Saving Face

Risk managers believe one of the top risks facing organizations today is a lack of insurance coverage available for reputation risk. The scarcity of coverage makes it absolutely necessary to pre-plan for handling a crisis.

Reputation risk is cited as a top priority for risk managers in a Marsh survey taken at the 2007 Risk and Insurance Management Society (RIMS) conference, delegates of the 2008 RIMS conference in San Diego, California.

And it seems that one year later, reputation risk remained top-of-mind for many of the attendees, with it being the focus of many of the sessions. Michael Jones of Kilburn Jones & Gill LLP, James Kirtland of ING Group and Bruce Abrams of AIG VALIC, hosted one such seminar entitled ‘Reputation Risk, the Hidden Risk,’ at this year’s conference.

More than half of the 269 CEO respondents contacted for a 2005 Economist Intelligence Unit survey placed reputation risk as the top risk facing their organizations. At the same time, a 2008 Corporate Executive Board survey found that 52% of respondents have no strategy in place to address the risk, Jones said.

Although insurance covers many different types of risks, no one has developed a true risk transfer program to mitigate an adverse reputation risk, he noted.

“We all know that insurance is available for the ancillary effects of the reputation risk — for things such as extra expense, business continuity, lost income etc. — but there is nothing actually available to repair a company’s reputation,” he said.

CEOs, CFOs and risk managers in the Economist survey identified security breaches, unethical practices and regulatory non-compliance as the most serious risks to a firm’s reputation, Jones said.

With this in mind, it is imperative that corporations develop clear and comprehensive communication plans and strategies before an event occurs that may damage an organization’s reputation, Kirtland said. “If you have no strategy to manage reputation risk, then your company can only react to an adverse reputation event and that has the potential to end very badly.”

Kirtland said a more proactive approach involves senior management accepting the risk and planning for an event. In a “best-case scenario,” a company that involves all of its staff members in preparing for a crisis will be the one that responds to an actual crisis most effectively.

Panel members called on organizations to determine in advance potential sources of reputation risk, analyze the impact of such risks, organize and focus resources to mitigate these risks, pre-plan for crises and train leaders to respond appropriately.

POSSIBLE HURDLES

Undoubtedly there will be obstacles facing risk managers who want to raise the issue of reputational risk with management, Kirtland warned. Three likely hurdles include:

• little regulatory guidance on how to handle an event that may damage an organization’s reputation; • the unpredictability of “the middle section” (for example, Kirtland noted, how does a risk manager identify a plan for management misbehavior?); and

• value at risk.

Kirtland gave the following example of

what is meant by value at risk. “If a factory burns down, we know how much it will take to replace the building and its contents, and we can calculate the lost profits quite easily,” he said. “But how can we put the number on exposure to reputation risk?”

The panel drafted some suggestions to help overcome the obstacles. The first suggestion is to establish a protocol to make sure the decisions and transactions that could impact the reputation of the business go to senior management or the board if necessary.

The second is a prioritized focus. “You have limited resources available to you, so certainly not enough to manage every possible risk to your reputation,” Kirtland observed.

And lastly, “when it comes to value at risk, talk to the internal business owners,” Kirtland said. “They’re in the best position to understand the potential financial impact of damage to your company’s reputation.”

TECHNIQUES TO IDENTIFY RISKS

Before a strategy or communications plan can be developed, Kirtland emphasized the importance of testing the waters. He suggested companies conduct surveys of their financial transactions and their relationships with the public and media. Using the information obtained in these surveys, companies’ risk management teams can gain some insight into what might be at risk and how the public, its stakeholders and its competition perceive them.

By taking the time to perform a “deal questionnaire” that analyzes large, complex financial transactions before they are completed, a company can help to identify potential sore spots for its reputation. Such questionnaires should focus on the terms and conditions of the deal, the purpose of the transaction, the client profile of the other organization involved in the transaction, legal, tax and regulatory positions and the social concerns of the other organization. “Such a review of a transaction can stop a deal from progressing if certain characteristics are viewed by management as risking the company’s reputation,” Kirtland said.

Surveys examining a company’s relationship to external organizations or individuals

will help to answer the questions: How do others perceive your company? How do media perceive the company? Should the company be seeking out its critics?

“It’s very important to understand how others perceive you and your company,” Kirtland said. “It’s the first step in developing a communication plan that may also be very useful if a crisis situation develops.” By having such a communication plan, an organization is helping itself to send a strong, consistent public message that is aligned with the organization’s core beliefs.

NO TIME TO SPARE

Shortly after an event, the markets react very quickly, panelists noted. Investors make decisions based on the way the representatives of a company act when confronted with a crisis. “Your stakeholders want to see leadership under stress,” Abrams said. “Good leadership may be rewarded, poor leadership is quickly punished.”

It is up to the risk manager, he continued, to provide management with the tools they need to respond quickly. “Recovery [time] can be short if you have anticipated events,” he said. “But if you are doing it after the event, then it’s too late.” The difference between organizations that recover well from a crisis and those that don’t can be measured in terms of billions of dollars worth of market capitalization, Abrams warned.

Senior executives responding immediately with compassion, empathy and humility may speed the recovery from the loss and could improve the organization’s capital value in the long run. Abrams cited the example of an airplane crash to which the CEOs of each of the two airlines involved had different responses. One reaction revealed compassion, while the other was overly defensive. Partly as a result of these different reactions to the crash, Abrams observed, the airlines experienced different levels of damage done to their corporate reputations.

“Following the July 25, 2000 crash of Air France’s Concorde jet in Paris, the CEO of that company went immediately to the airport, where he expressed humility, compassion and sympathy to the families,” Abrams told delegates. “The CEO of British Airways [which also had a fleet of Concorde jets at the time] gave a press conference at the same moment [in which the C EO] suggested debris on the runway was the cause of the crash and that it was not the aircraft’s fault.”

This is a perfect example of one organization being overly defensive and the other reacting with compassion, Abrams said. Since then, he added, Air France’s capital value has increased 40%; British Airways’ has decreased 20%. “A damaged reputation can cost an organization billions of dollars and there’s no insurance coverage for loss of reputation,” Abrams warned. “Keeping that in mind, it is crucial to pre-plan and have a communication strategy in place before an event hits.”