Libby Bevin

Reputational risk is both an old and new phenomenon. If you ask senior executives whether they worry about their business’s reputation, they always say yes; that’s the old part.

More and more, managing reputation risk is becoming a more complex endeavor; that’s the new part. Reputation risk management, however, is still often overlooked in the risk assessment process. That makes little sense. Your company’s reputation is delicate, and managing the risks surrounding it should always be a top priority.

In the current social media landscape – which won’t recede any time soon – reputational risks are at an all-time high. Therefore, effective reputational risk management is necessary to maintain a positive relationship with customers, maintain brand equity, and achieve strategic business objectives.

Why Is Reputational Risk Important?

Reputational risk is crucial because it can pose a swift and dire threat to your business. Ruined reputations scare away current and potential customers, reduce revenue and profits, drive away employees, and sow distrust among your company’s stakeholders.

Moreover, recovery from reputational risk can be difficult since the internet allows past incidents to remain easy to find, even years after the fact.

The consequences of reputational risk are not always immediate or easy to track. Minor incidents can do cumulative damage over time, or explode when a pattern of misbehavior suddenly appears. So it’s incredibly valuable to track and manage reputation risk as much as you can.

Reputational Risk Management Strategies

Broadly speaking, risk management has five main strategies.

1. Avoidance: Avoid any areas or activities where a risk might occur.
2. Retention: Retention means that the organization accepts the risk and understands that losses are inevitable.
3. Sharing: Distribute the risk among multiple parties to reduce the losses for any single party.
4. Transference: Transfer responsibility for risk to another party entirely (say, by taking out an insurance policy).
5. Loss prevention: Accept the inevitability of the risk, but seek to minimize the potential loss and damage as much as possible.

Applying these traditional risk management strategies to reputational risk can be tricky. Reputation risk management is more challenging to pin down than most operational risks, and consequences can arise long after an incident occurs.

Insurance policies (a standard solution for most of the above strategies) aren’t available for your reputation. So, your best defenses against these risks are vigilance and preparedness.

Best Practices for Reputational Risk Management

Reputational risk is challenging to contain and can be unpredictable. There’s also no time limit on when a risk event could cause harm to your reputation down the line. Here are some best practices to consider.

Track Mentions and Conversations Surrounding Your Brand

Social media is a helpful tool to prevent reputational damage, control business risk, and minimize its effects. By paying attention to the comments on your posts and how users talk about your brand on Twitter, Instagram, and Facebook, you can maintain a real-time grasp of how your company is perceived.

Instill a Strong Ethics Program at Your Company

Develop a robust code of conduct for your organization and make those ethical values the core of your business planning. Strong ethics must be clearly practiced by senior management and the board of directors to be most effective.

While it’s impossible to avoid reputational risk entirely, you can prevent its effects by integrating ethics into your corporate practices and decision-making processes. It’s also essential to move swiftly when infractions of these values occur.

Hire Marketing and Public Relations Professionals

Positive brand building and unified messaging can be vital tactics in managing reputation risk. Investments in marketing and public relations initiatives can be an indispensable part of your crisis response team if your reputation takes a hit.

What Risks Do Third Parties Pose to My Organization?

Suppliers, vendors, stakeholders, and contractors can potentially harm your organization’s good reputation. While you may perform due diligence when entering a contract with a third party, these relationships can change over time. You may not be privy to personnel or policy changes within your business partners after the relationship begins.

Reputational damage by association is a real possibility. For example, celebrities or politicians who mention your brand can harm your reputation if they are viewed negatively by your customer base.

Include Third-Party Reputational Risk in Your Risk Assessment Strategy

Before building a relationship with an outside company, consider what reputational risks it may pose. As a part of the risk assessment and risk analysis, investigate the third party’s reputation and social media mentions. You may find nothing, but the risk is significant enough that it shouldn’t be ignored.

Besides avoiding third parties with questionable reputations, you also want to build business decisions and initiatives around working with companies with strong reputations. It’s good to surround yourself with other organizations that emphasize values such as corporate social responsibility.

Monitor Your Contractors and Vendors as Carefully as You Do Your Own Organization

Their names should be tracked, both on social media and through standard news outlets. You’ll want to be the first to know if their public image begins to sour.

Have a Plan in Place for Mitigating Third-Party Risks

Whatever trust you place in your vendors, it’s still wise to have contingency plans and be prepared to distance yourself from them if necessary. Your public relations and crisis management teams should also be prepared for handling negative press caused by third-party mentions.

