Reputation_The Missing Piece in Resiliency Planning, Part 1, by Linda Locke 2015

20 CONTINUITY Q2 2015

©iS

tock

phot

o.co

m/lo

rrai

neda

rke

THE MISSING PIECE IN RESILIENCY PLANNINGIn part one of her article, Linda Locke looks at the value of effective reputation management both to the organisation and to the BC practitioner, and considers the relationship between operational and reputation resilience

In 2014, as news of data breaches became commonplace, the Sony cyber hack broke new ground. Moviegoers around the world were taken

aback by the suspicion that the government of North Korea had supported the hack, triggered by its possible umbrage at the release of a movie which mocked the country’s leader, Kim Jong-un.

The Sony incident is notable for several reasons. The released emails caused embarrassment to the firm, and the on-again/off-again release of what for many was a forgettable movie became an international debate. While the movie at the centre of the incident has been relegated to the ‘Dustbin of Awfulness’, the perceptions of Sony’s response, and the management team in charge, are likely to remain.

Reputation resilience on the BC agendaFor some organisations, reputation resilience is not viewed as central to their overall business planning or strategy. In such companies, incidents are often seen as episodic events – challenges to be overcome through skilful use of media and advertising channels, and

perhaps a donation to a charitable organisation, and then they move on.

The Sony incident, however, provides a classic example of why reputation resilience should be a primary goal for any business continuity planners and managers, and also why it represents a significant opportunity for them. Those BC professionals who understand the value of protecting reputation, and develop strategies to help their organisations navigate those events which have the potential to damage that reputation, are much more likely to achieve greater visibility and strategic influence, and ultimately heighten their overall standing within the firm.

Placing a value on reputationReputation is an intangible asset, and many organisations lack the tools to measure it. It is, however, highly prized as it can create significant competitive advantage, but can also be lost quickly without effective planning, monitoring and skilled management.

Most organisations aspire to operational resiliency and plan for it. However, whereas an organisation ‘owns’ its

“Reputation is not owned

by the organisation, but rather by

its stakeholders. A company’s reputation is

determined by the judgments

and perceptions of others”

Q2 2015 CONTINUITY 21

©iS

tock

phot

o.co

m/lo

rrai

neda

rke

©iS

tock

phot

o.co

m/lo

rrai

neda

rke

Reputation Management

operations, reputation is something different. Reputation is not owned by the organisation, but rather by its stakeholders. A company’s reputation is determined by the judgments and perceptions of others, including customers, suppliers, investors, advocacy groups, regulators, policy-makers and the general public. A company can influence reputation, but it will never own it.

Operational resiliency gives an organisation the ability to manage risks and adapt throughout the lifecycle of a disruption. Resiliency planning brings strength, flexibility, swift recovery and adaptability to a volatile environment. The resiliency objective is to enable the organisation to operate as usual, powering through crises, interruptions and disasters, recovering quickly and predictably.

Reputation resiliency, then, is the ability to sustain positive stakeholder perceptions, openness to external input, and responsive, supportive behaviour throughout disruptions. In both cases, managing for resiliency requires ongoing measurement and monitoring. It requires balancing risks and costs, and maintaining an enterprise-wide focus. However, the two types of resiliency also have fundamental differences; each requires a distinct management and mitigation approach.

Why reputation mattersThe issue of trust is central to an organisation’s reputation. A company that has a strong reputation is one which is trusted by its stakeholders. A trusted organisation is likely to enjoy strong brand loyalty and long-term, high-value customers. It will experience lower employee turnover and will find it easier to recruit high-calibre employees. Such a company benefits from higher investor confidence, a more positive regulatory environment and even lower costs of capital, as its reputation paves the way for greater trust from financial partners.

A weak or negative reputation exacts a measurable cost – a reputation penalty. A company viewed with

distrust and outrage by its stakeholders is more likely to suffer increased customer churn and elevated customer acquisition costs. It will face higher employee training costs and related service inefficiencies. Such a company will pay the price of regulatory constraints, increased cost of capital, lower investor confidence and an increased vulnerability to competitors. For example, major financial institutions that suffer a credit downgrade due to reputational damage may have to post millions or even billions of dollars in additional collateral and face higher borrowing costs.

A balanced approachTo achieve a strong, positive reputation and to better manage reputation risks, companies must work towards a resiliency model that balances the protection of revenue and reputation. Unfortunately, risk literacy is rarely a top concern within the functions typically assigned to manage reputation, such as corporate affairs, communications and public relations. These functions often lack the analytical tools and rigorous processes required to measure risk. When these functions control reputation strategy they may have challenges providing data-driven risk heat maps and quantitative reporting on issues such as time-to-recovery after a crisis.

Conversely, reputation literacy is rarely a top concern within functions that manage risk.

Business continuity staff often think that reputational issues reside strictly in the PR domain and are primarily relevant during times of crisis. While organisations are judged on their response in a crisis, if the incident team has tools to predict shifts in stakeholder perceptions based on business decisions, it can escalate potential reputation damage in advance of a crisis event.

The gap in insight presents a path forward. Reputation risk management should be integrated into risk-related processes and practices. When an organisation focuses on building enterprise-wide reputation competence, the entire company is having conversations about how their decisions might influence the perceptions of their key stakeholders. Consider the following outcomes: • The lines of business will better understand risks

and opportunities to build reputation from a competitive perspective

• The strategy team will understand the drivers of corporate reputation and incorporate them into planning

• The communications team will be able to measure the impact of its response to a crisis and improve the next time

• The risk team will have data to share with the C-suite and board related to evolving and emerging risks, outside of the annual or biannual discussion to reduce surprises In our next article, we will offer suggestions for tools

and points of analysis to help build reputation resiliency for the organisation.

LINDA LOCKE

Linda Locke is senior vice president and partner at Standing Partnership, a reputation and strategic communications consultancy.

www.standingpartnership.com [email protected] @Reputationista

What the customers sayAccording to numerous surveys, the vast majority of consumers say they will avoid buying a product if they don’t like the company behind it. They say they are more likely to purchase products from companies they like and trust – those which have a good reputation. What is notable is that they are judging companies and their corporate behaviour, and not necessarily the quality of their products. Therefore, a significant reputational crisis event is often followed by a negative impact to revenue – unless a company is prepared.