reputational risk Archives | Bryan E. Hopkins

Damages caused by reputational or brand risk events are not tied to just domestic related issues. Approximately half of the executives that Kroll polled for its recent Global Fraud Report opined that their companies are at risk of vendor, supplier, or procurement fraud tied to overseas expansion. Many of those surveyed felt their companies were highly or moderately vulnerable to corruption and bribery risks which can of course lead to reputational risk or loss of brand as well as FCPA investigations and fines. According to the respondents in the Kroll Global Fraud Report, ethics and integrity (or lack thereof) was the major cause of reputational risk.

The reputational risk caused by supply chain issues can escalate out of control unless properly managed. Loss of brand value can happen quickly if a fraudulent event becomes public or if a bribery scandal is publicized in the media. Just look at the some of the crisis that happened over the last decade. Many people have been affected (some have died) because of the crises or mega-crises that have happened. Many of them also included reputational risks as well. Examples include:

The financial and housing collapse and major recession of 2008

Toyota implicated in recalls because of brake issues

Major Banks having their credit card customers’ names stolen by computer hackers

Volkswagen was implicated in a pollution emissions scandal

Target’s customers had personal data stolen due to lax security systems. Over 40 million
Credit and debit card customers effected

Sony Pictures- Sony as well as its employees had confidential information stolen

As you can see from the examples above, there are numerous kinds of crises that a company should be prepared to handle, especially in an international context. Among them are financial crises, natural disasters including pandemics, product failures, workplace violence, cyber-attack, or hacking, and, of course, terrorism. However, most if not all have resulted in serious reputational crisis which also led to legal risk.

It is undisputable that a major crisis can pose serious threats to a company, and, therefore, the crisis must be managed. Crises can result in (a) government fines, (b) loss of retailer confidence, (c) loss of investor confidence, (d) loss of employee confidence, and (e) massive litigation, including class actions. In other words, the end of the company! Crises also result in reputational risks or damage to the company’s brand which may have a greater effect on the company’s bottom line than the damage caused by the original crisis itself.

The problem facing any risk manager or in-house counsel is that the media in today’s society has become very anti-business. As this anti-business culture of attack has gotten worse over the last twenty years, a crisis can no longer be handled by a simple PR or marketing statement. A full-fledged crisis management operation must be put in place. Damage control is now a very serious matter for any potential crisis, no matter how small. Today, more and more companies have to consider issues that negatively affect the company’s brand and how best to counteract them.

Key considerations when considering potential brand or reputational risk caused by ethical or fraudulent behavior within the company or within the company’s supply chain:

-Compliance- does the Company have a compliance program and is it up to date?
-Compliance- does the Compliance program and code of conduct promote an ethical culture within the company?
-Supply Chain- has the Company’s vendors involved in the supply chain been vetted? Do they follow the Company’s code of conduct? Do they have compliance programs?
-Are there sound corporate governance and control processes in place?

Major considerations for handling brand risk once a crisis has started includes:

-Is there a Crisis Management Plan in place to handle brand risk once a crisis starts?
-Does the Company have an effective internal investigation process in place that may shorten the time taken to discover internal risks and mitigate reputational harm?
-Have the appropriate decision makers been trained to handle PR and media issues once a crisis has occurred?
-Does the Company have appropriate 3rd party consultants, including risk management companies and media crisis companies in place to help mitigate reputational/brand risk once a crisis event takes place?
-Does the Company have an appropriate international Crisis Management Plan in place in case the crisis is international in scope?

Companies must realize that there are many risks associated with doing business internationally as well as domestically. Brand or reputational risk is very serious and can lead to the loss of money or even the destruction of a company unless the right steps to mitigate or prevent brand risk are in place. So when considering what risks should be addressed on a regular basis, remember reputational risk should be of primary importance.

To properly manage civil litigation, especially in the United States, companies need to implement LRM strategies and processes by use of an in-house Law Department that is capable of overseeing or managing outside litigation. Depending on the legal exposure of a company, it can be a full-time job. This management function will be key in properly coordinating litigation to avoid excessive costs, duplication of effort, and minimization of disruptions to a company’s business, as well as setting an effective trial strategy.

What many foreign companies doing business in the United States fail to appreciate is that an outside litigation lawyer does not necessarily have the company’s best interests in mind during litigation. Litigators want to win. Sometimes the desire to win is not in the best interests of the company. Many companies have paid a great deal of money to litigate a case when a resolution to the dispute was available had the parties tried to actively settle the matter. Remember, a trial lawyer’s business and primary goal is to win- not to settle.

