Headlines from Recent Bank Scandals Are Their Own Problem

Revelations over the last several weeks regarding business practices at Wells Fargo and ongoing financial problems at Deutsche Bank once again underscore the importance of effective reputational risk management practices.

While these two firms just happen to be in the negative spotlight now, reputational risk is an issue that affects all types of companies large and small, financial and nonfinancial. Automakers, energy producers and even mobile phone manufacturers are not immune to the kind of negative headlines that hurt many firms during the financial crisis and the LIBOR-rigging scandal, among others. Dissecting the factors contributing to these events and the subsequent responses by firms provides some insight into what banks can do to elevate their awareness of these risks and steer away from potential reputational nightmare scenarios.

In general the banking sector has not historically placed a high priority on reputational risk — compared to credit, market or operational risks. Only within the last several years, for instance, has the Basel Committee incorporated reputational risk into its capital framework, and the Basel framework still does not consider it a direct risk to capital. Reputational risk has remained somewhat of an orphan relative to operational risk or other more traditional risks, which have dedicated teams of risk professionals, processes and controls in place.

A lack of hard data to measure the cost of reputation risk and the relatively unstructured and indefinite nature of reputational risk pose major challenges for banks in assessing this risk, even for those that are effective at managing more traditional bank risks. Reputation risk usually manifests itself by way of some other risk. Reputations of many well-known banks during the crisis suffered as a result of some other emerging risk such as credit, operational or liquidity.

The nature of reputation risk in the industry has not been the subject of much empirical study. Yet we do have some insight on how this type of risk affects institutions. For example, one analysis by Perry and Fontnouvelle before the financial crisis found that losses driven by internal fraud tend to have a bigger reputational hit on a firm — as measured in market value decline — than losses driven by external factors such as a cyberattack on a bank customer database. The researchers also found that reputational harm can be greater in instances where a firm with strong corporate governance practices experienced an internal fraud event. In other words, reputational problems can amplify when the market is surprised by a negative outcome from an otherwise well-governed firm. And reputational events can have tangential costs. Direct and indirect losses from lost or reduced business opportunities; regulatory penalties and litigation expenses compound the pain of reputational risk events.

It is likely that banks for several reasons have understated the cost of reputational risk. First, a short-term focus on earnings translates into shortcuts in key processes and activities. In turn, the potential cost associated with a later misstep that results in a reputational risk event is hard to quantify. And the effect of social media on reputation should not be understated. The speed at which breaking news — good and bad — reaches the public simply amplifies the impact from an event. Such factors increase both the likelihood of a reputational risk event and its severity.

An array of practices can mitigate the potential for reputation risk. Understanding and clearly articulating the bank's tolerance for reputational risk is critical. Risk appetite statements should include a clear expectation that the bank's reputation is a key asset that must be protected at all cost. Southwest Airlines, a company with one of the best long-term safety records in the industry, embodies the essence of such an approach in what it refers to as its "Warrior Spirit" philosophy. The strategy translates into a relentless pursuit of excellence surrounding every aspect of safety and customer service. This mentality leads to a proactive approach to identifying any strategies, processes or activities that could lead to a major loss and in turn a headline event.

In the course of evaluating existing and new business ventures, the cost of reputational risk needs to be incorporated into risk assessment processes. Working through potential scenarios that could lead to reputation risk must be weighed objectively against short-term goals. Key risk indicators should be developed around reputational risk. Business and risk departments should further have a portion of their incentive compensation structured around mitigating reputation risk, including explicit clawbacks. Board risk committees should include a discussion around reputation risk in order to create transparency and focus at the highest levels of the organization.

Unfortunately it seems that just as everyone tends to drive a bit slower after passing an accident on the side of the road, only after a major reputational event occurs does reputational risk management surface as a discussion point for the industry. Instead of passively reacting to the news of a reputational risk event, the industry would be well-served to use it as an opportunity to implement measures that in the long term will not only enhance the reputation of individual banks but the industry as a whole.

Clifford Rossi is Professor-of-the-Practice and Executive-in-Residence at the Robert H. Smith School of Business at the University of Maryland.