Reduce Your Reputational Risk With ZenGRC

Strategic risk assessment of any kind is a challenging endeavor. ZenGRC is an easy-to-use platform that allows you to track your compliance and enterprise risk management, giving you more time to run your business.

Policies, risk assessments, and internal controls must be documented and updated regularly to assure they meet the evolving environment. With ZenGRC’s document repository, policies and procedures are revision-controlled and easy to find.

Workflow management features offer easy tracking, automated reminders, and audit trails. The ZenConnect feature enables integration with popular tools, such as Jira, ServiceNow, and Slack, assuring seamless adoption within your enterprise.

Insightful reporting and dashboards provide visibility to gaps and high-risk areas. By better understanding your risk landscape, you can take action to protect your business from cyberattacks, avoid costly data breaches, and monitor the risks posed by your vendors.

Schedule a demo and learn how ZenGRC can help your company succeed.

In the modern business environment, managing risk is an organization’s top priority. Typically the risk management process includes a number of steps that should be repeated often and with each new project: risk identification, risk analysis, risk prioritization, and risk treatment.

The most important step in the risk management process may well be risk treatment – that is, deciding what you’ll do about a risk once it has been identified. There are a number of paths your organization can take. Most common are four potential risk treatments: risk reduction (risk mitigation), risk transfer, risk acceptance, and risk avoidance.

In this article we’ll take a closer look at risk avoidance as a mitigation strategy, so that your organization can better determine whether avoidance is the right risk treatment for you.

First we need to dive a little bit deeper into risk avoidance and what it is.

What Does Risk Avoidance Look Like?

In project management, risk avoidance is a strategy that businesses can adopt to reduce their level of risk by avoiding certain high-risk activities altogether. Simply put, risk avoidance means not taking risks.

That said, organizations can’t eliminate all of their risks entirely. The right risk avoidance strategy, however, can help your organization prevent some of the losses associated with risks. A risk avoidance strategy is an important part of any risk management plan, and it’s especially useful for protecting your assets from potential losses.

Although many businesses may already have business insurance or a professional liability insurance policy (also known as errors and omissions insurance) to protect them from lawsuits, a risk avoidance strategy can provide an additional layer of protection.

Avoidance typically involves running your organization in a way that eliminates certain hazards and exposures that might result in a lawsuit or some other financial loss. A comprehensive risk avoidance strategy is one designed to deflect as many threats as possible, to avoid the costly and disruptive consequences of an unexpected event such as a security breach.

An example of risk avoidance might be a manufacturing business not using certain hazardous materials or chemicals due to the dangers of handling and storing them; or, an organization limiting the type of customer data it stores on its computers in case of a cyberattack. The latter of these two examples has more to do with cybersecurity risk and digital risk management in general.

Risk avoidance is just one type of risk treatment. In risk management, the type of risk treatment you choose is typically decided according to the type of risk and which treatment will be most effective for managing that risk. As mentioned above, other risk treatment types include risk acceptance, risk reduction or risk mitigation, and risk transfer.

Risk acceptance means choosing to accept a risk without taking any actions to mitigate it. Risk reduction seeks to eliminate the potential risk and the potential for damages and financial consequences of a disruptive event by mitigating risk. Risk transfer means contracting with a third party to assume the risk and its consequences on your behalf.

Risk avoidance seeks to eliminate a potential risk and the potential for damages and financial consequences of a disruptive event. Ultimately, your organization should use a combination of risk treatments, including both risk avoidance and risk mitigation strategies when managing risk. Together, they can greatly reduce the likelihood of a liability lawsuit or some other form of financial loss.

What Are the Downsides of Risk Avoidance?

While risk avoidance might seem like the right answer to all risks, avoiding risks can also mean losing out on the potential gain that accepting the risk can bring. For example, an organization might refuse to purchase a property or business to avoid legal liability. By avoiding that risk, however, the organization will forego a number of potentially lucrative business opportunities.

For this reason, it’s important that your organization follows a robust risk management program that considers all of the possible risk treatments available, to decide which will work best for you. In some cases, you may find that risk mitigation or risk acceptance are better strategies than risk avoidance.

Best Practices for Risk Avoidance

To avoid risks, your organization will need to design and implement the right policies, procedures, technology and employee training to support your objective. We’ve compiled some of the best practices for risk avoidance as a risk management strategy.