An in-house legal manager, representing the company’s best interests, can help facilitate settlement once a legal risk assessment as to the validity, cost, and expense of litigation is made. In fact, during trial, a settlement is still possible and can be facilitated by in-house counsel. Therefore, the Law Department should maintain control and oversight of any litigation. A LRM program can be very helpful in managing the legal risk process as well as providing litigation oversight. Remember, litigation can result in a variety of negative issues such as:

• Loss of time.
• Expense.
• Potential interruption of business.
• The cost and expense of business interruption.
• Potential bad or negative publicity.
• Negative impact on the company’s brand image
• Potential loss of reputation.

As companies facing U.S. litigation are often exposed to excessive fees and costs, massive business disruption, lengthy litigation, and the unpredictability of the jury system, efficient management of the litigation process is necessary. Though, obviously, outside litigation counsel is necessary in most cases, an in-house Law Department can save the company great sums of money by managing the litigation process. Such management involves the assessment, management, and potential transfer of risk through various LRM strategies, including:

-Effective coordination of legal defense efforts in order for the company to avoid duplication of costs and effort from case to case
-Coordination of witnesses, answers and interrogatory responses, documents, and depositions
-Acting as the central site for all facts, positions, decisions on legal issues, and motions
-Development, implementation, and coordination of a defense plan

As part of an overall LRM program, a company’s Law Department must implement processes to control, reduce, and manage outside legal fees and costs. By utilizing legal risk management tools, a Law Department can proactively reduce legal fees and costs.

The financial and housing collapse and major recession of 2008

Toyota implicated in recalls because of brake issues

Major Banks having their credit card customers’ names stolen by computer hackers

Volkswagen was implicated in a pollution emissions scandal

Target’s customers had personal data stolen due to lax security systems. Over 40 million
Credit and debit card customers effected

Sony Pictures- Sony as well as its employees had confidential information stolen

When considering brand risk issues during a crisis ask the following questions:
• Is there a Crisis Management Plan in place to handle brand risk once a crisis starts?
• Does the Company have an effective internal investigation process in place that may shorten the time taken to discover internal risks and mitigate reputational harm?
• Has the appropriate decision makers been trained to handle PR and media issues once a crisis has occurred?
• Does the Company have appropriate 3rd party consultants, including risk management companies and media crisis companies in place to help mitigate reputational/brand risk once a crisis event takes place?
• Does the Company have an appropriate international Crisis Management Plan in place in case the crisis is international in scope?

In the past I have commented on crisis management and the tools needed to handle such crisis in today’s business environment. Of course what companies are finding out is that international crisis are harder to handle than domestic ones. Why? In today’s world, many companies do business internationally. Because of international considerations, an international crisis is harder to manage than a domestic crisis. As it is more complex, companies caught up in an international crisis have to pay more attention to international, cultural, and communication issues than they would in a purely domestic scenario. Cross-border crisis management has become very important. Therefore, an international crisis requires a number of steps, including:

• Planning for an international crisis
• Appointing an international crisis manager
• Establishment of an international crisis management team
• Knowledge of foreign situation and its impact
• Communications
• Cross-border management of the crisis

The principle focus of any crisis management strategy, especially in an international context, is communications. All crisis management plans call for effective crisis communications, which many times are not always executed. Inadequate or failed communications lead to bad publicity, unhappy stakeholders, and potential disaster. An effective crisis communication strategy is necessary for any international crisis. A number of companies failed to defuse an international crisis because of poor communications. A number of processes are need to implement an effective crisis communication strategy to manage an international crisis, including:

1. Creation of the crisis communication team.

2. Identify key spokespersons who will speak for the organization. Who are they? What are their roles?

3. Training on cultural issues, if the crisis involves other cultures.

4. Establishment of communication procedures and protocols.

5. Identify key messages to communicate to key stakeholders and groups.

6. Has a budget been approved for the crisis?

Though companies try and resolve the crisis at hand and spend significant sums of money to do so, if they fail to properly communicate to stakeholders such as the media and the public, they in effect have lost control of the situation and can expect outrage and consumer dissatisfaction to such an extent that the very existence of the company may be threatened. So remember, a company doing business internationally has to plan for an eventual crisis which may pose a threat to the company. If it fails to handle communications properly, it faces not only a potential loss of business but a negative impact on its brand and reputation.

The other day I had lunch with a friend who was lamenting the fact his company’s sales team continued to ink deals without any regard for risk. When he asked them why they continued to do so, the reply was “that’s the way we have always done things.” Unfortunately, many companies continue to plod along doing business without regards to risk. In fact, many companies fail to look at operational risk which can lead to disaster down the road. In order for a company to succeed it not only has to a sustainable business model but it has to constantly review its risk processes. After all, what happens when the current business model does not work anymore? What happens when the risks outweigh the benefits of continued standard corporate operations? Maybe it’s time to re-examine your risk management processes. Do they really work?

