What it means
Reputation is the accumulated expectation that people hold about how a business behaves. Reputational risk is the chance that an event, whether a product failure, a data breach, poor treatment of staff or a clumsy public response, breaks that expectation badly enough to change how people act.
What makes it distinctive is that it is a second-order risk. A factory fire is an operational risk, and the reputational risk is what follows if the company handles the aftermath badly or is found to have ignored warnings.
The response often does more damage than the original event. The costs are real and measurable even though the risk itself is hard to quantify in advance.
They include lost revenue as customers switch, higher recruitment costs, legal and public relations spending, management time diverted from running the business, and in listed companies a fall in share price. Because prediction is difficult, most organisations manage reputational risk through prevention and preparedness rather than precise measurement.
That means clear conduct standards, escalation routes so bad news reaches senior people early, and a rehearsed crisis communication plan with named decision makers. Where a number is needed, boards typically use expected loss, multiplying an estimated probability by an estimated financial impact, and treat the result as a planning aid rather than a forecast.
The value lies in comparing the cost of prevention against the scale of what is being risked.
In practice
Real-world examples
Example 1
A payroll software provider suffers a data breach affecting client employee records. Sales stall for two quarters because prospects ask about security in every meeting, and the company spends heavily on an independent audit to rebuild confidence.
Example 2
An airline handles a weather-related disruption poorly, leaving passengers without information for a day. Bookings dip for a month, and the airline invests in an automated rebooking and notification system to reduce the chance of a repeat.
Example 3
A bank is fined for mis-selling a product. The fine itself is affordable, but the reputational damage costs far more as corporate clients put new business out to tender and the regulator increases the intensity of its supervision.
Think of it
Building a good reputation is like carefully crafting a glass vase over many years, while reputational risk is the chance of dropping it on a concrete floor, shattering all that hard work instantly.
Formula
Calculation
Expected annual loss = Probability of a damaging event x financial impact of that event
A consumer goods business estimates an 8% chance in any year of a product quality incident serious enough to reach national media. It puts the impact at $12,000,000 of lost revenue over the following twelve months plus $3,000,000 of recall and legal costs, a total of $15,000,000. Expected annual loss is therefore 0.08 x $15,000,000 = $1,200,000. The company considers a $400,000 annual quality assurance and crisis readiness programme that it believes would cut the probability from 8% to 3%. The revised expected loss is 0.03 x $15,000,000 = $450,000, a reduction of $1,200,000 - $450,000 = $750,000, so the net benefit is $750,000 - $400,000 = $350,000 a year.Case study
Seen in the real world
Kestrel Fields Organics is an illustrative and clearly fictional food brand used to show reputational risk in practice. A supplier substituted a cheaper ingredient without telling the company, and the substitution came to light through an independent test rather than through Kestrel's own checks.
The product was safe, and the direct cost of withdrawing affected stock was about $600,000. The greater cost came from three retailers pausing orders while they reviewed supplier assurance, which removed roughly $4,000,000 of revenue over two quarters, and from the founder spending most of a quarter on the response rather than on growth.
In this fictional example the board's conclusion was that its supplier auditing had been the cheapest thing to cut and the most expensive thing to lack. Kestrel introduced unannounced supplier testing at a cost of $250,000 a year and published the results, which several retailers later cited as a reason for expanding the range.
Watch out
Common mistakes
- Treating reputational risk as a communications problem to be solved after the fact, rather than as a consequence of operational and conduct failures.
- Leaving it off the risk register because it cannot be measured precisely, which means nobody is accountable for managing it.
- Assuming only consumer-facing brands are exposed, when business-to-business suppliers can lose contracts just as quickly through procurement reviews.
Questions
People also ask
How can something so hard to measure be managed?
By focusing on the underlying causes, setting clear standards, ensuring bad news travels upwards fast, and rehearsing the response before it is needed.
Does insurance cover reputational damage?
Some policies cover crisis management costs and specific losses, but lost future revenue and diminished brand value are generally not insurable.
Who should own reputational risk?
Ultimately the board, with day-to-day ownership sitting where the underlying risks sit, such as operations, quality, technology and human resources.