What is Reputation Risk and how can Internal Audit approach it with confidence?
Risk to reputation is one the most topical risks discussed by a board yet few people in senior management understand it. At a functional level it is not owned like financial risk by the Chief Financial Officer or information security by the Chief Technical Officer. Reputation is not owned by Corporate Communications as it is determined by behaviour not by press releases. The Chief Risk Officer produces a risk register showing threats by probability and severity, yet reputation damage often evades scrutiny as it is impossible to predict and impossible to value. Ownership is critical for the audit function to determine whether risks are properly managed. It is tempting to deduce that where a risk is not owned it is not managed, yet with reputation it is never this simple. Often reputation is managed indirectly through good governance as reputation damage is often, although not always, a consequence of operational failure. In order to understand why you don’t find many Chief Reputation Of
