See discussions, stats, and author profiles for this publication at: [Link]

net/publication/327877292

Reputation Risk

Article · August 2018

CITATIONS READS
0 1,425

1 author:

Dominik Heil
University of the Witwatersrand
17 PUBLICATIONS   38 CITATIONS   

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Hermeneutic Phenomenology and Organisations View project

All content following this page was uploaded by Dominik Heil on 21 August 2019.

The user has requested enhancement of the downloaded file.

Reputation Risk

Dominik Heil
Wits Business School, Johannesburg
dominikheil@[Link]

Word Count: 2756

Abstract

Reputation is widely acknowledged as one of the most important corporate assets, but the most
difficult to protect. Changes in the environment (e.g. the development of global media and
communication channels, and reduced customer loyalty) are exposing organizations to increased
reputational risks. Regarded as the ‘risk of all risks,’ reputation risk is a so-called mega risk due
to its compounded nature, for the event that triggers the reputation risk usually also constitutes
another (business) risk. Research has indicated that reputation risk has become the main concern
for the majority of risk managers due to reputation being regarded as a major source of
competitive advantage. Reputation risk oversight has therefore become a core board
responsibility and mitigation strategies rest predominantly with organizational management.
Reputation risk differs from most other risks in that it presents not only potential negative
consequences but, if well managed, an opportunity for improving the organization’s reputation.

Keywords: Reputation risk, risk management, corporate governance, corporate reputation, crisis
communication, crisis management.

Reputation is widely acknowledged as one of the most important corporate assets and a major
source of competitive advantage, but it is also the most difficult to protect. Changes in the
environment (e.g. the development of global media and communication channels, as well as
reduced customer loyalty) are exposing organizations to increased reputational risks. The latter
are more difficult to manage than traditional risks because they rest on perceptions. For
organizations, there is more at stake with (negative) perceptions than with traditional risks
because it is their intangible value that is put at risk. Intangible value today is estimated at circa
70% of the market value of S&P 500 companies (an index comprised of 500 of the largest
U.S. companies).
Research has indicated reputation risk as being the ‘risk of all risks,’ a so-called mega
risk which has become the main concern for the majority of risk managers -- ahead of regulatory
compliance risk (previously the primary concern), human capital risk, IT network risk, market
risk, credit risk, and risk due to fraud (Ross & Lofthouse, 2005). Reputation risk oversight has
therefore become a core board responsibility and mitigation strategies rest predominantly with
organizational management (Dowling, 2006; Tonello, 2007).
In an organizational context, reputation is based on perceptions of its characteristics,
performance and behaviour – a reflection of how positively or negatively it is viewed by its

