Reputation, risks and redundant rule books

Start Reading
To paraphrase Amazon founder Jeff Bezos, your reputation is what people say about you when you’re not in the room. Reputational risk has never been more critical. As lockdowns ease and businesses look to start their return to normal, the green shoots of economic recovery seem to be appearing. Job vacancy numbers were the highest for a year in February to April, with 657,000 open positions. And house prices have climbed at their fastest rate since the credit crunch, with some demand driven by the Stamp Duty break which lasts until the end of June 2021. But however positive the outlook, risks persist. We have been working with a range of organisations to create modern risk frameworks fit for the new business environment. The key to agility in this area is not wholesale change – the world, your business and its customers are changing too quickly to sweep away your existing frameworks and start again. You need to keep it simple.

What’s most important about risk right now

Managing risks in the even-more dynamic and fast-paced world in which we’re currently operating isn’t about the minutiae of your plans. It’s about how you, your board, your executive and teams hold and manage the narrative around risk. And the big secret about successful reputational risk management? It all hinges on trust. In thevaluecircle language, managing risk is more about the dynamics than the mechanics; more about the people involved than the processes.

The risk spectrum

From business as usual (BAU) at one end, to a crisis threatening your organisation’s very existence at the other, all risk sits on a spectrum. Organisations must identify which risk goes where and have regularly tested plans to deal with each type. continuum of reputational risk The four categories on the risk spectrum we’ve developed to use with clients are:
  1. Business as usual – run-of-the-mill kind of risks which need dealing with operationally
  2. Idiosyncratic – usually particular to a small part of the organisation or could emerge from societal issues which affect many organisations
  3. Emerging crisis – teetering on the edge of something needing a full-blown organisational response. These need swift action to mobilise and contain (where possible)
  4. Existential – a threat to the very existence of your organisation
Examples of idiosyncratic risks include lending scandals, issue-based pressure, and bad behaviour from a senior executive. They are manageable but still need an experienced team to manage them. Covid-19 is a textbook example of an emerging crisis, but also in this category are cyber attacks and loss of senior members of staff. Northern Rock is a classic example of an existential crisis that brought down a multi-billion-pound organisation. The BBC broke the news that it needed Bank of England support on 13th September 2007, and the day after there were queues outside branches, the first run on a British bank in 150 years. Management lost control. It never recovered from the reputational disaster and was finally nationalised in 2008. Planning for these kinds of risks is about reducing the risk of them happening, not just managing the response.

Dynamics, not mechanics

You need plans to deal with each of the four categories of risk. They must include the principles for dealing with the risk and which people are involved. And they need regular testing, with exercises that stretch people’s competencies and relationships and identify parts of the plan which need adjusting. But what’s key isn’t how you design the mechanics of your framework to deal with risk. The best framework in the world will fail if the people using it don’t trust one another. The dynamics of these relationships matter more than the rule book. Trust is the critical factor. Whether people trust one another impacts on how risks move up and down the corporate structure. Operational teams must be trusted to deal with business as usual risks. Leaders must be trusted to contain or escalate. The board must be trusted to be strategic, responsive and to have securing the organisation’s future as its core purpose. So whether or not your organisation had a pre-existing plan to deal with Covid-19, the ultimate success of your response depends on trust between your people, not the detail of the plan itself.

Leave a Reply

Your email address will not be published. Required fields are marked *