Not long ago, creditors, bondholders, and other risk-averseinvestors considered so-called “sin industries” to be safe havensthat were less susceptible to market fluctuations. However, inrecent months, we've seen how rapidly society's perceptions of andtolerance for “sin” can change, whether they are problems with anentire industry's business model or with the behavior of a specificcompany's executives. We've also learned how much economic damagecan be caused by angry and disappointed stakeholders as a result ofsuch problems.

We live in an era of cultural climate change and reputationalrisk tornadoes. Finance professionals who can demonstrate thattheir companies understand how to mitigate these risks—and who canprovide validation of their reputational risk managementpractices—will find their reward in a lower cost of capital.

|

Changing Landscape of Culture Risk

Consider how dramatically recent changes in attitudes andperceptions of certain practices and events are affecting corporateAmerica. In some workplaces, sexual harassment and abuse existedfor years. The corporate world overall expressed regret about suchbehavior, recognized it as counter to organizational values, anddealt with it in ways that varied from company to company and caseby case. But suddenly, in the wake of scandals starring HarveyWeinstein, Steve Wynn, and so many others, the #metoo movement hasmade this issue into a bright red line. Companies or individualswho cross it may have their reputations, and perhaps their futurebusiness prospects, destroyed.

Another realm in which culture risk is evolving rapidly isweapon sales. For years, our society understood that guns posed athreat, that at any time a deranged individual might wreak havocwith a product acquired legally, and that the retailer which soldthe weapon could face tangible economic impacts. For years,national retailers accepted that risk—until the reaction to theParkland, Florida, school shooting caused several retail chains tochange their policies.

We seem to be at a similar inflection point now with respect todata privacy and security. For years, our society seemed tounderstand that we were surrendering a vast amount of personalinformation in return for a more customized user experience onvarious sites, including Facebook, and we were willing to acceptthe risks. Indeed, in many cases, consumers reflexively agreed to“privacy” policies that allowed companies to collect and use theirpersonal information. Today, as more information comes to lightabout Cambridge Analytica, Facebook, and others, the public'sexpectations appear to be changing.

What all these events have in common is that they are altering,suddenly and profoundly, the risk environment for businesses. Asthey have done for years, companies need to be constantlychallenging their own assumptions about future events andstakeholder expectations—protecting themselves against every “whatif” they can imagine. But today, they need to do so more often.Failing to correctly gauge stakeholder expectations can lead toexistential economic risks. Companies need to understand thenuances of reputation risk and how to measure, manage, and insureit.

|

The Reality of Reputation Risk

“Reputation risk,” defined as the risk of negative publicopinion, has been named by banking regulators as one of the eightmost threatening perils. We agree that it can have majorconsequences for companies, but we believe it should be defined ina subtly different way. We believe “reputation risk” is the threatof enterprisewide economic damage inflicted by angry, disappointedstakeholders. Identifying the source of risk as the gap betweenexpectations and actual experience, rather than focusing on publicopinion, means that it arises from the interplay of severaloperational factors that need to be measured, modeled, andmanaged.

In reputation risk scenario modeling, the peril involves actionsby stakeholders and three contributing variables: stakeholders'expectations, their experience of reality, and the media'senhancement of both. Focusing exclusively on the media arm of thistriangle obscures risk scenarios arising from changes in eitherstakeholder expectations or stakeholder experiences. This isespecially problematic in current times, when many reputationcrises are products of culturally driven changes inexpectations.

Effectively managing reputationalrisk exposure can provide very tangible economic benefits, enablingtreasury and risk professionals to give capital-markets principalsand the ratings agencies greater confidence in the future stabilityof their cash flows.

This is an issue Steel City Re has researched. We've analyzedhow credit markets have behaved toward companies dealing withreputational issues. Our data show that, all things being equal,the variance between a great reputation and a poor reputation canalter the cost of capital by around 80 basis points. And ourRepuSPX index, an equity index of companies arbitragingunderappreciated reputational value, has outperformed the S&P500 by 375 percent over the past 15 years.

Companies need to recognize the tangible impact thatreputational crises can have, and they need to consider these risksand plan to mitigate them just as they would an operational crisis.The difference is that an operational crisis occurs when somethingthat a company is expected to control goes wrong. Often thisinvolves a failed control for innovation, safety, security,sustainability, or quality.

A reputational crisis occurs when stakeholders believe thecompany didn't make an authentic effort at mitigation—and they'redisappointed or angry that the company's leadership failed them.That anger can manifest itself in very real ways. Our researchshows that the cost of reputational attacks against companies hasrisen by more than 500 percent over the past six years, fueled byweaponized social media and influencers, including politicians, whoare adept at channeling public anger toward specific targets.

Stakeholders will forgive an unanticipated operational failureif they believe the company did everything it could to avoid thesituation. And they may believe it did everything it could if thecompany has already convinced them that it is dedicated to theirneeds, concerns, and values; that it has identified future risks tostakeholder expectations; and that it is doing what is ethicallyprudent to mitigate those risks.