1
 The International Encyclopedia of Strategic Communication IESC

stakeholders or other interest/issue groups in society (Larkin, 2003). No organization operates
completely on its own – in order to succeed, it requires collaboration with, and support from,
numerous individuals, groups, institutions, companies and communities. Reputation declines
when experience or perceptions of an organization falls short of stakeholder (or societal)
expectations. A reputation risk often materializes when the negative publicity triggered by
certain (business) events, whether accurate or not, compromises the organization’s reputation
capital and results in loss of value. Reputation risk is thus a potential event that has a negative
effect on the perceptions of stakeholders and other societal interest/issue groups and, as such,
will lead to their diminished collaboration and support.
Reputation risks are in many ways similar to other risks on an organization’s risk register
that need to be managed by identifying, assessing, prioritizing, mitigating, and continuously
monitoring them. In some ways, however, a reputation risk is different from other risks:
• Reputation is shaped outside the organization. A reputational risk problem usually
involves the media as well as what customers, employees and other stakeholders are
saying in the public domain. The tools and analyses for measuring and monitoring
reputation risk is different from traditional risk management since the latter is focused
inward -- things that happen either within an organization or within its control.
• Reputation risk is considered a mega risk due to its compounded nature, i.e. the event that
triggers the reputation risk usually also constitutes another (business) risk that has its own
factual circumstances and consequences for the organization.
• For the most part, a reputation risk cannot be transferred to another party (through a
contract) or to a professional risk bearer namely an insurance or reinsurance company
(Ross & Lofthouse, 2005). For many typical risks, there are financial products that insure
against the losses incurred should a risk materialize. A currency fluctuation risk, for
example, can be transferred to a financial institution by buying financial instruments that
protect against currency fluctuations, thus mitigating the impact. Reputational damage is
very difficult to quantify, especially in its long-term effects and therefore not easy to
insure. While there are insurance products that insure against reputational damage, these
usually only capture a certain aspect of the costs of repairing reputational damage such as
expenses for public relations activities designed to lessen the effect. An organization thus
typically has to bear the consequences itself, which makes it even more important to have
a sound approach to managing reputation risks holistically and from start to finish.
• A reputation risk presents not only potential negative consequences but, if well managed,
an opportunity for improving the organization’s reputation.
While the academic literature and research on reputation has grown substantially over
many years, the related issue of reputation risk identification, analysis and management has only
found attention in more recent times (Davies, 2002; Eccles, Newquist, & Schatz, 2007; Honey,
2009; Larkin, 2003; Talantsev, 2015).With an increasing recognition of the importance of
reputation as a source of corporate success and an important aspect of its overall value (Ross &
Lofthouse, 2005), there has also been a growing realization that it is critical to identify,
proactively understand, and manage the risks that come with events and occurrences that can
tarnish this reputation.
Top managements often realise much too late that an event or occurrence must be
understood and managed as a risk to reputation. A prominent example is the DeepWater Horizon
Oil Spill in the Gulf of Mexico that began on April 20, 2010 with an explosion on a BP operated
oil platform. Since the explosion immediately resulted in the death of a number of workers and

2
 The International Encyclopedia of Strategic Communication IESC

an oil spill, it was at first predominantly thought of, and communicated as, a human tragedy and
an environmental disaster. The initial concern centred on what it would take to deal with
fatalities and stop the leak (the latter mostly framed as a technical challenge).
As the crisis progressed and the environmental impact and broader economic effect on
businesses around the Gulf of Mexico became clearer, the DeepWater Horizon Spill started to
emerge as a legal issue with billion dollar lawsuits filed against BP. However, due to its size,
financial muscle, and ability to dispose of large assets to meet financial obligations, the effects
were damaging but not a threat to BP’s survival.
As the public criticism of BP over the spill mounted, it became a reputational crisis that
made BP very vulnerable. A whole host of stakeholders, vital for its existence, was now
withdrawing their support and collaboration on a broad scale -- resulting in a serious
deterioration in its share price. BP was now suddenly in serious danger of becoming a take-over
target (but ultimately prevailed).
An often-overlooked aspect of a reputation crisis is that it need not lead to long-term
damage of the reputation, but is also an opportunity to improve it (Scott & Walsham, 2005). A
good example is Perrier, a company known for the purity of its mineral water. In 1990, when a
toxic substance was found in 13 water bottles, Perrier reacted very quickly and immediately
recalled 160 million bottles of water around the world. In so doing, Perrier demonstrated its
commitment to living its value of ensuring the purity of its water under duress and under scrutiny
of increased public attention. After a short-term dip in the share price, this incident led to a
strengthening of Perrier’s reputation in the marketplace.
An event that tarnishes the reputation of an organization is caused by an explicit or tacit
expectation that is not being met. Consequently, reputation risk increases with heightened
expectations. It is for this reason that a project to improve the reputation of an organization,
without due regard for its ability and propensity to meet these expectations, is misguided and
likely to be in vain – it will only lead to increased reputation risks. On the one hand, the aim
should rather be to determine the level of collaboration and support that the organization requires
in order to achieve its strategic goals and ensure business continuity. On the other hand, the aim
should be to make sure that the reputation is in line with what the organization can, and will,
deliver on -- given its organizational culture, competencies and capabilities.
Since reputation risks materialise when events indicate to stakeholders that their
expectations are not being met, it is necessary to assess how such an event is likely to alter each
stakeholder’s behaviour and the consequences thereof for the organization. As Talantsev (2015)
points out, this can be vastly different among the ecology of various stakeholders depending on
their perspective, expectations, and interest in the organization.
The main sources of identifying reputation risks in the process of drawing up a risk
register for an organization are the following:
• It is critical to assess the likely reputational effect of previously identified risks in an
organization’s existing risk register. The focus of the risk register is often the financial
impact as a consequence of a risk occurring. However, this only captures a fraction of the
effects of a damaging event. When a risk materializes, this typically also has an effect on
the reputation and an impact on the willingness of stakeholders to continue to support and
collaborate with the organization. (Usually the assessment of the likelihood of these risks
has already been established as they are already part of the formal risk management
process of the organization).

