It is impossible to know whether Tony Hayward, the chief executive of BP; Akio Toyoda, the Toyota boss; or Mark Hurd, the head of Hewlett-Packard, woke up on the days in the last year that their companies were plunged into crisis with reputational risk on their minds. But they almost certainly went to bed thinking about it.
Read the complete Corporate Risk report .
It was those companies' reputations that were most lastingly damaged by the explosion of BP's oil rig in the Gulf of Mexico, the recall of Toyota vehicles over concerns about sticky accelerator pedals and the revelations about Mr. Hurd's relationship with a contractor. As the legendary investor Warren Buffet once said, it can take 20 years to build a reputation and only five minutes to ruin it.
To a large extent, many companies are defined by their reputations. A good reputation and a strong brand allow companies to stand out in crowded markets. Peter Anthonissen, founder of Anthonissen & Associates, a firm advising on reputation management and crisis communication, says: "A company's reputation is, without a doubt, its most precious commodity."
Reputational risk is therefore one of the most potent dangers that any company faces. It is also, unfortunately, one of the most elusive. While it is relatively easy to talk about reputation risk in the abstract, it is far harder to protect against it in practice. A recent survey conducted by Airmic, the association for insurance and risk managers, frames the conundrum well. Of those who took part in the poll, 80% claimed that reputational risk is their top concern. However, only 43% believed that they have formal and well-managed plans in place to tackle it.
The problem is clear: It is easy to identify and measure the impact of the damage wrought to a reputation after a crisis. But it is far more difficult to predict when and – more importantly – how a reputation might be tarnished in the future.
This is not to say that companies aren't concerned with their reputations and their brands. All but the very smallest companies will employ phalanxes of internal and external public relations executives, marketing managers and advertising gurus. But, for the most part, they will be focusing on maximizing a company's reputation and brand for the good times, using them to increase awareness and ultimately sales. Very few will spend time thinking about how to insulate a brand for when disaster strikes.
Anthony Fitzsimmons, chairman of Reputability, a consultancy that provides reputation and crisis risk management, believes that up to 40% of the value of a vibrant company can be attributed to its reputation. But he argues that traditional approaches to risk management fail to adequately protect this vital asset. "Even state-of-the-art risk management misses large and important risks to reputation," says Mr. Fitzsimmons.
Part of the reason for this is that reputation is such a nebulous term. It doesn't explicitly appear on balance sheets and therefore is hard to quantify within risk management frameworks that require measurable inputs. John Hurrell, the chief executive of Airmic, says: "It's hard to assign a value to reputation and hard to manage, so often it's easier for organizations to leave well alone."
One thing that companies can do, is to be prepared for when trouble does strike so that they are able to react quickly and effectively. "When something goes wrong it becomes very important for senior managers to respond rapidly to deal with the needs and expectations of stakeholders who are essential to their licence to operate," says Judy Larkin of specialist consultancy Risk Principals. "When there is a delay in response it can be incredibly damaging."
Ms. Larkin says that both BP and Toyota were slow off the mark to communicate what they were going to do to fix their problems. "When there's a delay, the information gap gets filled by speculation or allegations by others outside the organization," she says.
In a world of 24-hour media, companies need to be agile and quick to respond. Mr. Anthonissen says the onus should be on communicating frequently and openly; companies need to be clear about how they plan to resolve the situation and to be honest if they don't have all the answers.
But reputational risk management is about far more than fighting fires. A company's reputation is established through the implicit and explicit promises that it makes to a variety of communities, be they investors, customers, suppliers, employees, regulators, or the media.
"Traditional risk maps often work from the bottom up whereas a reputation risk map should look at the other end of the telescope, starting with stakeholder impact," says Mr. Hurrell. "You need to analyze the impact of risks for various groups of stakeholders and that forces you to ask questions you could otherwise ignore."
To protect its reputation a company must first find out what those stakeholders expect of it and then ensure that performance goals are set to ensure those expectations are met.
That, of course, is easier said than done. Such a strategy can only ever be led from the top not least because it may require the careful management of conflicting expectations. Mr. Anthonissen says: "It's essential that someone on the board of directors or within the executive committee is responsible for reputation management."
Only a chief executive or chairman of a company will have a broad enough overview. It can be difficult for more junior members of an organization to recognize the impact of particular operational risks to reputation. Traditional risk management approaches can often filter out these risks before they reach a senior level.
"One perception of BP is that the board didn't know what was going on in the engine room," says Mr. Fitzsimmons. "If that is true, it is not surprising. It regularly emerges from large organizations that staff at lower levels have all kinds of information about what is going on but don't pass the information to their bosses."
Many risk professionals believe that the strength of a company's reputation is its own best protection. "The challenge is to build strong foundations that will make a reputation sustainable through bad times as well as good," says Mr. Fitzsimmons. "Culture, behavior and leadership are key."
It is important for a company to build up a stockpile of goodwill for it to draw on if disaster strikes. In 1999, Belgium banned the sale of Coca-Cola drinks following an outbreak of poisoning cases. Similar bans followed elsewhere in Europe.
Although the crisis raised questions about whether Coca-Cola would operate in Western Europe again, the company was able to recover to the point where it had the highest drink sales in the region the following year.
"It had established trust with stakeholders over a long period of time and was able to cash in on that when it needed to," says Mr. Anthonissen. "People rightly gave Coca-Cola the benefit of the doubt because of the goodwill and trusted reputation it had built up."
However, the changes required to build up goodwill could conceivably have a negative impact on margin.
Lucy Neville-Rolfe, a board member and director of corporate affairs at Tesco, says: "It's about culture more than anything else. We need to focus on reputation specifically as well as in every area of the business which can have a bearing on that reputation. There is a big overlap with our core risks. Every area of our business has a bearing on reputation."
But it can also be difficult to inculcate a reputation-focussed culture across an organization. Nicky Harvey, head of risk management at Christie's auction house, says: "We have a code of conduct which underpins everything that we do. It's a challenge to ensure everyone is on board right across the organization but it's critical to managing our reputation."
Reputational management is still too often something that companies feel they should do rather than something that they want to do. A good reputation is hard to quantify and may actually get in the way of delivering short-term profits or cutting costs.
Few investors ask about reputation at the annual general meeting. Until, that is, something goes horribly wrong.
Ms. Lux is a writer based in London. She can be reached at email@example.com.