Most boards define risk more narrowly than they realise

Simon Thomson:

Ask a board to list its principal risks and you will typically get things like operational failure, regulatory exposure, and financial volatility. Creditable, but there’s often something missing.

Most boards define risk more narrowly than they realise. They focus on threats that are visible and measurable. Reputational risk is harder to quantify, meaning less attention is paid to the questions of who owns it, how it is monitored and what your response looks like.

Yet reputation is rarely a standalone risk. It is the lens through which operational, financial and governance failures are judged by customers, regulators, investors and employees.

Not a level playing field

Boards also underestimate reputational risk because they fail to recognise that reputational contests are not fought on a level playing field.

I spent more than two decades leading organisations through complex situations in the energy sector – including sovereign disputes, hostile activist campaigns and coordinated environmental pressure. In each case, the fundamental asymmetry of the playing field was the same. Those seeking to damage your reputation operate without constraint: no requirement to verify, no regulatory obligation to disclose, no legal sign-off before publishing a claim. You face all of those constraints.

UK PLC is particularly exposed to this dynamic. Companies are bound by disclosure obligations and market rules, while opponents often face no equivalent constraints. Your detractors are not playing to the same rules as you. This fact needs to be understood and accepted – and it means reputational risk should be given more attention, not less.

The energy sector – where I’ve spent my career as a CEO and chair – should be ahead of the curve. Strong safety and business continuity disciplines have embedded rigour around anticipating operational failure: risks are modelled, scenarios tested and procedures rehearsed. There’s genuinely impressive rigour and thinking behind all of this.

Despite the fact that that rigour is an example from which many businesses and functions could learn valuable lessons, the reputational dimension tends to lag. You can see it even among the largest names in the sector: when a high-profile situation arises, the communications response can struggle to keep pace with events, and it quickly looks like the reputational dimension was not meaningfully built into the preparation.

Everyone’s responsibility, nobody’s responsibility

Part of the reason, experience tells me, is structural rather than psychological. Boards often avoid the conversation because reputational risk feels difficult to define and assign. Operational risks have owners, metrics and reporting cycles. Reputation often sits across or between functions, making it everyone’s responsibility – and therefore nobody’s.

But these are not adequate excuses. Directors have a responsibility here that is not discretionary. Properly considering risks affecting the business – including reputational risk – is a fiduciary obligation, not a nice-to-have. Boards that defer it because they are too busy have not made a sensible decision about resources; they have quietly created an exposure.

There is a further structural problem that surfaces when things go wrong. In many organisations legal advice is developed in one room and communications advice in another. The result can be legally robust decisions that are reputationally disastrous, or communications that create unnecessary legal exposure. The disciplines need to be integrated from the outset.

Organisations that handle reputational crises well are almost always those that have done adequate crisis planning beforehand. It doesn’t necessarily require elaborate plans or large in-house teams, and I understand that some may feel they’re at risk of overplanning for something that might never happen.

But the greater risk is taking a laissez-faire, ‘cross that bridge if we come to it’ approach. The best boards do not simply ask, ‘What could go wrong?’. They ask, ‘How would this look to our stakeholders if it did?’. That shift in perspective often changes the discussion entirely. 

+++

Simon Thomson is a former chief executive of Cairn Energy PLC (now Capricorn Energy PLC), and currently Chair of Rockhopper Exploration Plc and a Senior Adviser to Alder, a reputation risk and crisis advisory consultancy.