3
 The International Encyclopedia of Strategic Communication IESC

• Ascertaining what is important or critical about an organization among its mission critical
stakeholders in order to retain their continued collaboration and support. For example,
reputations of very well regarded companies rest particularly strongly on their products
and services. Therefore, if any aspect related to products and services falls short as
perceived by existing and potential customers and other stakeholders, the company’s
reputation is tarnished. Reputation risks can be determined by looking at possible events
that will likely lead to stakeholder expectations not being met and then making a
judgement on the likelihood of their occurrence.
• Identifying those aspects of reputation where stakeholder expectations about the
organization are significantly higher than what the organization is likely to deliver. This
can be done, inter alia, by comparing internal and external perceptions on various aspects
of the organization. This serves to expose areas of the reputation where internal
experiences differ from external perceptions. For example, there may be an external
perception that a company is very innovative and therefore many new product features
are to be expected. It is easy to verify the validity of such a perception by asking
employees close to areas of potential innovation about their experience. If there is an
internal experience that there is very little innovation, this shows that the external
expectation for innovation is not justified by the internal reality in the organization. If this
difference becomes significant, it is highly likely that the reputation will eventually be
tarnished in this area.
Beyond the tools of ongoing monitoring of organizational risks, reputation risks are
continually emerging. It is therefore indispensable to be in touch with mission critical
stakeholders on a continual basis, ideally in direct conversation, to identify these risks.
Reputation is a highly complex and multifaceted notion and direct contact is typically the
preferred way to get an in-depth understanding of the reputation an organization has with its
stakeholders. In addition to direct dialogue (or where it is not practical), formal research can be
used as a control to mitigate the risk.
Stakeholder or public perception of risk, whether it is bad employee behaviour; unfair
employment practices; damage to the environment; inconsistency in policies and practices; or
poor governance/ethics, is a constant threat to organizations. Reputation, as portrayed through
visual identity, services, communication and behaviour is built over years by organizations and
at great cost, but can be devastated in a remarkably short time. Being well prepared for what to
do when a reputation risk materializes that is not managed, and turns into a crisis, is critical.

Strategic communication and reputation risk

Communication is the key to crisis management and many (large) organizations do have some
form of crisis, risk, or disaster management program in place. Research however indicates that,
when it comes to managing reputational risk, most organizations consider the communication
element of their crisis management program to be the area where their capabilities are the
weakest. Only 10% regard themselves as being “excellent” at managing communication during
crises; 11% regard themselves as “poor or worse”, and 44% say they are “adequate” (Ross &
Lofthouse, 2005).
When things do go wrong, organizations often lean on the skills of communication
practitioners to reactively communicate with strategic stakeholders such as the media, customers,
employees and their relatives, the community, and others. Some organizations do require their