Start at the Beginning

Before you get too far into risk avoidance as a risk management strategy, you first need to make sure that all the other parts of your risk management process are working correctly. As part of your risk management program, you should frequently revisit all the steps in the process and make any necessary changes as new risks arise.

Risk identification begins with a risk assessment and a risk analysis; make sure that these processes are well documented and that they’re replicable. It is nearly impossible to avoid risks if you don’t know what those risks are.

Once you’ve assured that these components of your risk management program are up to speed, you can start thinking about risk treatment options. Keeping a risk register throughout the risk management process will help you identify more clearly which risks require which treatments. You can also use a risk heat map to help you better visualize your risk management strategy.

Document Everything

Just like the risk management process itself, you’ll need to make sure you document everything that has to do with your risk avoidance strategy. This means maintaining a paper trail, including signed documentation and written correspondence. Documentation reduces the chances of a misunderstanding, and it gives you the evidence you need in the case of an audit or a lawsuit.

You should also follow up on any verbal agreements with a letter or an email to confirm the details in writing. Additionally, it would be wise to have an attorney examine your contracts, leases, and agreements.

Keep Open Communication

Make sure that your clients, employees, and any other business stakeholders are informed as clearly as possible. This includes defining what you plan to deliver for products and services, as well as letting your clients know about any disruptions. Make sure that clients are aware of, and agree with, any key milestones or changes that happen during a project.

You also need to make sure that your employees and team members all understand their risk management duties. For each identified risk, make sure that there is an owner who is responsible for executing the appropriate risk treatment. Again, a risk register can help you keep track of this information.

Provide Education

Helping your customers, employees and business stakeholders understand the best practices for risk avoidance can not only demonstrate just how seriously your organization takes risk management. It can also help to reduce the risks associated with these actors by encouraging them to do the same.

To do so, you should consider providing specialized training and education for your employees, business partners, and clients. Security awareness training works because it helps end-users better understand how their actions affect your organization, and why those actions are important.

Ultimately, you can put all sorts of policies, processes, and programs into place, but they won’t be effective until the people using them can articulate why those mechanisms exist in the first place. Building a risk-aware culture isn’t easy, but it can make the difference between a successful risk management program and one that fails.

Choose Tools to Help

For most organizations, the risk management process is time consuming and expensive. From risk identification to risk avoidance, there are a lot of moving parts that need to be addressed, and it can quickly become overwhelming, especially if you’re doing everything internally and relying on spreadsheets to get things done.

Fortunately, there are solutions designed to help.

Manage Risks with ZenGRC

No matter which risk treatment is right for you, the right software solution can help you better manage risks and mitigate business exposure by providing you with greater visibility and control across your organization.

ZenGRC from Reciprocity is risk management software that can help your organization pinpoint risks by probing your systems and finding cybersecurity and compliance gaps for you. Zen can even help you prioritize those risks and assign tasks to members of your team. Zen’s user-friendly dashboard lets you see in a glance the status of each risk and what needs to be done to address it.

Zen also generates an audit trail of your cybersecurity risk management activities, and it stores all the documentation in a single source of truth repository for easy retrieval come audit time. It also allows for unlimited self-audits so you always know where your organization’s risk management and compliance efforts stand.

At Reciprocity, a team of cybersecurity professionals is always looking out for you and your organization’s assets, making sure you get the best and most up-to-date cybersecurity risk management tools on the market.

With Zen, cyber risk management all but takes care of itself-leaving you and your team free to address other, more pressing concerns, like boosting your business and your bottom line.

Learn how we can fit into your business and schedule a demo today to get started on the path toward worry-free risk management, the Zen way.

YOUR COMPREHENSIVE GRC TOOL EVALUATION GUIDE

If you’ve ever invested in a GRC tool that proved too costly or challenging to implement, then you know how difficult finding the RIGHT solution can be.

There’s nothing worse than making a big investment in software that never even gets used. Or works only intermittently. And requires expensive and seemingly endless professional service calls for repairs. Right?

Not to mention the embarrassment of such a failure.

Fortunately, such mistakes-though common-can usually be avoided by performing a comprehensive evaluation of your organization’s current GRC management systems and processes, resources, and objectives.

Use this 6-Step Ultimate Guide to GRC Tool Evaluation, so you can see the greatest returns on your investment.

Inside the Guide, you’ll discover…

• 4 costly pitfalls of analog GRC management (e.g. spreadsheets).
• What a GRC platform is and how it can enable your organization to leverage new business opportunities.
• 8 ways a robust GRC tool can streamline and uplevel your GRC management.
• 5 roles in your enterprise the right GRC tool can optimize.
• 6 steps to evaluating GRC tools and selecting the best fit for your business.

