Reputation Risk Your Name is All You Have
Keeping Your Name Out of the Mud
Today s Agenda Why Reputation is Important What is Reputation Risk Interdependency of Risks Managing Reputation Risk Crisis Management The Role of Internal Audit
Why Worry About Reputation? Part of the format; not a reputation risk
It takes twenty years to build a reputation and five minutes to destroy it If you think about that you ll do things differently Warren Buffet
Everything you do builds or undermines trust
What Can Happen? CPS, Education, and Sheriff Joe
Some Numbers You Should Know
81% Ace European Risk Briefing - 2013
2011 8% Global Risk Management Survey 2013 AON Risk Solutions
2013 40% Global Risk Management Survey 2013 AON Risk Solutions
Managing the Risk 56% Global Risk Management Survey 2013 AON Risk Solutions
Is it a Big Deal? #4 Global Risk Management Survey 2013 AON Risk Solutions #1Exploring Strategic risk Deloitte - 2013
NEWSFLASH!! UPDATE!! #4 2015 #1
The Business Case for Reputation
Over 80% of market value is derived from intangible assets
A decrease in 1 Star Rating can equate to a 10% reduction in revenue
An increase in rating by 1 Star Rating can equate to a 5-9% increase in revenue
Ultimately, Reputation Affects Public Image Customer Retention Employee Recruitment/Retention Access to Capital/Investors Ability to do Business/License to Operate Third-party Relations Sales/Revenue/Expenses/Profits Shareholder/Stakeholder Value
Reputation Risk: A Stab at a Definition
What is a risk? If the organization has the general objective Act in an ethical manner, is the following a risk? Act unethically
The Definition of Risk The possibility that an event will occur and adversely affect the achievement of objectives COSO Internal Control Integrated Framework 2013 Effect of uncertainty on objectives ISO31000
Reputation Defined Reputation is what people expect us to do next. It's their expectation of the quality and character of the next thing we produce or say or do. We control our actions (even when it feels like we don't) and our actions over time (especially when we think no one is looking) earn our reputation. Seth Godin
Reputation Defined The emotional connection between stakeholders and organizations The Reputation Institute
My Definition The potential that an event will impact the organization s reputation in a way that will adversely impact that organization s objectives
My Definition The potential that an event will impact the organization s reputation in a way that will adversely impact that organization s objectives
All Risk Is Reputation Risk
Amplifier Risk Reputation risk is an amplifier risk that layers on or attaches to other risks adding negative or positive implications to the materiality, duration, or expansion of the other risks on the affected organization, person, product, or services. The Reputation Risk Handbook Andrea Bonime-Blanc
Interdependency of Risks
Top Ten Risks 1. Damage to reputation/brand 2. Economic slowdown/slow recovery 3. Regulatory/legislative changes 4. Increasing competition 5. Failure to attract or retain top talent 6. Failure to innovate/meet customer needs 7. Business interruption 8. Third party liability 9. Computer crime/hacking/viruses/malicious codes 10. Property damage Global Risk Management Survey 2015 AON Risk Solutions
Reputation Requires Delivery Core Areas Products/Services Innovation Workplace Governance Citizenship Leadership Performance Adapted from Defining and Managing Reputation Risk: A Framework for Risk Managers 2015 AIRMIC
Reputation Risk Management
Another Number For You 92% Ace European Risk Briefing - 2013
Why is it So Hard? Difficult to define Some organizations define it as an impact, not a risk Little information on how to manage Difficult to measure Defined by external perceptions
Build from the Top Down An appropriate culture and associated processes will minimize the potential for crises to occur in the first place
Reputation Risk Management Considerations Tone at the Top Understand Potential Reputation Risks Governance PR & Communications Integration Front Line Integration Crisis Plan Measure Monitor
Tone at the Top Culture CEO is in charge Visibly principled leaders who communicate values, then live them Structure Strong and integrated governance Existing risk assessment program Speak-up Culture Encourage early problem detection Hot-line, ethics line, problem resolution method Incentives Values-based assessments and rewards Support employees to guard reputation
Auditing Tone at the Top Approaches Entity-wide surveys Structured entity-level interviews Gathered in all conversations Resources Best Practices: Evaluating the Corporate Culture (Roth) Enterprise Risk Management: Achieving and Sustaining Success (Sobel & Reding)
Understand Potential Reputation Risks Risk Identification Design system to identify and address areas of potential exposure Understand interdependent risks (fraud, IT, regulatory, financial, etc.) Team integration Cross-functional approach Governance ERM Three lines of defense Use internal and external resources Strategic Integration Strategy will drive reputation; reputation will drive strategy
Governance Executive oversight High-level Coordinate with experts Knowledgeable Board oversight Standard discussion in board meetings Built into strategic risk management, annual planning, and long-term strategic planning
Board Role and Responsibilities Educate Yourself Chose the governance structure that fits Create a robust intelligence system Hire the right CEO Have a plan for when things go wrong
