Reputation can be seen as a critical intangible asset. It is an indicator of past performance and future expectations. In their book Invisible advantage, Jonathan Law and Pam Kalafut talk of reputation "In a sense a company's reputation is the ultimate intangible. It's literally nothing more than how the organisation is perceived by a variety of people. It is slippery, volatile, easily compromised, impossible to control, amorphous." It is different from image, which is a part of reputation. Image is the immediate external perception of an organization while reputation is something that is built over a long period of time and is based on the integrity of the organization. A good reputation indicates that the expectations of the shareholders match the actual performance of the company.
It is very easy for a damage to occur to the reputation of a company in today's globalized, technologically interconnected world. This is why understanding and managing it has come of utmost importance in business of all sectors.
REPUTATION AND ITS VALUE
'A good reputation is more valuable than money.'
-Latin maxim
Reputation is the perception of the organization in the eyes of the stakeholder. As mentioned earlier, a good reputation means that the performance and behaviour consistently meet or outdo the expectations of the stakeholders. A good reputation can help to attract and retain good employees and can prevent new competitors by acting as a barrier to market entry. The attitude of the regulators and the media are also influenced by the reputation of the organisation
Reputation has intrinsic value as an intangible asset. Reputation will not be found as a figure in the balance sheet, but it can be seen as the difference between the market values and the book values. Intangible assets which include reputation as well as employee loyalty, trust, brands and credibility account for 70 percent of the value of the business. This is why reputation is more important than ever before. In a way it is a very important source of competitive advantage because products and services are becoming less differentiated in today's world.
Reputational risk is important to banks mainly because of information asymmetry. Outsiders do not have as much information as the insiders of the company and for this reason, a good reputation is very important for the outsiders to make choices. It becomes all the more important in this period of rapid changes, globalization and meddlesome media.
REPUTATIONAL RISK
After having discussed Reputation, we go on to define what Reputational Risk is.
Risk to reputation is in fact the most amorphous and difficult to define of all the risks affecting an organization. There is no commonly accepted definition for Reputational risk. The Basel 2 Accord recognizes the existence of Reputational Risk but does not define it. It states that it is excluded from the definition of Operational Risk but it includes it in the scope of risks to be considered under Pillar 2.
Reputational Risk can be explained as the current and future impact on earnings capital caused by negative publicity. This affects the company's ability to establish news relationships and maintain old ones. Reputational risk exposes the company to financial loss or a fall in its customer base.
Few of the available definitions of Reputational Risk are as follows :
"Reputational risk arises from operational failures, failure to comply with relevant laws and regulations, or other sources. Reputational risk is particularly damaging for banks since the nature of their business requires maintaining the confidence of depositors, creditors and the general marketplace".[BIS, 1997].
The Committee of European Insurance and Occupational Pension Supervisors (CEIOPS) has defined reputational risk as follows :
"The risk of potential damage to an undertaking through deterioration of its reputation or standing due to a negative perception of the undertaking's image among customers, counterparties, shareholders and/or regulatory authorities."
In particular, with reference to banking and financial services, Professor Ingo Walter defined Reputational Risk in his paper 'Reputational Risk and Conflicts of Interest in Banking and Finance: The Evidence so far': "Reputational risk in banking and financial services is associated with the possibility of loss in the going-concern value of the financial intermediary - the risk-adjusted value of expected future earnings. Reputational losses may be reflected in reduced operating revenues as clients and trading counterparties shift to competitors, increased compliance and other costs required to deal with the reputational problem - including opportunity costs - an increased firm-specific risk perceived by the market."
We can see the effect of reputational loss in many banks. One such example is of Goldman Sachs. The Securities and Exchange Commission charged Goldman Sachs Group, Inc. with securities fraud in a civil suit, claiming the financial giant defrauded investors with a mortgage-related investment that was intended to fail. The SEC accused Goldman Sachs of failing to disclose vital information on a synthetic CDO that was peddled to clients while the bank bet against its success, knowing the bank was likely to come out the winner. The SEC says Goldman used hedge fund Paulson & Co. to pick particularly risky securities for the product with a higher chance of collapsing. The whole financial sector slid after the SEC's announcement. Goldman's stock fell over 12% Friday to close at $160.70 a share.
