How to minimise reputational risk to your business

Four days after Vladimir Putin’s sol­diers invad­ed Ukraine, the price com­par­i­son web­site Com­pare The Mar­ket pulled its TV ads on news bul­letins fea­tur­ing the ani­mat­ed Russ­ian bil­lion­aire meerkat Alek­san­dr Orlov and his faith­ful side­kick Sergei.

The pop­u­lar price com­par­i­son website’s own­er, BGL Group, said the fic­tion­al meerkat char­ac­ters have no asso­ci­a­tion with Rus­sia and the cur­rent sit­u­a­tion, and that it was con­tin­u­al­ly review­ing its adver­tis­ing.

The speed of the action would sug­gest a defen­sive move to dis­tance the com­pa­ny from any asso­ci­a­tion with Rus­sia, as the world looked on aghast at Putin’s attack on his neigh­bour.

Rep­u­ta­tion­al dam­age caused by what­ev­er risk – account­ing scan­dal, data breach or sup­ply-chain issues – can ulti­mate­ly destroy a com­pa­ny if the man­age­ment does not han­dle it well. His­tor­i­cal­ly, risk man­age­ment – includ­ing rep­u­ta­tion­al risk – has been over­seen in a silo sep­a­rate from exec­u­tive lead­er­ship. In recent years, how­ev­er, it looks as if exec­u­tives are final­ly tak­ing rep­u­ta­tion­al risk seri­ous­ly.

“They’ve pre-emp­tive­ly decid­ed not to put them­selves in a sit­u­a­tion where they can be rep­u­ta­tion­al­ly dam­aged” Tri­cia Fox, of Cun­ning­ly Good Group, says of Com­pare The Market’s move. “That makes sense. That implies that there are com­pa­nies that take rep­u­ta­tion­al risks very seri­ous­ly and act upon it.” 

Com­pare The Market’s deci­sion is a mod­ern-day exam­ple of how to tack­le rep­u­ta­tion­al risks before they become an issue. But few organ­i­sa­tions have such a proac­tive com­mu­ni­ca­tions divi­sion with a direct line to the board­room. So, how should lead­ers act if faced with a dam­ag­ing rep­u­ta­tion­al event and how can they mit­i­gate this risk?

Iden­ti­fy­ing poten­tial issues and build­ing a risk reg­is­ter are the first crit­i­cal steps. Next, is devis­ing a risk man­age­ment strat­e­gy and ensur­ing that all those respon­si­ble for this aspect of the busi­ness, includ­ing the com­mu­ni­ca­tions depart­ment, are up to date. The lev­el of each risk will change depend­ing on inter­nal and exter­nal fac­tors, so the need to mon­i­tor the risk reg­is­ter and strat­e­gy reg­u­lar­ly is crit­i­cal. It must be a dynam­ic process.

“In gen­er­al, there is a poor under­stand­ing of the sources of rep­u­ta­tion­al risk and how to man­age them. Sit­u­a­tion­al aware­ness is every­thing. Mon­i­tor evolv­ing threats and test their poten­tial impact. Ask ‘what if?’ in rela­tion to the cur­rent land­scape, for­ward risks, his­tor­i­cal issues and unfore­seen ‘black swan’ events,” says Ryan McShar­ry, head of cri­sis and lit­i­ga­tion at PR firm Infi­nite Glob­al. 

Com­pli­ance is also vital. “The most effec­tive way to mit­i­gate rep­u­ta­tion­al risks is to build a cul­ture of com­pli­ance and resilien­cy. This means ensur­ing every­one knows what is expect­ed of them by hav­ing a clear­ly artic­u­lat­ed pol­i­cy and pro­ce­dure,” says Lau­ren Kor­nutick, solu­tions man­ag­er for com­pli­ance at Fusion Risk Man­age­ment.

Often, when an organ­i­sa­tion comes up against a risk, it only becomes a rep­u­ta­tion­al issue when it hasn’t been han­dled swift­ly, clear­ly and hon­est­ly. In today’s world of social media and cit­i­zen jour­nal­ism, the so-called “gold­en hour” no longer exists. So, irre­spec­tive of whether the company’s lead­ers know all the facts, it’s crit­i­cal that they pub­licly acknowl­edge the issue and explain how they plan to deal with it.

“Tell it first, tell it fast and tell it clear­ly. If you become aware of the issue and can head it off at the pass before the media gets wind of it, then do so. Take the ini­tia­tive and, in doing so, you can con­trol the mes­sage,” says Paul MacKen­zie-Cum­mins, founder and man­ag­ing direc­tor of Clear­ly, a rep­u­ta­tion man­age­ment and pub­lic rela­tions agency.