USING RISK METRICS TO SET THE FOUNDATION OF YOUR ERM STRATEGY

Companies in every industry face risk on a daily basis. However, when a company reaches the enterprise level, it becomes unmanageable to tackle risk management manually via spreadsheets.

It’s at this point that they will typically turn to enterprise risk management (ERM) tools to empower them to scale their workflows and better identify, evaluate, monitor, and mitigate risks.

However, with a dynamic business environment, it can be challenging to assess risk tolerance and appetite as the first step to an ERM strategy.

In this eBook, we share how to calculate risk appetite and risk tolerance. You’ll learn:

• The difference between risk appetite and risk tolerance
• How to calculate residual risk
• How to use residual risk calculations to determine risk appetite and tolerance
• How to apply risk appetite and tolerance in the real-world

As a Product Line Manager for Reciprocity, Kerwyn Velasco is responsible for driving the strategy and execution of the next generation of our ZenGRC platform. From gathering information and ideas for new features and functionality, to demonstrating our latest innovations to customers, he is involved in all aspects of our product development.

Kerwyn’s Journey

Kerwyn has held many roles on his path to Reciprocity. After going to school for Accounting, he worked as an internal auditor and public accountant. He then transitioned to an IT Auditing role while pursuing his Master’s degree in Computer Information Systems. After impressing one of his client’s governance, risk and compliance (GRC) vendors with his skills, he began doing Professional Services implementations. From there, he pivoted to Sales, which gave him an opportunity to better understand the sales cycle and how it impacts every other part of a business. This eventually led him to Product Management, which enables him to leverage all of his previous experience and ‘own’ the business strategy behind a product, including specifying its functional requirements and managing the launch of new features.

“With every job I’ve had, I’ve been able to take the best ‘lessons learned’ from those positions and apply them to the next goal I wanted to achieve, whether it was a new role, a new industry, or even a new product. This wide range of experience is extremely valuable as a Product Manager, as you’re able to really understand your client’s point of view – what they need and what they want to accomplish – as you’ve been there too.”

Change is the Only Constant

Early in Kerwyn’s Product Management career, he experienced a challenging situation: after months of working on a new product – from ideation and research to prototypes and market validation – the project was delayed and then cancelled. While this isn’t an uncommon occurrence with an early stage, “in development” product, it can be extremely frustrating for new Product Managers.

“It’s easy to get disheartened when you learn a project you’ve been working on for months has been cancelled. However, you can’t take it personally. As a Product Manager, your role is to provide your team with the information they need to decide on the best course of action for the business. As your target market, your competitors, and even your organization change, so will your project. In fact, change is the only constant.”

Culture Counts

While Kerwyn has been able to experience (and enjoy!) several roles throughout his career, he acknowledges there’s something else that enables him to truly enjoy and embrace his role as a Product Line Manager at Reciprocity – and that’s the company culture. The culture at an organization not only sets expectations for how people work together. It also impacts how well they function as a team…and it’s all about teamwork at Reciprocity.

“Reciprocity has a unique culture that I really appreciate. Our Product Experience Team – which is made up of the Product Management and Product Design teams – is really close. We share everything, from our trials and triumphs to our music. (Our Spotify playlist is called ‘Effective But Not Compliant’!) But we also understand that personal time is just as important. And this is respected by everyone at the company, from the top down.”

What Comes Next

Kerwyn’s Product Management role at Reciprocity has coincided with his being more active in his profession. He’s an active member of his local Information Systems Audit and Control Association (ISACA), which enables him to give back to the organization that has provided him with so much opportunity. He has also been able to deepen his expertise in Security and Risk by becoming a ISACA Certified Information Security Manager (CISM). However, he continues to look for ways to expand on his current experience.

“I’m really impressed with our amazing Marketing team at Reciprocity, and feel that marketing is a ‘muscle’ that I have only begun to ‘flex’ in my career. While I understand certain elements from my time spent in sales roles, I’d really like to learn more about things like strategic partnerships and how they impact both product development and the business overall.”

The Next Challenge

Reciprocity continues to grow at an exponential rate, which is creating new career opportunities for people like Kerwyn, who are always ready for the next challenge. We know there is much more to come from Kerwyn, so definitely keep an eye on him – and his LinkedIn profile – to track his career!

Interested in a career at Reciprocity? Check out our current job openings.