Just what is “reputation risk”?

Ask the pharmaceutical industry CEO with rumors of tainted drugs. Or the fast food CEO whose customer has complained of finding an appendage in the chili. Or the religious organization with allegations of clergy abuse.

Or better yet, ask the banker whose institution has announced that there has been a large-scale theft of customer data, or a significant embezzlement, or that the bank is the subject of an agency enforcement action.

Reputation risk is the “goodwill” line on your institution’s balance sheet. It is the difference between the cash liquidation value of your organizational franchise and its value as a credible, viable institution. And it is easily the most vulnerable of all your assets. It reflects the "public perception" of your institution, and as the saying goes, perception can and often does become reality.

Unfortunately, many unpredictable events are beyond your ability to control, particularly once they become fodder for the media. Even if rumors and allegations are unfounded and untrue, retractions seldom appear on the front page and the damage has been done.

There is arguably no other industry in the world so vulnerable to reputation risk. Customers trust banks with their financial lives. They want to deal with safe, sound, and healthy institutions, and will quickly exercise their options to change banks if concerns arise. Even a slightly tarnished reputation can result in significant problems for the institution. The recent financial institution issues created by media hype and misunderstanding of the “subprime mortgage” situation, and the resulting impact on banking institutions, is unfortunately in itself a prime illustration of how reputation risk issues can create a self-fulfilling prophecy.

So how does a bank deal proactively to address reputation risk?

First and foremost, the best defense is a good offense. Institutions must implement and enforce effective control and oversight mechanisms, and conduct their activities in a manner which will instill confidence in the banks' constituencies and reflect ongoing credibility of the institution and its management and board. Boards and management must aggressively avoid potential conflicts, and anything which could result in even the appearance of impropriety.

While strong organizational values and ethics, coupled with good management and active board oversight and governance, should help to minimize opportunities for issues which give rise to reputation risk concerns, the fact is that problems will still arise in any business and advance preparation for responding is another important element of preparedness. Assembling a team to address reputation risk issues after they have become public is likely too late to effectively respond.

Particularly in the case of publicly-disclosed bank problems and enforcement actions, the “team” must anticipate and identify the likely responses of the institutions’ constituencies and be prepared to preempt and to respond. Failure to do so can mean the end of the institution as an independent entity. Employees, communities, shareholders, and customers are impacted by the news (or rumors) of bank “problems” and each group tends to react in a fairly predictable fashion given their particular interests.

Since it is impossible to engage in business in a risk-free environment, institutions should be ready to deal with issues impacting their public image in a preemptive, aggressive, and positive fashion. When problems arise, the institution must speak clearly and with one voice, and must take care to control the flow of half-truths and rumors that can have a devastating impact on the institution and its constituencies. The board in particular must take control of the situation to prevent the situation from escalating.

Establishing an informal board and management "emergency response team" before problems arise (and particularly before they become public) is an important element of preparation for the inevitable kinds of issues that can trigger reputation risk concerns. In addition, identifying appropriate experienced professionals to assist in responding to issues that result in reputation risk exposure is critical.

Reputation risk is more difficult to prepare for, and more difficult to respond to, than other operational risks faced by banks and other businesses. It is often beyond the control of the institution and its board and management, and is not capable of ready quantification like credit risk or other tangible risks faced by the institution in the normal course of business. The practical operating implications of reputation risk problems on banks are too numerous to list, but include increased funding costs, reduced funding availability, reduced stock valuation, increased premiums, reduced loan business, equity and debt downgrades, employee distraction and loss, increased regulatory oversight, shareholder angst and pressure, increased exposure to shareholder claims, increased exposure to unwanted acquisition overtures, customer concern and deposit loss, and a general circling of sharks.

Like a tsunami, the issues that lead to and create reputation risk are sometimes visible on the horizon, but may not be readily identified or give extensive warning. Unfortunately, the actual nature, size, and impact of the issues may not be known until it is too late. The unpredictable fast food "finger in the chili" situation is not the usual scenario however, and good management and board oversight can minimize the likelihood of unforeseen problems giving rise to reputation risk. Hence the focus on "governance," organizational ethics, "controls," and identification and disclosure of "off-balance sheet" risk by regulatory and rating agencies.

A strong control environment and "early-warning system," with accountability at all levels, facilitated and reinforced in a top-down fashion by management and the board, serves to minimize opportunities for surprises which result in reputation risk concerns. Strong controls and an effective risk management system also serve to maximize the ability of institutions to identify and to respond promptly and effectively to potential problem issues before they fester and grow.

Reputation risk concerns can arise suddenly despite the best well-intended efforts of all involved, and are arguably the most dangerous and uncontrollable issues faced by financial institutions. Often the underlying issues giving rise to institutional reputation risk are all too clear with 20-20 hindsight, and a proactive (and preemptive) approach to problem-solving and risk management can sometimes help avoid much more serious problems down the road.

Institutions owe it to their shareholders, depositors, employees, communities, and other stakeholders to minimize opportunities for such issues to exist. And management and boards must be prepared to respond rapidly, consistently, confidently, and effectively to reputation issues once they arise.