By Malcolm Stokes, Head of Operational Risk, BT Operate
When assessing threats to business, how can we tell whether security and resilience are good enough? The answer depends largely on how we value reputation; however, there’s no recognized method for measuring damage to an organization’s reputation. BT Security is piloting an approach that aims to solve this problem.
Business success, or survival in a crisis, depends ultimately on reputation. If the expectations of customers, employees, suppliers, regulators, and/or investors are not met, reputation is damaged and the bottom line suffers. Safeguarding reputation means continuing to meet expectations of security, reliability, product or service quality, value for money, and integrity. Risk to any of these characteristics can be a threat to reputation, to market share, costs and profitability.
If expectations are not met, customers will buy elsewhere, employees leave, suppliers are reluctant to offer best terms, regulators impose greater scrutiny, and investors may raise the cost of capital. Any combination of these responses will tend to reduce revenues, raise costs and erode profits.
Nearly all business risks have the potential to damage reputation in some way, which is why the phrase — “damage to reputation” — arises so frequently as a possible consequence. Often this intangible part of consequences is said to exceed the tangible losses that may arise from an incident. However, without a consistent way to evaluate reputation damage potential, we may distort our analysis of risks and draw false conclusions.
Market surveys that ask which risks concern managers the most tend to find “reputation risk” at the top of the list, simply because almost all risks are potentially risks to reputation. Look at any risk register and ask yourself if reputation can ultimately be affected. Study a few well-known business failures (e.g., Ratners, Perrier, Pan-Am, Barings Bank, Enron, Anderson, Jarvis, and potentially BP) and consider the role played by reputation damage.
The proposed scheme for measuring reputation damage uses a set of 10 estimated cost components that together represent the overall cost to a company of suffering and repairing a damaged reputation. Not all of these cost components will apply in every case:
- Advertising and communication costs to restore trust
- Reactive expenditure to prevent recurrence
- Cost of de-mergers and re-branding
- Value of lost business contracts that are terminated
- Cost of acquiring customers to offset increased churn
- Opportunity cost of new business prospects and partnerships lost
- Increased cost of capital due to lower credit rating
- Cost of delayed product launches and smaller market share
- Cost of replacing executives and managers who resign
- Cost of replacing skilled employees who leave
The process of estimating what reputation damage might cost avoids the pitfalls of trying to value reputation or brands before and after an incident in order to assess the damage in terms of value difference. A series of pilot studies are in progress to demonstrate how risk management and threat assessment can be more effective if reputation takes center stage in the process.
I’ll report back on what we find from the pilot studies. But, in the meantime, join the dicussion and let us know what costs your company associates with risk.