REPUTATIONAL RISK AND ITS LINK TO OPERATIONAL RISK
Reputational Risk is often linked to Operational Risk but there are distinctions between the two. According to Basle II, operational risks are associated with people (internal fraud; clients, products and business practices; employment practices; and workplace safety), internal processes and systems, and external events (external fraud, damage or loss of assets, and force majeure). Professor Walter in his paper 'Reputational Risk and Conflicts of Interest in Banking and Finance: The Evidence so far' talks about the link and gives a possible working definition for Reputational Risk. "Reputational risk comprises the risk of loss in the value of a firm's business franchise that extends beyond event-related accounting losses and is reflected in a decline in its share performance metrics. Reputation-related losses reflect reduced expected revenues and/or higher financing and contracting costs. Reputational risk in turn is related to the strategic positioning and execution of the firm, conflicts of interest exploitation, individual professional conduct, compliance and incentive systems, leadership, and the prevailing corporate culture. Reputational risk is usually the consequence of management processes rather than discrete events, and therefore requires risk control approaches that differ materially from operational risk."
Source : 'Reputational Risk and Conflicts of Interest in Banking and Finance: The Evidence so far' - Ingo Walter
Figure 1 shows the hierarchy of risks confronting financial intermediaries. The top three risks in the figure - Market Risk, Credit Risk and Liquidity Risk have a high degree of manageability while the lower three- Operational Risk, Sovereign Risk and Reputational Risk do not. Reputational Risk is considered to be the most intractable. It has poor time series and cross-sectional data availability and limited metrics to assess volatility and correlation. We can also say that the linkages associated with Reputational Risk are among the most difficult to manage and assess.
PRIMARY RISK OR CONSEQUENTIAL RISK
Some organizations consider reputational risk as primary risk while others consider it a consequential risk. For example, we can look at these contrasting, if not contradictory statements about Reputational Risk :
"Reputational Risk is about getting everything else right" meaning to say that if all other risks are managed satisfactorily, there will also be good reputational risk management.
"Reputational Risk is the starting point for all risks" meaning to say that the management of all other risks is based on good reputational risk management.
According to Economist Intelligence Unit(2005) survey, 52% of the senior executives interviewed consider reputation risk as a risk by itself, while 48% consider it as a consequence of other risks" like operational risk - people, process, systems and external events - compliance and financial.
Majority of the reputational loss can be considered as a second order impact while there are a number of reputational risks that can be considered as an independent risk. The Economist Intelligence Unit referred to reputational risk as "the risk of risks". Credit, Market or Operational losses are capable of affecting the reputation of an organization as a second order impact. However it must be noted that the damage caused by reputational loss could prove to be more important than the first order impact itself.
A striking example is Northern Rock. This bank faced problems because of inadequate liquidity risk management. It did not address its dependence on money market funding, which dried up in the time of the credit crunch. But Bank of England provided a liquidity support facility, helping the bank to fund its operations. This helped the bank to take the required actions to resolve its structural problems. In the end, the bank was affected more by the erosion of consumer confidence than the liquidity problem itself.
ROLES AND RESPONSIBILITIES
The survey mentioned earlier also had findings about roles and responsibilites. 84% believed that the CEO was in charge, while the rest believed that the CRO, head of business units, communications manager were also responsible.
The CEO is regarded as the individual with primary responsibility for managing reputational risk by most organisations in the survey. It is the CEO's responsibility to provide an ethical identify for their companies. They also co-ordinate the response of other senior managers to reputational threats and crises. The chief risk officer (CRO) has a more technical role. The CRO attempting to quantify threats to reputation and policing systems to make sure that they are properly enforced. Though the board of a business is the ultimate custodian of a business's reputation, managing reputational risk requires a team effort from everyone involved in the business: the executive and non-executive directors, senior and middle managers, public relations staff, risk and audit professionals, key business partners etc
SOURCES OF REPUTATIONAL RISK
Few of the sources of reputational risk are : Non-compliance with regulatory/legal obligations, Exposure of unethical practices, Security breaches, Failure to deliver minimum standards of service/product quality to customers, Poor crisis management ,Failure to hit financial performance targets , Risk by association with 3rd party suppliers/partners with a poor reputation, Failure to address matters of public concern (e.g. climate change/trading with unpopular regimes) ,Environmental breaches, Labour etc
ICAAP REGULATION
A fiercely debated topic is whether a financial institution must set aside capital for reputational risk. Setting aside capital for any risk, requires that there is a commonly accepted quantitative assessment technique to measure the risk. For reputational risk, it proves to be difficult to do so, because there is no commonly accepted method to quantify such risks.
Many firms are arguing that the reputational risk can be assessed mostly on a qualitative basis. The Committee of European Banking Supervisors recognize that while capital has an important role to play in managing risks, it may not be the best option. For risks like reputational Risk, the focus of ICAAP could be on a more qualitative level.
