Protecting the Shine on Your Reputation [RMA Journal, The]

The populist anger against Wall Street may seem misdirected to some and justified to others, but it's definitely a reminder about the importance of reputation risk. Warren Buffet once said, "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently."

Thinking about it is key. Reputation risk is an important risk under the ERM umbrella. Our business is built on confidence and trust, and without them our customers will go elsewhere and our market value will erode.

In today's inhospitable environment, an institution's reputation is more at risk than ever. We have more interaction with regulators, legislators, activists, and social media. Our industry strengthens Main Street, but we're often confused with those on Wall Street who are blamed for causing today's economic havoc.

What is reputation risk? The Fed's Commercial Bank Examination Manual defines reputation risk as "the potential that negative publicity regarding an institution's business practices, whether true or not, will cause a decline in the customer base, costly litigation, or revenue reductions."

Whether true or not.... That's a scary proposition. A sound, well-managed institution can suffer significant damage when an unfounded rumor gains traction. Today, good news and bad, truth and rumor travel in real time along the digital highways of Twitter and Facebook as well as the traditional media outlets.

Like goodwill, reputation is an intangible asset that is difficult to measure. Strong earnings, capable management, and loyal employees all contribute to a strong customer base and a good reputation. But it can all unravel quickly and in unexpected ways. Customer data may be stolen, a systems failure may make account information unavailable, an employee may be charged with fraud. A money-laundering operation may be uncovered, or the institution may be cited for regulatory violations.

You guard against this elusive risk through your corporate governance structure. Senior management and the board must support awareness of reputation risk by demanding accurate and timely management information. Below are suggestions for managing reputation risk, offered by Philadelphia Fed Enforcement Specialist William J. Brown. They appeared in SRC Insights, Fourth Quarter 2007:

* Maintain timely and efficient communications among shareholders, customers, boards of directors, and employees.

* Establish strong enterprise risk management policies and procedures throughout the organization, including an effective anti-fraud program.

* Reinforce a risk management culture by creating awareness at all staff levels.

* Instill ethics throughout the organization by enforcing a code of conduct for the board, management, and staff.

* Implement independent testing and transactional testing on a regular basis.

* Respond promptly and accurately to bank regulators, oversight professionals (such as internal and external auditors), and law enforcement.

* Establish a crisis management team in the event there is a significant action that may trigger a negative impact on the organization.

In addition to those, I suggest that you also establish a cross-functional, tactical response team that meets weekly or monthly to solve reputation problems and make decisions on how to handle near-term reputation issues. Team members should include Risk, Corporate Communications, Legal, Government Affairs, and Human Resources.

Reputation risk can come from anywhere inside or outside the bank, including your vendors. It is heavily influenced by other areas of risk and can arise from missteps in credit risk or market risk or in the legal and compliance areas.

After having spent the past two years in the mortgage business, I believe that reputation risk is the biggest risk we face right now. Going forward, this risk will only get bigger. We need to prepare for it and to make sure that we take a multi-layered, culturally embedded approach involving the board, senior management, and every employee. Ensure that your people, practices, and products are aligned with your vision and values. Your reputation risk should be monitored, measured, and managed like all other types of risk.

Although I've recommended this in a previous letter, I once again urge you to consider RMA's Risk Management and Governance Program for Board Directors of Financial Institutions. Developed with the Wharton School of the University of Pennsylvania, this intensive three-day program prepares board directors to play an active role in risk and governance oversight of their financial institutions. The program covers all aspects of sound risk management-including, of course, reputation risk.

Remember that risk management is a journey, one we can never complete. We must continually seek to circumvent emerging risks as well as the familiar ones. And yes, our reputations depend on our success in managing those risks. So protect the shine.

Jack Wixted, RMA Chair

[email protected]