Maintaining and protecting a good name can deliver significant benefits to an organisation and enhance its market value, writes John Keilthy

Reputation risk has assumed a greater importance in the pantheon of corporate risks. But is management only paying lip service to the potentially devastating impact reputation risks can have on shareholder value? Or are executives embracing the management of reputation risk in the same way that they manage financial and operational risk?

The emergence of the new role of chief risk officer in Ireland suggests that Irish companies are taking a more holistic view of risks, including those that affect their reputation.

Risk management, as it has been applied across most organisations historically, has tended to concentrate on credit, market and operational risk. These relate to the risk of loss due to, for example, the default of a customer, adverse changes in the conditions of the market in which a company operates or systems/ procedural failures in an organisation.

These risks have lent themselves to being monetised and measured. In the financial services industry, for example, sophisticated quantitative techniques such as value at risk (VAR) are in common use. This formula measures the loss a bank could expect to make on its proprietary trading book on any given day, based on past experience. The risk calculation is encapsulated into a single figure, which can be monitored.

As it is possible to measure these types of risks, organisations have built infrastructures to manage them, as well as escalation procedures that flash amber or red when limits are close to being breached.

But they are not foolproof and businesses have suffered significant financial loss arising from the impact of these risks, notwithstanding the existence of monitoring and management procedures. Most notably, the loss of market value due to negligent employee behaviour and operational failures is hard to buffer against, even with risk management procedures in place.

Interestingly, credit, market and operational risks, while they may have inflicted heavy financial losses on certain organisations, haven't always led to outright collapse. In fact, there are plenty of examples of organisations that recovered from initial financial loss and went on to prosper. Think of the bounce-back effect demonstrated by reputable firms such as Johnson & Johnson, Coca-Cola, Ford, Disney, Shell and Unilever after their various crises.

The real damage is felt where there has been an accompanying reputational risk impact, or where reputational risk was at the heart of the problem. These situations have a devastating impact on organisations, the demise of the once mighty Arthur Andersen being a case in point.

So how does one define reputation? Reputation is what a company does, what it says it does, how it behaves and what others (stakeholders) say about it. It develops over time through repeated interactions between an organisation and its stakeholders.

Reputation is one of the key intangible assets of a business. It is the sum of the parts of stakeholders' expectations about future financial performance; corporate culture; employee loyalty; corporate governance, social/ ethical/environmental behaviour, compliance and regulatory norms, product reliability, and the quality and performance of the senior management team.

Maintaining a strong reputation will deliver significant benefits to an organisation. It helps attract capital. It helps attract and retain talent and customers and improves financial returns. It gives an organisation the credibility and ability to influence policy. Reputation "equity" helps overcome crises.

Reputation has a commercial value for businesses which, when damaged, can result in significant financial losses, including business collapse. Over 30 per cent of the market value of the companies quoted on the Irish Stock Exchange is accounted for by intangible assets that include reputation attributes. That amounts to €24 billion in value, potentially at risk.

Reputation risk is therefore any risk that can affect negatively the perception of a business in the eyes of its stakeholders. Reputation risks are not always as obvious to organisations as credit or market risk because they often require a view of the organisation from the outside in. Reputation risk arises from situations where an organisation's behaviour is perceived to differ from stakeholders' expectations. The first question every chief executive should ask is "do we know what our stakeholders expect of us?"

There is an increasing appreciation that reputation risk constitutes a significant threat to a business. A 2004 survey of chief executives conducted by PricewaterhouseCoopers/Economist Intelligence Unit reported that reputation risk posed the greatest threat to an organisation's market value, more than credit, business strategy, technology or political risks.

It is becoming increasingly important to take the specific risk to reputation seriously as it is the most difficult to restore. Many companies even communicate this fact openly. Goldman Sachs, for example, lays out the importance of reputation risk: "Our assets are our people, capital and reputation. If any of these are ever diminished, the last is the most difficult to restore."

Managing reputation effectively can act as an insurance policy against operational disasters and this area is climbing on the executive agenda.

Although enhancing and protecting corporate reputation is a chief executive's responsibility, ultimately, every employee is responsible for it. From practical experience, it has become clear that without a common framework to manage reputation, it will be difficult to maintain consistency and favourable perceptions among stakeholders.

To manage and minimise risks to reputation, it is necessary to know where one stands. This involves a thorough assessment of all risks based on inputs from key divisions, combined with an external assessment and reputation measurement.

Clearly, not all perceived reputation risks carry the same materiality for an organisation, so it is necessary to assess the likely impact of risks with a view to identifying those risks that can threaten the organisation and which require close monitoring and proactive management.

Arising from this exercise, management will have choices that range from accepting the risk but monitoring it, to terminating the activity that constitutes the risk in the first place.

Only by adopting a holistic approach to managing reputation risks will management be in a position to make informed decisions. Otherwise, a chief executive will only know there is a problem when he or she receives the proverbial phone call!

• John Keilthy is a partner with ReputationInc