The Need for ERM is Crystal Clear

Unlike the waters of the Gulf of Mexico, the need for companies to have robust enterprise risk management (“ERM”) programs became crystal clear during an interview of former BP CEO Tony Hayward aired this week by the BBC. Here’s some of the highlights from the interview.

Former BP PLC chief Tony Hayward has acknowledged that the company was unprepared for the disastrous Gulf of Mexico oil spill and the media frenzy it spawned, and said the firm came close to financial disaster as its credit sources evaporated.

In an interview with the BBC to be broadcast Tuesday, Hayward said company’s contingency plans were inadequate and “we were making it up day to day.”

Hayward said BP had found itself unable to borrow from international investors during the spill crisis, threatening its finances. He said that before a meeting with President Barack Obama at the White House in June, “the capital markets were effectively closed to BP.” “We were not able to borrow in the capital markets, either short or medium term debt at all, ” he said. “It was a classic financial crisis issue.”

Hayward’s successor, Bob Dudley, told the program that “these were frightening days” for BP. “With a company the size of BP, its reputation, what it does — you almost can’t quite believe how close you are” to financial disaster, he said.

This interview demonstrates the catastrophic impacts of a risk event not only to the environment at large, but also to every corner of the company responsible for the event occurring. BP obviously did not have a comprehensive ERM program at the ready that resulted in improvisation and ultimately a full-blown crisis. Only a company of BP’s size and resources could weather this type of event. So, how effective is your ERM program?


ERM Helps Avoid Risk Miscalculations

A recent article in the New York Times discusses the inherent failings in estimating risks in our society today.  As our environment becomes more complex, people are faced with ever-increasing amounts of risk that are difficult to quantify until it is too late.  Here is an excerpt from the article that explains the challenge very well.

But there also appears to have been another factor, one more universally human, at work. The people running BP did a dreadful job of estimating the true chances of events that seemed unlikely — and may even have been unlikely — but that would bring enormous costs. Perhaps the easiest way to see this is to consider what BP executives must be thinking today. Surely, given the expense of the clean-up and the hit to BP’s reputation, the executives wish they could go back and spend the extra money to make Deepwater Horizon safer. That they did not suggests that they figured the rig would be fine as it was. For all the criticism BP executives may deserve, they are far from the only people to struggle with such low-probability, high-cost events. Nearly everyone does. “These are precisely the kinds of events that are hard for us as humans to get our hands around and react to rationally,” Robert N. Stavins, an environmental economist at Harvard, says. We make two basic — and opposite — types of mistakes. When an event is difficult to imagine, we tend to underestimate its likelihood. This is the proverbial black swan. Most of the people running Deepwater Horizon probably never had a rig explode on them. So they assumed it would not happen, at least not to them. Similarly, Ben Bernanke and Alan Greenspan liked to argue, not so long ago, that the national real estate market was not in a bubble because it had never been in one before. Wall Street traders took the same view and built mathematical models that did not allow for the possibility that house prices would decline. And many home buyers signed up for unaffordable mortgages, believing they could refinance or sell the house once its price rose. That’s what house prices did, it seemed. On the other hand, when an unlikely event is all too easy to imagine, we often go in the opposite direction and overestimate the odds. After the 9/11 attacks, Americans canceled plane trips and took to the road. There were no terrorist attacks in this country in 2002, yet the additional driving apparently led to an increase in traffic fatalities.

The best way to avoid miscalculating risks is to develop a disciplined enterprise risk management program with a solid framework to help quantify the level of risk.  Wheelhouse Advisors can help.  To learn more, visit

Reputation Is Everything

In last month’s issue of Operational Risk & Regulation magazine, Goldman Sachs’ operational risk management program and its focus on reputational risk was profiled.  The article focused on Goldman Sachs’ use of scenario analysis in anticipating the magnitude of reputational risk events.  Scenario analysis exercises such as these are very useful tools to increase the risk awareness within an organization.  Here is a summary of Goldman Sachs’ approach.