According to Basle 2, Reputational Risk does not require a minimum capital requirement, but regulators for the second pillar are allowed to ask banks to improve their economic capital in case of scandals which could affect their perception among stakeholders. This process is called Internal Capital Adequacy Assessment Process (ICAAP)
In the end, it does not matter whether firms have quantified their reputational risk or not, what matters is that they are able to manage it in a way that reputational risk is reduced to a minimum. This does not mean that quantifying reputational risk is not important.
We pay attention to ways to quantify this risk in the next section.
MEASURING REPUTATIONAL RISK
Companies struggle to categorise, let alone measure, reputational risk. As mentioned earlier, measurement can be done in qualitative and quantitative terms
QUALITATIVE MEASURES
In qualitative terms, Risk rating scales can be used both for the assessment of likelihood and severity. It is said to be of high likelihood if it is likely to occur at least once per year, medium if it is likely to occur once every few years and low if it has remote probability of occurrence.
In terms of severity, it is said to be of high severity when the opinion of regulators, clients and the public is affected leading to a fall in customer base. The management does not take timely action in response to changes in the market. Exposure from Reputational risk is expected to continue in the near future.
It is said to be medium when the management responds adequately to the changes in the market. In this case only few clients are lost, customer complaints are manageable and the exposure from the risk is not expected to increase in the coming future.
The aggregate level of reputational risk is said to be low when the management anticipates and responds well to the changes in the market. In this case, the exposure from reputational risk is expected to be low in the coming future.
QUANTITATIVE MEASURES
In order to quantify reputational risk, many models have been proposed.
In order to estimate the existence of a negative reputational effect , we can look at a multifactor model based on the traditional market model.
EDIT.DELETE REP TERM
We introduce a dummy variable to study the effect of reputational loss.
Reputational factor (Rrep) is the dummy variable for the reputational effect. The reputational model specification is therefore
where:
Ri,t is the daily return of the bank i at time t;
Rm,t is the daily return of the stock index m at time t;
Rrep,t is the reputational dummy variable.
The one-factor market model mentioned above is used in many papers that study the effect of Reputational Risk. In one of the papers 'Measuring Reputational Risk: The Market Reaction to Operational Loss Announcements' by Perry et al, reaction of the firm's stock price to operational loss announcements is measured. Without reputational effects, the market value of the firm will fall with the announced loss. Any losses that exceed the announced loss amount are taken as the reputational losses.
An alternative model is the multifactor model proposed by Ross in 1985, so to analyse the industrial factor
RBanks;t is the banking sector yield at time t.
We can now introduce the independent variable to estimate the reputational effect
The reputational model when estimated in case of scandal is generally able to measure the magnitude of market value changes due to the negative event.
Another approach is the actuarial approach, whose focus is the loss distribution. In this approach, banks have to calculate two distributions: one for frequency and one for loss severity. These two are modelled separately and then aggregated using either Monte Carlo or numerical techniques. The aggregate loss distribution can be found by combining the two distributions over a fixed period.
ADVANTAGES AND DISADVANTAGES OF QUANTIFICATION APPROACHES
Quantification is a science and it can prove to be useful even when there are large uncertainties. It contributes to intelligent decision making and makes the risk more tangible and easier to handle. Quantification also proves to be useful in forecasting and hence preventing such losses to happen again.
Though many models exist to quantify reputational risk, one of the major disadvantages of these approaches is the non-availability of data regarding the reputational loss. Another problem in quantifying reputational risks is the scarcity of appropriate data; banks will rarely make their history of reputational loss known to the public and hence it is difficult to model these losses.
MANAGEMENT OF REPUTATIONAL RISK
There are 2 different ways to manage reputational risk
Ex-ante approach is to minimize the causal factors. Ex-post is to minimize the damage to the reputation of the bank.
The reputational risk management process can be seen to encompass the following:
These is the reputational risk management process explained in the paper 'The framework for integrating reputation risk into the enterprise risk management process' by Laureen Regan.
It includes defining the strategy, identifying the events that may lead to reputation damage, assessing on the basis of likelihood and severity, mitigating the risk, communicating with internal and external stakeholders and monitoring and updating the events to avoid further damage.
1. Defining the strategy: The first step of the process requires the firms to define the strategy for reputation risk management. This includes defining the goals of reputation risk management, how it is going to be measured, whose responsibility it is to manage it, what are the expectations of the stakeholders
2. Identification: Once the strategy for reputation risk is defined, the firm needs to identify its risk exposures. This step includes identifying the potential risk as primary risk or consequential risk. The identification process should consider risks at the country, industry and firm levels. Reputation damage could be through events such as allegations of fraud, violations of ethical standards, breaches of customer information security etc. As can be seen in the figure below, it has 3 basic components: selecting a team with adequate knowledge about the firm and the industry, specifying the level of analysis and then classifying the risk events.