If, how­ev­er, the issue becomes pub­lic first, man­age­ment can still recov­er con­trol by act­ing quick­ly and hon­est­ly. “In this instance, the advice is to acknowl­edge it and explain what steps are being tak­en to rem­e­dy the sit­u­a­tion. What­ev­er you do, don’t go into hiber­na­tion mode and hope it will go away – that will only fan the flames and exac­er­bate the dam­age to the organisation’s rep­u­ta­tion,” MacKen­zie-Cum­mins says.

Cus­tomers, employ­ees and stake­hold­ers are savvy. If they feel that they have been deceived, the dam­age to rep­u­ta­tion can spi­ral down­wards quick­ly. Take the data breach at Talk­Talk in 2015, when the com­pa­ny failed to pub­licly acknowl­edge the prob­lem of hack­ers steal­ing thou­sands of cus­tomers’ per­son­al details, includ­ing bank accounts. At the time, the com­pa­ny faced a record fine and, ulti­mate­ly, its CEO, Dido Hard­ing, hand­ed in her res­ig­na­tion.

Recent­ly, in the wake of a rep­u­ta­tion­al­ly dam­ag­ing inci­dent, busi­ness lead­ers have tried shift­ing the neg­a­tive pub­lic focus by adopt­ing a new “favourable pur­pose” in its recov­ery. If this is a gen­uine, well-man­aged core strat­e­gy of change with­in the busi­ness, it can work. But often, com­pa­nies choose this route of pur­pose for inau­then­tic rea­sons, which today’s shrewd con­sumers and investors will quick­ly uncov­er.

“Con­sumers are an unfor­giv­ing bunch and will drop a brand or busi­ness in an instant if they feel mis­led. This is where respon­si­ble report­ing is need­ed. Busi­ness­es need to hold them­selves to account and demon­strate the tan­gi­ble impact they are mak­ing, rather than pay­ing lip ser­vice to it,” MacKen­zie-Cum­mins says.

In a fast-mov­ing, inter­con­nect­ed world of glob­al busi­ness, pre­ven­tion is always bet­ter than cure. It’s not uncom­mon for a com­pa­ny to lose as much as a third of its val­ue because of a rep­u­ta­tion­al risk. The invest­ment a com­pa­ny makes in devel­op­ing robust, well-mon­i­tored rep­u­ta­tion­al risk man­age­ment infra­struc­ture is, ulti­mate­ly, far less than the cost of respond­ing to a cri­sis and the ensu­ing rep­u­ta­tion­al fall­out. It’s worth remem­ber­ing that it takes years to build a good rep­u­ta­tion but min­utes to destroy it.

SolarWinds and how it fixed a major reputational risk

In 2020, Solar­Winds, a large US infor­ma­tion tech­nol­o­gy com­pa­ny – with cus­tomers includ­ing the US Depart­ment of Home­land Secu­ri­ty and Trea­sury Depart­ment – was hit by the most sophis­ti­cat­ed and biggest data breach cyber­at­tack at the time.

Sud­hakar Ramakr­ish­na, its CEO and pres­i­dent, took up his new job just days before the data breach went pub­lic. Despite hav­ing the option of walk­ing away, Ramakr­ish­na decid­ed to take on the chal­lenge of resolv­ing the breach, fix­ing the rep­u­ta­tion­al dam­age to the com­pa­ny and restor­ing trust.

Remark­ably, just over a year into his role, the CEO has achieved those goals, with the com­pa­ny now mov­ing back towards its his­tor­i­cal 90% range of cus­tomer reten­tion, which had dropped to 80–85% fol­low­ing the soft­ware sup­ply-chain attack. The com­pa­ny has also recent­ly been acquir­ing new clients again. As a result of Ramakrishna’s swift actions, the dam­age that the hack could have cre­at­ed end­ed up being far less severe than was feared at the time.

Ramakr­ish­na sta­bilised the com­pa­ny and fixed the breach by fol­low­ing a strict frame­work he devised, called “secure by design”, which focused on three key things: what hap­pened, how it hap­pened and “what we are doing about it”.

Cou­pled with the frame­work, Ramakr­ish­na fol­lowed the strict oper­a­tional prin­ci­ples of trans­paren­cy, “relent­less com­mu­ni­ca­tion”, humil­i­ty, belief in a solu­tion and col­lab­o­ra­tion.

“Our focus was our cus­tomers and our busi­ness, while deal­ing with the press, PRs, reg­u­la­tors and gov­ern­ment. If the gov­ern­ment wants to know some­thing, col­lab­o­rate with them, do not try to hide the issue and do not wish the prob­lem goes away,” Ramakr­ish­na says.

Then he spent months work­ing with wor­ried cus­tomers. “They have a right to be con­fused. They have a right to be angry. So, don’t brush it off, work towards engag­ing them.” 

Solar­Winds fixed the issues that allowed the orig­i­nal breach to occur, pub­li­cised the changes and com­mu­ni­cat­ed them to cus­tomers and the indus­try. Today, arguably, Solar­Winds is among the most secure com­pa­nies in the world.