Goldman Sachs is using scenario analysis to study reputational risk, employing operational risk expertise within its broader risk management framework, according to its global co-heads of operational risk management, Spyro Karetsos and Mark D’Arcy.  The bank says it embraces events, even those creating more reputational risk exposure than financial risk exposure, into its framework.  “Franchise value is highly important within the organisation and managing reputational risk is a by-product of that,” says Karetsos, who is based in New York. “While it is not our responsibility to quantify reputational risk, there is an internal process that measures our exposure to those risks that are difficult to quantify, one of which is reputational risk.”

The timeliness of this story is ironic given the potential massive impact to the bank’s reputation as a result of the fraud charges levied by the Securities and Exchange Commission on Friday.  Once the announcement was made, the bank lost close to $12.5 billion in shareholder value by the end of the trading day.  Whether that loss can be overcome remains to be seen.  However, it does prove that in business, reputation is everything.

Reputation Risk Must Be Actively Managed

As the survivors begin to emerge from the carnage of the financial crisis of 2008, corporate reputations are once again viewed as a highly valued asset.  The primary challenge for these surviving companies is to rebuild trust while managing their reputations in a way that aligns with their corporate strategy.  Once they become misaligned, it is very difficult (if not impossible) to bring them back in sync.   Here is what Anthony Johndrow had to say in a recent article from Forbes magazine.

Today it’s about balancing the seven dimensions that make up corporate reputation (product/service, innovation, governance, workplace, citizenship, performance and leadership), namely going beyond product and service promises that are still rooted in 20th-century brand-building assumptions. The evolution of the role of chief reputation officer is still in its infancy, but one thing is clear: It’s not about just getting involved in social media, it’s about giving the company a voice in the formation of its reputation.

Every company has a reputation, regardless of whether or not it has a strategy behind it. Thus, today’s reputation stewards must give voice to their companies. If they do not, their reputations will be driven only by accident (as a result of company actions that don’t benefit from expert CRO guidance–see recent financial crisis for numerous examples) and by conversations among people who might not be their best friends. That is a recipe for disaster, no matter who is keeping score.

Many companies may not go as far as creating a full-time chief reputation officer position.  However, it is critical that someone is on point for managing a firm’s reputation and that it is actively monitored.  In the highly connected and media driven society that we now live, a company’s reputation and brand value can be destroyed in an instant.

Reputation Risk Takes Center Stage

A new report about reputation risk management was released this week by The Conference Board.  The report is based on the findings of The Conference Board Reputation Risk Research Working Group and a survey of 148 risk management executives of major corporations.

More than three quarters of the respondents to the survey said their companies are making a substantial effort to manage reputation risk (82 percent) and they have increased focus in this area over the last three years (81 percent).

Other key findings of the study:

  • Reputation risk should be managed throughout the organization. Although communication is of critical importance in responding to a risk event, a company’s reputation should be considered during the preparation and execution of strategy and new projects, which hasn’t been the case in most companies.
  • Reputation risk is often not incorporated into risk management. Only 49 percent of executives surveyed said that the management of reputation risk was highly integrated with their enterprise risk management (ERM) function or another risk oversight program.
  • Assessing reputation risks is a top challenge. Fifty-nine percent indicated that assessing the perceptions and concerns of stakeholders was an extremely or very significant issue, making it the highest-ranked challenge.
  • Media monitoring has become more sophisticated. Today, there are tools to assess whether coverage is positive, neutral or negative; the credibility of publications; the prominence of coverage, etc.
  • Efforts are being made to quantify the value of reputation. A select group of companies is making progress in this area by working with specialist consulting firms to quantify the impact of reputation on share price.
  • Social media are gaining influence, but most companies are ignoring them. Although consumers and investors are increasingly gathering information from blogs, online forums, and social networking sites, only 34 percent of the survey respondents said they extensively monitor such sites, and only 10 percent actively participated in them.

Given the speed and efficiency of today’s modern communication and news infrastructure, reputation risk should be a serious concern for all companies.  As Warren Buffett said, “It takes 20 years to build a reputation and five minutes to ruin it.”