3. Assessment: This step includes qualitative and, where applicable, quantitative assessment of reputational risk and its consequential risks. In qualitative terms, risks are sorted on the basis of likelihood and severity of reputational damage.
4. Mitigation: For each risk event that is ranked among the highest priority, the firm next investigates the causes of the potential reputation damage. The firm then plans how to reduce the likelihood of the event occurring and if it does occur, how to reduce the severity of damage. The firm must also have a plan in place to manage the media. The firm must appoint a spokesperson to communicate with the media and the key stakeholders. Finally, if the cause of the event that draws the attention of the media is within the firm's control, the firm needs to accept responsibility, apologize, and communicate steps taken to address the cause of the event. This provides assurance that the event will not happen again, and signals the integrity of the firm's management.
5. Communicate: The final step of the reputation risk management process is to communicate the results of the process throughout the firm. This is where roles and responsibilities become clear, what each person needs to contribute to protect and enhance the firm is defined.
6. Monitor and Update: This step involves regular tracking of all the actions in order to account for new risks. The environment of the firm and the industry is constantly changing to update for any changes in the market, and hence the process must be monitored and updated periodically so that the firm is prepared to handle any new risks to reputation.
CASE STUDY
In this section we look at one particular case of loss of reputation in detail. We look at the Banesto Fiasco.
Banco Español de Crédito (Banesto) was the then 4th largest Spanish banks. On December 1993, the Bank of Spain took control over Banesto. This had effects on the shares of J.P Morgan and Co as well. This was because J.P Morgan and Co was very closely linked to Banesto. Morgan had been advising Banesto on its financial and business affairs since 1987. Morgan's involvement increased in 1992 because it began to advise Banesto on how to raise capital. In 1993, Morgan helped Banesto raise U.S.$710 million. Morgan and Banesto were also linked through Corsair, when Corsair invested U.S.$162 million in Banesto. In a letter dated December 27, 1993, Morgan wrote to the Bank of Spain's Governor outlining how Banesto could continue to raise capital including a bond issue that Morgan was planning to launch in the first quarter of 1993. But Bank of Spain took control of Banesto on the next day citing mismanagement and reckless lending. This takeover also affected the reputation of J.P Morgan and hence the value of its shares diminished tremendously.
Next we look at the paper 'Reputational risk and conflicts of interest in banking and
finance: the evidence so far' by Ingo Walter in which this case has been studied.
In order to study the effect of the Banesto fiasco on the J.P. Morgan share price, the paper uses conventional event study, as in De Long and Walter (1994). First a sample prediction of returns of the Morgan stock is created, by regressing the daily return of Morgan stock against the daily return of the market index as well as on an industry-group index.. Then the predicted returns are compared to the actual returns on the shares after the announcement of the Banesto take over announcement. The difference is considered the excess return attributable to the event.
The data which is used is from 300 days to 50 days prior to the announcement date which is December 28th. The resulting coefficients are then multiplied by the returns on the market and industry indices from 50 days prior to 50 days after the announcement. The indices used in the paper are NYSE index and the industry group composed of 20 banking and securities firms. The excess return is then calculated by subtracting the actual Morgan stock returns from the predicted returns and the cumulative excess return is plotted. The cumulative excess return is then multiplied by the market value of equity 50 days before the announcement. This amount is actually the difference between what shareholders would have received had they sold their shares in the market 50 days prior to the announcement and what they would have received if they had sold them on subsequent days. The results of the paper show that
"A few days before announcement, the returns began to decline. Thereafter, an essentially steady decline occurred. A cumulative loss of 10% of shareholder equity value is apparent 50 days after the announcement. When we look at the shareholder value loss in monetary terms we find that the 10% loss in shareholder value translates into a loss in JPM market capitalization of approximately U.S.$1.5 billion versus a maximum direct loss of only U.S.$10 million from the Banesto failure. This analysis suggests that the loss of an institution's franchise value can far outweigh an accounting loss when its reputation is called into question"
The takeover of Banesto can be seen to affect the reputation of Morgan. The fact that Morgan could not turn around Banesto, lead to doubts of Morgan being successful in advising clients.
"The damage J. P. Morgan has done to themselves financially is nothing compared to the damage they have done to their reputation," said Rosie Erskine, an analyst with Barclays de Zoete Wedd, a London brokerage firm.