4
 The International Encyclopedia of Strategic Communication IESC

communication practitioners to be proactive by developing a crisis communication plan to be
able to respond quickly and effectively when reputation risks materialize or disasters hit.
Organizations however benefit immensely in their goal achievement and business
continuity when communication practitioners have strategic communication knowledge and
skills -- for instance, to assess and bring to attention the reputational effects of traditional risks in
the existing risk register. Even more so, if they also do environmental scanning and monitoring
in the external environment to identify trends, emerging and current issues not (yet) recorded in
the organization’s risk register (often because they fall outside the domain of risk managers and
traditional risks) and also assess their reputational risks.
Since there are no issues without stakeholders, strategic communication practitioners
could also interactively map stakeholder concerns, expectations, values, and norms to ascertain
what is important or critical about the organization among its mission critical stakeholders. This
includes identifying those reputation aspects where expectations are significantly higher than
what the organization is likely to deliver. They could also add value by identifying events or
occurrences that are potential reputation risks likely to alter stakeholder behaviour or perceptions
and assess their consequences for the organization – not only the potential negative
consequences if the reputation risks should materialize, but also the opportunities for improving
the organization’s reputation, if well managed.
The governance scandals of the last decade brought the value and vulnerability of their
reputation home to business and other types of organizations, attesting to the fact that
reputational damage can be fatal. On the other hand, organizations that establish a robust
reputation have a strong competitive advantage when it comes to attracting and retaining
customers and talented employees. Although reputation is an asset that needs to be protected and
nurtured, many organizations lack strategies and organizational structures to ensure that this
happens.
It should be the main aim of reputation management in general and reputation risk
management in particular to achieve a favourable and stable reputation that meets the
requirements of business continuity and the attainment of strategic goals. This can be facilitated
by fully integrating strategic communication practices into a cohesive response strategy to ensure
that not only the strategic or operational business event that caused the problem or issue is
corrected, but also that its reputational consequences are addressed in order to prevent or
mitigate a crisis. Organizational boards and management should therefore see to it that the
organization has a comprehensive, holistic risk management program in place that includes
strategic communication practitioners and is aligned with strategic communication best practices.

SEE ALSO: iesc0148; iesc0149; iesc0072; iesc0113; iesc0054; iesc0167; iesc0168; iesc0156;
iesc0181; iesc0049; iesc0047; iesc0122; iesc0157; iesc0158

Note: The author acknowledges the assistance of Benita Steyn in applying Reputation Risk to Strategic
Communication.

References

Davies, D. (2002). Risk management -- Protecting reputation: Reputation risk management --

5
 The International Encyclopedia of Strategic Communication IESC

Dowling, G. (2006). Reputation risk: It is the board's ultimate responsibility. Journal of Business
Strategy, 27(2), 59-68.
Eccles, R. G., Newquist, S. C., & Schatz, R. (2007). Reputation and its risks. Harvard Business
Review, 85(2), 104.
Honey, G. (2009). A short guide to reputation risk. Farnham: Gower Publishing.
Larkin, J. (2003). Strategic reputation risk management. New York: Palgrave Macmillan.
Scott, S. V., & Walsham, G. (2005). Reconceptualizing and managing reputation risk in the
knowledge economy: Toward reputable action. Organization Science, 16(3), 308-322.
Ross, A., & Lofthouse, G. (2005). Reputation: Risk of risks. Fourth report in Global Risk
Briefing series. London: Economist Intelligence Unit.
Talantsev, A. (2015). A systematic approach to reputation risk assessment. In H. Le Thi, T.
Pham Dinh, & N. Nguyen (Eds.), Modelling, computation and optimization in
information systems and management sciences. Advances in intelligent systems and
computing (Vol 360, pp. 461-473). Cham, Switzerland: Springer.
DOI: 10.1007/978-3-319-18167-7_40
Tonello, M. (2007). Reputation risk: A corporate governance perspective. The Conference
Board Research Report No. R-1412-07-WG . Retrieved from [Link]-
[Link]/[Link] or SSRN:
[Link] [Link] Accessed
2016-09-01

Further reading

Aula, P. (2010). Social media, reputation risk and ambient publicity management. Strategy
& Leadership, 38(6), 43-49. doi: 10.1108/10878571011088069
Bebbington, J., Larrinaga, C., & Moneva, J.M. (2008). Corporate social reporting and
reputation risk management. Accounting, Auditing & Accountability Journal, 21(3),
337-361. doi: 10.1108/09513570810863932
EisnerAmper LLP. (2011). Concerns about risks confronting boards. Second Annual Board of
Directors Survey. New York.. Retrieved from [Link]
Accessed 2017-03-20
Reputation Institute. (2013) Making the grade when stakeholders rule. 2013 Annual reputation
leaders survey white paper. Retrieved from: [Link]
Accessed 2017-06-03

Brief Author Bio

Dominik Heil is a lecturer of strategy at Wits Business School, Johannesburg, SA and a program
director at Cranfield School of Management, Cranfield, UK. He is the Chair of ReputationHouse,
South Africa. His research interests include corporate reputation, philosophy of management,
organizational culture, strategy, and leadership.

View publication stats