When talking to your staff or to other departments, how often have you heard the phrase “That the way we have always done things.” Just because corporate processes have been done one way doesn’t mean that the best way or even in todays’ fast changing world- the right way. Even after 2008 many companies continued to use the failed metrics that got them into trouble in the first place. Even the credit markets haven’t changed as much as you would think after 2008. Why?

I truly believe that once processes are created in a corporate or bureaucratic environment, it is as if the processes have been set in stone. They are very hard to change. Even if the world around the company has changed. It is human nature to accept what has been done in the past. Few people want to “rock the boat” even if the proverbial boat is actually sinking. Companies get into real trouble because of this. What happens if the company’s business model actually is out of date or its business plan is no longer viable? Just because it worked in the past doesn’t mean it will work in the future.

I therefore caution everyone not to blindly accept the current risk management processes in place. Risk managers as well as in house counsel and other managers should be challenging risk management metrics on a regular basis. Counsel should be auditing departments on a regular basis. Does that compliance program really work? Maybe it did 5 years ago. But what about today?
Remember, if local or national laws have changed maybe the current processes are out of date. If the products that your company manufactures or the services it provides have changed maybe the internal processes surrounding the review of those products and services are out of date. What about the current social environment? When reviewing your current product liability review processes have you factored in the new risks created by the Internet of all Things? These risks are real. Are you ready for them? Does your current business model still work or is it outdated? What about data privacy laws?

It is a fundamental truth that all things change. Of course, some things change faster than others. Regardless, don’t rely on your old or standard risk management processes to continue to provide the same level of comfort they did in the past. Continue to review and to modify them if necessary. And don’t think that just because “that's the way things are done” your company should continue to operate as usual.

Of all the risks facing companies in today’s business world, reputational risk is one of the most serious. Reputational risk can not only damage a company’s brand, but can even lead to the demise of the company. It is of primary importance to executives, in-house counsel and risk managers in many multinational companies and is seen as one of the top risks a company may face. In fact, in Aon’s recent Global Risk Management Survey, it is one of the top ten risks that are of concern to companies. Deloitte surveyed companies as well and found out that the majority of companies it surveyed rated reputational risk as more important than strategic risk. Many of those surveyed acknowledged they had suffered a brand risk or reputational risk event that resulted in a loss of brand value or a loss of earnings.
Damages caused by reputational or brand risk events are not tied to just domestic related issues. Approximately half of the executives that Kroll polled for its recent Global Fraud Report opined that their companies are at risk of vendor, supplier, or procurement fraud tied to overseas expansion. Many of those surveyed felt their companies were highly or moderately vulnerable to corruption and bribery risks which can of course lead to reputational risk or loss of brand as well as FCPA investigations and fines. According to the respondents in the Kroll Global Fraud Report, ethics and integrity (or lack thereof) was the major cause of reputational risk.
The reputational risk caused by supply chain issues can escalate out of control unless properly managed. Loss of brand value can happen quickly if a fraudulent event becomes public or if a bribery scandal is publicized in the media. Just look at the some of the crisis that happened over the last decade. Many people have been affected (some have died) because of the crises or mega-crises that have happened. Many of them also included reputational risks as well. Examples include:

The financial and housing collapse and major recession of 2008

Toyota implicated in recalls because of brake issues

Major Banks having their credit card customers’ names stolen by computer hackers

Volkswagen was implicated in a pollution emissions scandal

Target’s customers had personal data stolen due to lax security systems. Over 40 million
Credit and debit card customers effected

Sony Pictures- Sony as well as its employees had confidential information stolen

As you can see from the examples above, there are numerous kinds of crises that a company should be prepared to handle, especially in an international context. Among them are financial crises, natural disasters, product failures, workplace violence, cyber-attack, or hacking, and, of course, terrorism. However, most if not all have resulted in serious reputational crisis.

Key considerations when considering potential brand or reputational risk caused by ethical or fraudulent behavior within the company or within the company’s supply chain:

-Compliance- does the Company have a compliance program and is it up to date?
-Compliance- does the Compliance program and code of conduct promote an ethical culture within the company?
-Supply Chain- has the Company’s vendors involved in the supply chain been vetted? Do they follow the Company’s code of conduct? Do they have compliance programs?
-Is there sound corporate governance and control processes in place?

Major considerations for handling brand risk once a crisis has started includes:

-Is there a Crisis Management Plan in place to handle brand risk once a crisis starts?
-Does the Company have an effective internal investigation process in place that may shorten the time taken to discover internal risks and mitigate reputational harm?
-Has the appropriate decision makers been trained to handle PR and media issues once a crisis has occurred?
-Does the Company have appropriate 3rd party consultants, including risk management companies and media crisis companies in place to help mitigate reputational/brand risk once a crisis event takes place?
-Does the Company have an appropriate international Crisis Management Plan in place in case the crisis is international in scope?