Building this understanding in advance is crucial if a companywants to emerge from a crisis with its reputation largely intact.At the same time, in the event of a reputational crisis, thecompany needs to prioritize managing stakeholder expectations andclosing the gap between what stakeholders expect and what thecompany can practically achieve.

Consider three examples that illustrate a range of operationaland governance-driven reputation risk management strategies. Eachcreated value for its parent by being discovered, appreciated, andvalued by stakeholders in the context of a potential crisis ofreputation.

Following the 1982 Tylenol poisonings, Johnson & Johnsonchanged the reality of product safety, instituting new controlprocesses over the supply chain and tamper-proof packaging. Thevalue of that investment was realized in 1986 when a copycatpoisoning in Brooklyn, N.Y., enabled Johnson & Johnson tohighlight the new safety reality. From that point on, stakeholderscame to expect this high level of product safety, and the companyregained 30 percent of the market capitalization it had previouslylost.

Rolls Royce and its board have long made reputation a prioritywith an asset preservation policy that prioritizes three things:reputation, profitability, and viability. The operationalimplications of this risk governance strategy were tested inNovember 2010 when a Rolls-Royce Trent 9000 engine powering anAirbus A390 blew up. The company identified and rectified asystemic fuel line issue, had the engine recertified, and announcedthe sale of 12 A390s to British Airways all within the span of 12weeks. Customers and investors alike developed a betterappreciation for the company's superior supply-chain control andcommitment to product safety. Year-over-year sales increased by 25percent and its equity outperformed the broader market by 30percent.

Risk governance was also key to how Merck & Co.'s CEO, KenFrazier, boosted his company's market cap in the aftermath of thewhite supremacist activities in Charlottesville, Va., in August2017. Frazier was the first CEO to resign from President Trump'sManufacturing Advisory Council—a move supported by his board,company stakeholders, and the public at large. For about 10 weekssubsequently, Merck outperformed the S&P 500 pharmaceuticalindex by about 3.5 percent. Ultimately, Frazier's resignationproduced almost $6 billion in value. The speed with which heresponded to the president's comments and distanced himself fromthe advisory council was made possible by Merck's enterprise riskmanagement (ERM) apparatus, which enabled corporate leaders toprocess a weekend event and make a board-level decision by Mondaymorning.

|

Accelerating Impacts

Clearly, in today's social media–driven environment, changes inexpectations—i.e., cultural shifts—can occur at speeds neverexperienced before. Companies need to view these risks as theywould view tornadoes. Once an event is upon you, it's too late.

Organizations need to build the systems and processes they'lluse to recognize cultural shifts while they're still on thehorizon. Then companies need to be able to adapt quickly. They needto develop internal systems that allow for rapid analysis,communication, and decision-making.

Businesses today need a reputation risk governance systemrepresenting the ideas, beliefs, and practices of the enterprise.They also need an operational ERM apparatus that integrates data onstakeholder expectations and coordinates efforts among internalcommunications, operations, legal/compliance, human resources, andrisk management teams.

The operational systems should look for the signs of changes instakeholder expectations, as reflected in specific metrics. Forexample, shifting customer expectations may be demonstrated bychanges in sales volume, sales cycle time, or price pointtolerance. Employee expectations are reflected in wage and salarycosts, turnover, internal friction, and a range of HR-relatedexpenses. Supplier terms are informative in determining supplierexpectations, as are credit costs and credit default swap prices.Lastly, earnings multiples speak volumes about investorexpectations.

An artificial intelligence system can index the values andvolatility of these data points and predict trends to produce anin-house equivalent to the reputational value metrics we use atSteel City Re. Those internal metrics, in turn, can support bothmanagement and governance of reputation value and risk.

Signaling the company's internal efforts to protect againstreputational risks through risk transfer, insurance, andthird-party warranties can provide outside validation of thecompany's practices and governance, and can cast potentiallydamaging events as anomalous incidents rather than systemicfailures. They essentially build storm shelters by ensuring that aclear and convincing, positive narrative is front and center beforedisaster strikes.

A town in a tornado zone can't be faulted if a tornado ravagesthe region. It can only be faulted if it failed to anticipate thecrisis and do everything possible to protect its residents.Companies, along with their directors and executives, can survivereputational crises in a similar way—by constantly analyzing andanticipating future possibilities and building reputational stormshelters to protect against them.

Dr. Nir Kossovsky isCEO of Steel City Re, which analyzes reputational risk andresilience of companies and insures them and their directors andofficers against the financial impact of reputational damage. Hehas written two books and many articles on trends affectingcorporate reputation, has developed proprietary algorithms formeasuring reputational risk, and has advised numerous companies onstrategies for deterring and mitigating that risk.