Executive Report

The Risk Perspective

Managing
Reputational
Risk
to Drive Strategic Performance

Managing
Reputational
Risk
to Drive Strategic
Performance

A RIMS Strategic Risk Management Development Council Report

Author
Andrew Bent, Suncor Energy Inc.
Contributors
Carol Fox, RIMS
Monica Merrifield, YMCA of Greater Toronto
Editor
Morgan ORourke, RIMS
Art Director
Joe Zwielich, RIMS

As the preeminent organization dedicated to advancing the practice of risk

management, RIMS, the Risk Management Society, is a global not-for-profit
organization representing more than 3,500 industrial, service, nonprofit, charitable and government entities throughout the world. Founded in 1950, RIMS
brings networking, professional development and education opportunities to
its membership of more than 11,000 risk management professionals located in
more than 60 countries. For more information on RIMS, visit www.RIMS.org.

2014 Risk and Insurance Management Society, Inc. All rights reserved.

MANAGING REPUTATIONAL RISK TO DRIVE STRATEGIC PERFORMANCE

INTRODUCTION
Historically, risk management has focused on tangible physical
assets, cash flow and profit generation, represented primarily with
financial metrics. Compared to these, reputation may appear to
be a rather nebulous concept too challenging to manage. Alternatively, some may argue that reputation is essentially a matter
of image best managed by public relationsand so does not
justify explicit risk management efforts.
Reputation more recently is viewed as a core strategic risk, as
demonstrated in the results of the 2014 RIMS/Marsh Excellence
in Risk Management Survey XI in which reputation and brand
concerns were ranked in the top 10 by both executives and risk
professionals for the first time in the surveys 11-year history.
In the RIMS Executive Report Understanding Reputational
Risk, managing the reputation of an organization was shown to
be one of the most challenging and pressing concerns of todays
business and community leaders. Details of slip-ups, mistakes,
errors and out-right criminality can now be flashed around the
world in minutes, drastically increasing the scope of the risk
management challenge, while simultaneously decreasing the time
available to mount a defense.
The impact of reputational damage may emerge suddenly, but
often disappears or decreases far more slowly. Reputational crises
tend to be remembered, particularly when they contrast sharply
with desired corporate or industry image. The loss of credibility
associated with a reputational faux pas may have an immediate effect on an organizations share value as competitors race to embed
any new insights first, acting on everything and anything they
learneven if what they learn has no short-term consequences.
Sales may also be impacted as consumers (and members/donors
for nonprofits) exercise their prerogative to abandon your products or brand and choose other options. Collaboration with vendors and partners can easily be hampered by increased requirements to reprove your value as a trusted partner.
With all the potential pitfalls of a poor reputation, how can the
value created by your organizations reputation be protected, or
even enhanced?

USING THE RIMS STRATEGIC

RISK MANAGEMENT
FRAMEWORK FOR
REPUTATIONAL RISKS
Reputational risks cannot sufficiently be handled by the control,
compliance and transfer mechanisms of traditional riskssuch
approaches may solve some of the issuesbut will not suffice
to safeguard or enhance an organizations reputation. That said,
managing reputational risks is closely aligned with and must be
put in context of the handling of other strategic risks. Using the
RIMS Strategic Risk Management Framework (Figure 1) helps
frame the questions that need to be answered:
1. What is the organizations risk appetite and tolerance? What is
the intended impact on reputation of the organizations strategy? How much damage to its reputation is management prepared to take to pursue the strategic goals and objectives? At
times, this tends to be very limited or next to a zero tolerance
approach.
2. What is the timeframe of the strategic plan?
3. What are the potential root causes, that is, what can happen
that would negatively or positively impact the organizations
reputation? Incorporating multiple processes of risk identification can validly be applied based on the organization.
For each relevant and significant reputational risk, what
could be the impact to the organizations reputation if the
alternate future outcomes materialize? Against what reputational impact scale is the risk being assessed? What is the
probability or likelihood that this risk will emerge or dynamically change within the defined timeframe?
4. What, if anything, can be done to control the identified risks
proactively?
5. What might be the impact to the overall risk portfolio and
execution of the organizations strategy?

