Newsletters
Risk Central
Digital Edition
Risk Insider: Elizabeth Carmichael
Reputational Risk – What Is It? Can We Manage It?
Elizabeth Carmichael is president of Carmichael Associates LLC. She formerly was director of compliance and risk management for Five Colleges Inc. She can be reached at [email protected].
Reputational risk is a category unto itself in the enterprise risk management basket. Everyone knows what it means — it’s common sense, right?
Something bad happens and your company or institution gets trashed in the press or on social media. There could be some fallout; sometimes it happens immediately and sometimes the fallout takes years to emerge.
As risk managers, we may often feel there is nothing we can do to address it until it happens — after all, how can we predict what the public and media will do? But, the more important questions are, why does it happen and how can we prevent it?
I would like to posit the idea that most reputational risks arise when the behavior or actions of the company or institution (or their employees) is not aligned with either its stated values or what the public thinks its values ought to be.
The solution is therefore quite simple: Practice what you preach. Follow the rules and play fairly.
The greater the incongruence between what the organization says it will do vs. what happens, the greater the reputational risk and likely fallout.
If an organization consistently and completely aligns its actions with its stated or expected values, even a wrongful act by a rogue employee is mitigated when the organization can demonstrate that the act was unprecedented and the employee was truly a loose cannon.
If only it were as easy as it is simple. I’ll illustrate using an example from higher education.
The public and congress believe that universities should keep students safe and that they should fight sex discrimination. Most institutions have statements of non-discrimination based on gender and statements on harassment prevention.
In addition, the Higher Education Act, Title IX and its subsequent and related reenactments, revisions, regulations and guidance require that institutions not discriminate based on sex and stipulate how they must respond to reports of sexual assault or harassment.
Failure on the part of many institutions to do this has resulted in more than 280 investigations by regulators, lower admission applications for some institutions and increased regulation for the industry overall.
This often boils down to compliance. Baylor University has been in the news quite recently over this — their policies said that they would responsibly investigate and manage claims of sexual assault filed by students.
But when allegations involved star athletes, they backed down, prevented their Title IX coordinator from doing her job and protected the athletes instead of the victims. The scandal (reputational risk) has resulted in the ousting of coaches, athletes and even the president of the university, as well as multiple claims and litigation.
Root cause: the institution’s actions did not align with their stated policies and values.
The greater the incongruence between what the organization says it will do vs. what happens, the greater the reputational risk and likely fallout. Compliance gaps in organizations are the harbingers of reputational risk as well as compliance risk.
Risk managers need to be aware of these gaps and build them into the ERM process for the success and reputation of our organizations.
