The document discusses the importance of reputation resilience planning for businesses. It argues that reputation is an intangible asset determined by stakeholder perceptions, not owned by the organization. While operational resilience focuses on continuing operations during crises, reputation resilience requires sustaining positive stakeholder views. The Sony hack is used as an example of how a crisis can damage a company's reputation. The document advocates for integrating reputation risk management into overall risk processes to improve reputation competence across an organization.

1. 20 CONTINUITY Q2 2015
©iStockphoto.com/lorrainedarke
THE MISSING PIECE IN RESILIENCY PLANNING
In part one of her article, Linda Locke looks at the value of effective
reputation management both to the organisation and to the BC practitioner,
and considers the relationship between operational and reputation resilience
I
n 2014, as news of data breaches became
commonplace, the Sony cyber hack broke new
ground. Moviegoers around the world were taken
aback by the suspicion that the government of North
Korea had supported the hack, triggered by its possible
umbrage at the release of a movie which mocked the
country’s leader, Kim Jong-un.
The Sony incident is notable for several reasons. The
released emails caused embarrassment to the firm, and
the on-again/off-again release of what for many was a
forgettable movie became an international debate. While
the movie at the centre of the incident has been relegated
to the ‘Dustbin of Awfulness’, the perceptions of Sony’s
response, and the management team in charge, are likely
to remain.
Reputation resilience on the BC agenda
For some organisations, reputation resilience is not
viewed as central to their overall business planning or
strategy. In such companies, incidents are often seen as
episodic events – challenges to be overcome through
skilful use of media and advertising channels, and
perhaps a donation to a charitable organisation, and
then they move on.
The Sony incident, however, provides a classic
example of why reputation resilience should be a
primary goal for any business continuity planners and
managers, and also why it represents a significant
opportunity for them. Those BC professionals who
understand the value of protecting reputation, and
develop strategies to help their organisations navigate
those events which have the potential to damage that
reputation, are much more likely to achieve greater
visibility and strategic influence, and ultimately
heighten their overall standing within the firm.
Placing a value on reputation
Reputation is an intangible asset, and many
organisations lack the tools to measure it. It is, however,
highly prized as it can create significant competitive
advantage, but can also be lost quickly without effective
planning, monitoring and skilled management.
Most organisations aspire to operational resiliency and
plan for it. However, whereas an organisation ‘owns’ its
“Reputation
is not owned
by the
organisation,
but rather by
its stakeholders.
A company’s
reputation is
determined by
the judgments
and perceptions
of others”

2. Q2 2015 CONTINUITY 21
©iStockphoto.com/lorrainedarke
Reputation Management
operations, reputation is something different. Reputation
is not owned by the organisation, but rather by its
stakeholders. A company’s reputation is determined by the
judgments and perceptions of others, including customers,
suppliers, investors, advocacy groups, regulators, policy-
makers and the general public. A company can influence
reputation, but it will never own it.
Operational resiliency gives an organisation the
ability to manage risks and adapt throughout the
lifecycle of a disruption. Resiliency planning brings
strength, flexibility, swift recovery and adaptability to
a volatile environment. The resiliency objective is to
enable the organisation to operate as usual, powering
through crises, interruptions and disasters, recovering
quickly and predictably.
Reputation resiliency, then, is the ability to sustain
positive stakeholder perceptions, openness to external
input, and responsive, supportive behaviour throughout
disruptions. In both cases, managing for resiliency
requires ongoing measurement and monitoring. It
requires balancing risks and costs, and maintaining
an enterprise-wide focus. However, the two types
of resiliency also have fundamental differences;
each requires a distinct management and mitigation
approach.
Why reputation matters
The issue of trust is central to an organisation’s
reputation. A company that has a strong reputation
is one which is trusted by its stakeholders. A trusted
organisation is likely to enjoy strong brand loyalty and
long-term, high-value customers. It will experience
lower employee turnover and will find it easier to
recruit high-calibre employees. Such a company
benefits from higher investor confidence, a more
positive regulatory environment and even lower costs of
capital, as its reputation paves the way for greater trust
from financial partners.
A weak or negative reputation exacts a measurable
cost – a reputation penalty. A company viewed with
distrust and outrage by its stakeholders is more likely
to suffer increased customer churn and elevated
customer acquisition costs. It will face higher employee
training costs and related service inefficiencies. Such
a company will pay the price of regulatory constraints,
increased cost of capital, lower investor confidence
and an increased vulnerability to competitors. For
example, major financial institutions that suffer a credit
downgrade due to reputational damage may have to
post millions or even billions of dollars in additional
collateral and face higher borrowing costs.
A balanced approach
To achieve a strong, positive reputation and to better
manage reputation risks, companies must work towards
a resiliency model that balances the protection of
revenue and reputation. Unfortunately, risk literacy
is rarely a top concern within the functions typically
assigned to manage reputation, such as corporate
affairs, communications and public relations. These
functions often lack the analytical tools and rigorous
processes required to measure risk. When these
functions control reputation strategy they may have
challenges providing data-driven risk heat maps
and quantitative reporting on issues such as time-to-
recovery after a crisis.
Conversely, reputation literacy is rarely a top concern
within functions that manage risk.
Business continuity staff often think that reputational
issues reside strictly in the PR domain and are primarily
relevant during times of crisis. While organisations are
judged on their response in a crisis, if the incident team
has tools to predict shifts in stakeholder perceptions
based on business decisions, it can escalate potential
reputation damage in advance of a crisis event.
The gap in insight presents a path forward.
Reputation risk management should be integrated
into risk-related processes and practices. When an
organisation focuses on building enterprise-wide
reputation competence, the entire company is having
conversations about how their decisions might
influence the perceptions of their key stakeholders.
Consider the following outcomes:
• The lines of business will better understand risks
and opportunities to build reputation from a
competitive perspective
• The strategy team will understand the drivers
of corporate reputation and incorporate them
into planning
• The communications team will be able to measure
the impact of its response to a crisis and improve the
next time
• The risk team will have data to share with the C-suite
and board related to evolving and emerging risks,
outside of the annual or biannual discussion to
reduce surprises
In our next article, we will offer suggestions for tools
and points of analysis to help build reputation resiliency
for the organisation.
LINDA LOCKE
Linda Locke is senior vice president and partner at Standing Partnership, a reputation and
strategic communications consultancy.
www.standingpartnership.com
llocke@standingpartnership.com
@Reputationista
What the
customers say
According to
numerous surveys,
the vast majority of
consumers say they
will avoid buying a
product if they don’t
like the company
behind it. They say
they are more likely
to purchase products
from companies
they like and trust
– those which have
a good reputation.
What is notable is
that they are judging
companies and their
corporate behaviour,
and not necessarily
the quality of their
products. Therefore,
a significant
reputational crisis
event is often
followed by a negative
impact to revenue –
unless a company is
prepared.