This executive report will explore how the risks that commonly
contribute to reputational changes can be effectively managed using a focused strategic risk management approach.

Figure 1: RIMS Strategic Risk Management Framework

Strategic objectives, strategic risks and risks arising from plans to meet objectives
Risk appetite and tolerance statements for key risk categories are used to reframe
risks as opportunities and to position control framework
Scenario and stress testing used for:
calculation of investment, resource needs,
capital allocation
revising risk appetite postions and
control actions
guiding strategy adjustments
Source: RIMS Strategic Risk Management Implementation Guide, 2012

2014 Risk and Insurance Management Society, Inc. All rights reserved.

MANAGING REPUTATIONAL RISK TO DRIVE STRATEGIC PERFORMANCE

INTEGRATING REPUTATIONAL
RISK INTO THE SRM
FRAMEWORK
The easiest way to highlight these touch points is to use an example which flows through each element of the framework. The
following notional scenario will help demonstrate how you could
approach the integration of strategic and reputational risk management. One of the greatest challenges in managing reputational
risks is in understanding the many influencers and dimensions
(as discussed in the RIMS Understanding Reputational Risk
executive report) that can impact both our strategic value and our
organizational reputation (Figure 2).
The illustrative situation that follows will touch on a number of
these key reputation dimensions.

THE SITUATION
A number of your competitors in the food service industry have
recently been hit by food contamination issues. Two of these competitors have gone out of business as a result of these problems,
and a third national supplier is currently facing two class action
lawsuits after their products made over 1,000 people sick in five
U.S. states and two Canadian provinces. Your company provides a
similar range of prepared food products as your competitors, and
uses similar food handling techniques to others in the industry.

Key Reputational Dimensions to Consider

u Industry and Media
The industry is shrinking due to the contamination issue.
The market is highly attuned to media reports around
contamination problems. This can have both positive and
negative consequences, depending on the response from
both your own company and its competitors.
u Products and Services
Prepared food products are a staple of many North
American homes, and consumer confidence is built around
consistent product quality and safety.

Figure 2: What Constitutes Reputation?

Source: RIMS, Understanding Reputational Risk, 2013

2014 Risk and Insurance Management Society, Inc. All rights reserved.

MANAGING REPUTATIONAL RISK TO DRIVE STRATEGIC PERFORMANCE

UNTAPPED OPPORTUNITIES
The demise of two (and potentially three) of your major competitors has opened a significant market gap that your company may
have the capacity, resources, skills and capability (know-how) to
fill.
In addition, your company currently uses similar food handling
techniques to others in the industry, there is an ongoing risk that
your organization could be the next food contamination headline if you do not adopt new or improved food hygiene/quality
measures.
With public confidence in prepared food suppliers at an all-time
low, there is also an opportunity to regain that trust and confidence (and corresponding market share) by demonstrating your
commitment to food hygiene and high food preparation standards through new marketing campaigns.

Key Reputational Dimensions to Consider

u Industry and Media
The demise of your competitors opens up potential market
share if you can demonstrate how your products are safe to
the consumer market.
u Governance
Because you use the same processes to handle food that
led to your industry competitors demise, your governance of
these processes may become a critical factor in the prevention of similar incidents.
u Leadership
By positioning your company as a leader in food safety, you
can increase consumer confidence and potentially market
share.

STRATEGY
Within your company, you develop a strategic objective to take
over the 90% of the market share vacated by your former competitors within 18 months. You also commit to gaining and maintaining a consumer confidence rating of 95% confidence in the
safety of your products within six months.
In developing these performance objectives, you identify the following strategic risks and opportunities:
Increasing market share will require the company to acquire
new processing plants, hire new resources and increase production at existing facilities. This could lead to a decrease in the
quality of the food being prepared and increase the possibility
of a food contamination issue.
Any further food contamination issues (either your own or
those of your competitors) are likely to negatively impact public perceptions around the safety of prepared foodstuffs. This
reflects the existing level of community concern following the
earlier incidents.

2014 Risk and Insurance Management Society, Inc. All rights reserved.

The company recognizes that it could control the quality of foodstuffs coming out of its facilities, but is not able to control the
safety of food being provided by its competitors. To this end, it
focuses on improving its own processes, and then using these improvements as a strategic differentiator from its competitors in a
targeted advertising campaign.

Key Reputational Dimensions to Consider

u Industry and Media
By positively leveraging the media reporting of the issues,
your company can demonstrate how its products are safe
to the consumer market, and position what you are doing to
protect food safety and consumer well-being.
u Creditors
The recent product safety issues may cause lenders and
other creditors to want to reduce their exposure in the
prepared foods industry, making it harder to obtain credit
for expansion. At the same time, strategic positioning of
enhanced safety initiatives can contain or reduce cost of
borrowing.
u Performance
Your companys strategy is based on being a supplier of highquality, safe products. Performance against this goal must be
the focus through all stages of the plans development.

RISK APPETITE FRAMEWORK

In order to manage these strategic risks (which would directly
impact the reputation of the company), the following risk appetite and tolerance statements are added to the organizations risk
appetite and tolerance framework:
The acceptable level of contamination present in any raw
foodstuff entering the supply chain shall be less than 25% of
the limit allowed under the most stringent food safety regulations in place in any of the locations the company operates
or supplies.
No contamination is acceptable in foodstuffs leaving any of
the companys production facilities.
Any foodstuff that is not transported to the end retailer in
accordance with the companys safe food handling protocols
shall be dumped without cost to the retailer and replaced in
kind.
Improvements in processes that increase food safety and reduce
waste by at least 5% will result in company-wide incentive
payments equal to 2.5% of the total savings realized.
The addition of these statements is intended to remove, or drastically reduce the potential for contaminated foodstuffs leaving the
companys production facilities. It also empowers line managers,
quality control staff and even the companys truck drivers to refuse to release products that may not meet the highest quality
standards without fear of retribution or censure.

MANAGING REPUTATIONAL RISK TO DRIVE STRATEGIC PERFORMANCE

The company creates a reputational risk impact scale linked to

media attention and timeframes to further assess the potential
impacts to its reputation:
Insignificant: Short-lived, local attention with limited or no
press coverage, not commonly known among the public
Small: Regional attention and some press coverage for up to
four weeks, known (but soon forgotten) by the public

These changes also mean that the number of quality control

checks that would be performed on products leaving its facilities
will have to increase. This operational change creates a natural
tension with the companys desire to expand production, and is
one of the key elements that needs to be examined in later stresstesting.

Key Reputational Dimensions to Consider

Medium: National attention and press coverage for no more

than two months. Known and recognized by general public.

u Workplace

Severe: Broad press and media attention in multiple countries leading to wide discussion in social media and attention
for several months. Some politicians comment on the incident. Requires robust communications plan/strategy with
specialized resources to manage properly.

u Governance

Devastating: Potential or actual global press attention and

discussion on social media. Consistent and repetitive frontpage disclosures. Directly seen actions and boycotts from
parts of the public, legislative or regulatory changes may be
invoked. Requires extensive communication strategy with
full-time/dedicated crisis communication and PR specialists.
For organizational prioritization purposes it becomes apparent that the chosen scale of reputational risks should be aligned
with the companys existing financial scale. This helps to ensure
that reputational loss can be consistently compared to other loss
mechanisms, such as the loss of a manufacturing unit.

Key Reputational Dimensions to Consider

u Regulators
Engaging with regulators in all markets where the companys
products are sold, and then setting lower acceptable limits
than are required will help to build trust and confidence with
food safety inspectors.
u External Partners
Accepting the no-cost dumping of any goods that do not
meet safe handling protocols provides an incentive to your
retail partners to conform to your risk tolerance controls.
u Products/Services
By focusing (and incentivising) the entire company on
improving food safety, new opportunities can be surfaced to
improve processes as well as products.

RISK CONTROL FRAMEWORK

The additions to the risk appetite framework drive changes in
the organizations risk control framework. Product safety quality
controls are now being driven back along the supply chain, with
quality checks being conducted on incoming materials before
they enter the production system. By adopting a uniform level of
acceptable raw food contamination, the company is able to simplify and streamline their inspection processeven if this means
applying a much lower level than they are required to by law.

2014 Risk and Insurance Management Society, Inc. All rights reserved.

By clearly articulating how product safety was to be managed by all members of the organization, the company is able
to engage all of its employees in protecting its reputation.
By clearly articulating how product safety was to be governed, the company imposes constraints on its own plans
to expandeffectively meaning that safety could not be
compromised by expansion.

EMERGING AND
DYNAMIC RISKS
The almost unprecedented level of food contamination and product recalls represents an emerging risk not only for the company,
but for the entire industry. As a result, the company recognizes
that regulatory reform and increased oversight could emerge as
significant risk exposures. As the nature of any regulatory changes
are not known, the company institutes a process to monitor state,
provincial and federal food regulations so that it has an opportunity to provide input into any forthcoming changes. It also steps
up its stakeholder engagement efforts with food administration
officials at all levels to demonstrate that the industry is able to
regulate itself without additional oversight.
The company may also recognize that a critical dynamic risk may
emerge in the form of new or mutated contaminants that might
not be picked up by existing quality control technology. These
contaminants could undo all the hard work put into controlling
traditional conditions and undermine the companys message
that it is a provider of safe food products. To address this issue, the
company may want to increase its R&D investment and capability to research emerging threats and review the technologies that
could be used to identify and potentially mitigate them. It might
also update its emergency response plans to include previously
unknown contaminants as a trigger for the plan to be activated.

Key Reputational Dimensions to Consider

u Regulators
Changes in regulations may impose new or onerous obligations on the company. This may hamper its ability to operate
and expand in certain markets, or result in unexpected
financial costs.
u Innovation
By recognizing the potential changes in the food safety
environment, the company can support R&D efforts that help
it to keep ahead of the contamination curve.

MANAGING REPUTATIONAL RISK TO DRIVE STRATEGIC PERFORMANCE

INTEGRATED ENTERPRISE
RISK PROFILE
Following the companys strategic and emerging risk analysis efforts, identified risks and their subsequent treatment plans should
be added into the enterprise risk profile. The risk profile can
then be leveraged to drive any necessary changes in operational
processes and procedures, and ensure that responsibility for its
implementation is assigned to the appropriate level(s) within the
organization. This also helps to ensure that managing food contamination risks are a part of every business units key responsibilities.

SCENARIO AND
STRESS TESTING
Following the changes to the organizations risk profile and control frameworks, stress testing can be performed to determine
the cost-benefit break point in the new operational model. This
testing looks closely at the level of exit screening that is required
to ensure no contaminated products leave a production facility,
and balances this against the desire to expand rapidly over the
following 18 months. Modelling test results indicate that 100%
compliance is possible, but only if the strategic goal to obtain
90% of the vacated market share was lowered to 70% over the
next 18 months. After careful deliberation by the board of directors, these results are acceptable after it is determined that the
same stress testing illustrated that a single contamination problem
would likely result in a loss of 20% of market share with a recovery period of at least 36 months.

Consideration should always be given to those risks that arise

from outside your sphere of influence, but your response to them
should focus on those things that your organization can control.
For example, by differentiating your organization from a poorer
performing competitor (or partner) it may be possible to drive
increased market share for relatively limited cost. When considering these points of differentiation, it can be helpful to group
these risks in two ways:
Identify the things that did not occur (and should have
occurred)
Identify the things that occurred (and should not have
occurred)
By then considering the source of these two groups (your own
actions, and those of others outside your direct control), it is
possible to more rapidly identify those risks that you can control
(such as your own product safety), and those which you cannot
but need to be prepared to respond to (such as your competitors
lack of product safety). The outputs of this analysis (shown in
Figure 3 below) can also be transferred into a SWOT matrix for
further analysis if required.
Figure 3: Sources and Types of Reputational Risk

DID NOT DO

DID DO

u C ustomer misuse of
products

u Malicious attacks

...and should have

OTHERS

Outside your
control

u R eckless behavior

...and shouldnt have

u Industrial espionage
u Activist movements

Key Reputational Dimensions to Consider

u Performance
Stress testing provides the company with the
opportunity to understand how different levels of
performance (and food safety) impacts its plans and
financial performance.
u Leadership
The ultimate decision on what is more importantfood
safety or financial growthis an important leadership
decision that reflected the need to balance consumer
expectations against shareholder desires.

SOURCES OF
REPUTATIONAL RISK
In this example we have shown that the risk exposures that can
impact your reputation are not always your own and they may
instead be a result of industry failures or simply one mistake on
the part of a competitor. These potential risks can also present
significant opportunities (such as growing market share) if managed effectively and thoughtfully.

2014 Risk and Insurance Management Society, Inc. All rights reserved.

YOU

Including direct
partners

uA
 dequate compliance
programs

u Compliance breaches

uH
 ealth and safety
programs

u Illegal behavior

u E nvironmental
protection guidance

u Deceptive marketing

u Dishonorable conduct

The development of contingency plans should also focus not only

on physical response to the problem, but also on the communication messaging that best supports those activities and reduces the
level of negative perception that may occur. Finally, the example
demonstrates that a structured approach to testing reputational
risk factors can also provide meaningful insights to strategic decision makers as they set and adjust the goals and objectives of the
organization.

MANAGING REPUTATIONAL RISK TO DRIVE STRATEGIC PERFORMANCE

MANAGING REPUTATIONAL
RISK AS A MEANS OF
PROTECTING AND
ENHANCING VALUE
When faced with an incident that negatively impacts your reputation, your organization must be able to act quickly, effectively
and initiate the right solution. Having a pre-defined team, with
pre-defined frames of reference, the right skills from across the
enterprise and the authority to act is pivotal to the handling of
reputational risks. In some instances, a response must be enacted
and visible worldwide within hours (or even less).
For this reason organizations should consider forming cross-functional action teams, and have these teams conduct fire drills
periodically to test their efficiency, action effectiveness and preparedness response time.
Once the action teams are formed, developing and working
through sets of plausible risk scenarios prior to their potential
emergence readies the participants for the various reputation
building, defending and repairing efforts and decisions needed
to protect and enhance organizational value. These scenario exercises (which may already be part of your organizations strategic
risk management framework) should include potential issues in
precise enough detail to give useful guidance on expected behaviours, without being so prescriptive that they hamper flexibility.
Military organizations are prime examples of these activities
they practice and rehearse routine tasks repeatedly to ensure that
in the middle of a crisis they are able to perform them consistently, to the required standard, with minimal delay, yet incorporating situational adaptability. This approach can be applied by
organizations looking to manage their reputational risk exposures
as well. Figure 4 illustrates how an organization can unlock reputational value while anticipating, defending/repairing and closing
reputational gaps.

The pre-emptive probability reduction efforts of behaving well,

supporting the community, being open and honest in your communications, and driving a stable and profitable business that
delivers what has been promised to stakeholders actually serve to
enhance ones reputation in strengthening strategic performance.
These combined efforts of value protection and value development help to build the good will and consumer support leaders will need to not only weather a reputational crisis they may
face in the future, but also grow organizational value for sustained
performance.

CONCLUSION
English writer Ernest Bramah warned, A reputation for a thousand years may depend upon the conduct of a single moment.
No organization is impervious if its stakeholders, or society at
large, believe it is behaving in ways contrary to expectations.
Leaving reputational risk to chance carries its own consequences.
Executives may be surprised when the public reacts negatively to
a perceived transgression. Shareholders, members, donors and
sponsors may withdraw support, all of which adversely affect the
organizations enterprise value and its future. On the other hand,
organizations that manage reputational risk well are able to bolster consumer confidence, achieve competitive advantages, gain
market share and, ultimately, improve overall results.
In this report, we have suggested ways that organizations might
actively manage reputational risks in the context of a focused
strategic risk management framework. We acknowledge that
there are other ways organizations manage reputational risks,
such as risk transfer mechanisms and crisis management, which
are intended to repair reputational damage. By taking a broader,
strategic approach to managing reputational risk, however,
insightful risk professionals also can help build reputational value
and drive strategic performance.


p

Figure 4: Framework for Managing Reputational Risks

Source: RIMS, Understanding Reputational Risk, 2013. Adapted from M. Merrifield, YMCA of Greater Toronto

2014 Risk and Insurance Management Society, Inc. All rights reserved.