It's become exceedingly difficult in today's risk-filled business environment for leaders to have confidence that their plans and strategies will play out as expected. A major reason is that strategic risks — those that either affect or are created by strategy decisions — can strike more quickly than ever before due to rapid-fire business trends and technological innovations such as social media. Henry Ristuccia, partner, Deloitte & Touche LLP and global leader, governance, risk and compliance services at Deloitte Touche Tohmatsu Ltd., warns that reputational risks can damage the most well-crafted business strategies. Ristuccia comments, "When organizations have a reputational risk problem, it usually involves the media and what their customers, employees and other stakeholders are saying in the public domain." Those organizations that are on the leading edge of managing reputational risk have successfully linked strategy and innovation with their risk management programs to identify where the next disruption could come from. "They're using data analytics to gather and help interpret market intelligence to identify threats to their reputation," Ristuccia remarked.
So, how do organizations incorporate risk management and oversight to the point where it becomes a part of their culture? Ristuccia stated, "An organization should start with their strategy and ask, 'What are the things that could go wrong with that strategy?'" That could entail a stress test where they validate their operational strategies and look at alternative models and scenario analysis. "Looking at those scenarios starts to give you your risk appetite and how you should be thinking about risk and strategy together," Ristuiccia added. He went on to warn against taking a rear-view mirror approach to reputational risk. When an adverse event happens that does cause damage to reputation, the tendency is to seek legal and PR advice and then "do a post mortem" to help avoid a similar event in the future. "That essentially is crisis management," Ristuccia concluded, "not reputational risk management.”
Wall Street Journal (10/02/13)