PR & Communications Integration Establish communication plan Part of crisis management Established policies and guidelines PR & communications response teams Identify teams for larger and smaller mini crises. Information on when to escalate Training for all teams
Front Line Integration Front-line business teams Supervisors equipped to identify and deal with reputation risk issues Supervisors know what to do Policies and guidelines Addressed in relevant documents, policies, procedures, etc. (e.g. code of conduct, hot-line protocols) Clear and actionable language Accessible Education and training Understanding the basics of reputational risk Sufficient knowledge to recognize potential crises and how to respond Sufficient knowledge to provide input on potential risks Learning from mistakes
Crisis Plan Plan integration Reputation risk issues integrated in crisis plan Crisis team in place Crisis management training Rapid deployment force Quickly focus on root cause Necessary internal and external resources Right team for identified root cause Post-event SWOT Debrief and lessons learned Integrating lessons into updates
Measure Measure how reputation is perceived externally Sets the starting point Compare as a part of monitoring Measuring the Impact an example Any losses in shareholder value beyond general market fluctuations which cannot be accounted for by financial costs from the event itself are pure reputational losses
Monitor Essential to understanding how external stakeholders perceive the organization Monitor on an ongoing basis Monitor across all markets Monitor on a global basis Invest in staff, resources, technology Full range of channels traditional and social media
Reputation Analysis GAP Messaging What you say GAP Word of Mouth What people say GAP Perceptions What people see GAP Behavior What you do GAP
Crisis Management
I want my life back Tony Hayward Tony Hayward Former CEO - BP Former CEO - BP
How Johnson & Johnson Got It Right with Tylenol The Story Came forward immediately Acted immediately Took Responsibility Took Action Treated people with respect Result? Back to market share after relaunch
The Best Laid Plans Even with the best reputation management, crises will happen If done correctly, crisis management can actually enhance the brand and reputation Companies are judged not on the crisis itself, but on the response
Hits and the Consequences Deadly Blow Organization/product/service/leader disappears Enron, Lehmans, Arthur Anderson, Barings Recoverable Hit Organization/product/service/leader regroups and recovers Siemens, BP Enhancement Event Organization/product/service/leader builds reputational equity Johnson & Johnson
Crisis Management Quick and agile (minutes not days) Predetermine when to mobilize a response Keep everyone informed transparency in communications Role of the board They should ask for a crisis management plan; they should know the plan They are not the spokespeople Predetermine what events they need to know
Crisis Management Identify media experts ahead of time Know the local responders Train, Re-Train, Keep Training Conduct simulations
Crisis Management Plan Short and practical Consider all scenarios Who does what, when, and where List the team Internal and external contact details Crafted messages Proven ability to implement Develop a process to allow for flexibility
What not to do Providing no response Replying No Comment Offering disorganized, conflicting statements Issuing a verdict before examining the facts
Candor Explanation Affirmation Declaration Contrition Certification Commitment Restitution I m Sorry Works
Alton Towers The Smiler
Alton Towers The Smiler June 2 Two cars crashed The Spokesperson Compensation Ensure Safety Existing Dialogue Business Model
Crisis Management in a Nutshell Have a plan Train for it Test it
What is Internal Audit s Role?
Start at the Top The C-Suite Conversations with the board Conversations with the C-Suite Assurance providers Governance, ERM, Three Lines of Defense, Audits of other assurance providers
Specific Audit Work Strategic-level audit Is there a strategy? What are the goals? Are they being achieved? What is the message?
Specific Audit Work Operational reviews Overall risk management approach Policies and procedures Monitoring processes Crisis plan
Specific Audit Work Lifecycle of Reputation Risk Management Beginning Strategy Development Risk Assessment Middle Policies and Procedures Monitoring Outcomes Crisis Management Post Mortem
Additional Audit Considerations Consider reputation risk for annual assessments Include in all relationship meetings Consider in all audit projects Risk assessment Considerations at management level Understanding at all levels Understanding of crisis management roles
In General - Questions to Ask Has reputation risk been assessed? Is reputation risk a part of all risk assessment activities? Is there a crisis management process? Has it been tested? Do people understand the impact of their processes/operations/jobs on reputation?
Resources Defining and Managing Reputation Risk: A Framework for Risk Managers AIRMIC The Reputation Risk Handbook Andrea Bonime-Blanc Best Practices: Evaluating the Corporate Culture James Roth Enterprise Risk Management: Achieving and Sustaining Success Sobel & Reding)
QUESTIONS?
THANK YOU! Feel free to contact me at: mjacka@fpacts.com And you can follow me at: figre@cox.net