony Hayward Tony Hayward Former CEO - BP Former CEO - BP

52 How Johnson & Johnson Got It Right with Tylenol The Story Came forward immediately Acted immediately Took Responsibility Took Action Treated people with respect Result? Back to market share after relaunch

53 The Best Laid Plans Even with the best reputation management, crises will happen If done correctly, crisis management can actually enhance the brand and reputation Companies are judged not on the crisis itself, but on the response

54 Hits and the Consequences Deadly Blow Organization/product/service/leader disappears Enron, Lehmans, Arthur Anderson, Barings Recoverable Hit Organization/product/service/leader regroups and recovers Siemens, BP Enhancement Event Organization/product/service/leader builds reputational equity Johnson & Johnson

55 Crisis Management Quick and agile (minutes not days) Predetermine when to mobilize a response Keep everyone informed transparency in communications Role of the board They should ask for a crisis management plan; they should know the plan They are not the spokespeople Predetermine what events they need to know

56 Crisis Management Identify media experts ahead of time Know the local responders Train, Re-Train, Keep Training Conduct simulations

57 Crisis Management Plan Short and practical Consider all scenarios Who does what, when, and where List the team Internal and external contact details Crafted messages Proven ability to implement Develop a process to allow for flexibility

58 What not to do Providing no response Replying No Comment Offering disorganized, conflicting statements Issuing a verdict before examining the facts

59 Candor Explanation Affirmation Declaration Contrition Certification Commitment Restitution I m Sorry Works

60 Alton Towers The Smiler

61 Alton Towers The Smiler June 2 Two cars crashed The Spokesperson Compensation Ensure Safety Existing Dialogue Business Model

62 Crisis Management in a Nutshell Have a plan Train for it Test it

63 What is Internal Audit s Role?

64 Start at the Top The C-Suite Conversations with the board Conversations with the C-Suite Assurance providers Governance, ERM, Three Lines of Defense, Audits of other assurance providers

65 Specific Audit Work Strategic-level audit Is there a strategy? What are the goals? Are they being achieved? What is the message?

66 Specific Audit Work Operational reviews Overall risk management approach Policies and procedures Monitoring processes Crisis plan

67 Specific Audit Work Lifecycle of Reputation Risk Management Beginning Strategy Development Risk Assessment Middle Policies and Procedures Monitoring Outcomes Crisis Management Post Mortem

68 Additional Audit Considerations Consider reputation risk for annual assessments Include in all relationship meetings Consider in all audit projects Risk assessment Considerations at management level Understanding at all levels Understanding of crisis management roles

69 In General - Questions to Ask Has reputation risk been assessed? Is reputation risk a part of all risk assessment activities? Is there a crisis management process? Has it been tested? Do people understand the impact of their processes/operations/jobs on reputation?

70 Resources Defining and Managing Reputation Risk: A Framework for Risk Managers AIRMIC The Reputation Risk Handbook Andrea Bonime-Blanc Best Practices: Evaluating the Corporate Culture James Roth Enterprise Risk Management: Achieving and Sustaining Success Sobel & Reding)

71 QUESTIONS?

72 THANK YOU! Feel free to contact me at: And you can follow me at: