The book Reputation management: The key to successful public relations and corporate communication by New York University professors John Doorley and Helio Fred Garcia opens with a quote from Warren Buffet who addressed a group of Salomon Brothers managers in 1991 after the firm became mired in a high-profile trading scandal: “If you lose dollars for the firm by bad decisions, I will be very understanding. If you lose reputation for the firm, I will be ruthless.”

Although numerous surveys show that many leaders of higher education institutions place the same value on reputation as Buffet does, effectively managing these risks remains elusive. In fact, most cannot even define what reputation is.

Defining Reputational Risk

In the article How to Manage Reputation Risk, Nir Kossovsky addresses the definitional ambiguity directly. “From your boardroom and C-suite to the SEC and Office of the Comptroller of the Currency, everyone agrees reputation risk exists, yet few can describe it. However, this isn’t as difficult as it seems.” Kossovsky defines reputation as the expectation of behavior that is set by stakeholders. “Customers have expectations when they buy products or services, employees have them when they accept jobs, vendors have them when they partner, creditors and investors have them, and even regulators have them.” For colleges and universities, this extends to the communities that house them, the potential pool of students and parents considering attendance, research partners, and the other organizations that interact with them.

This definition, importantly, addresses the role of external perception. While reputation’s value accrues to the institution, the actions taken by stakeholders drive that value. “A reputation crisis occurs when stakeholders change their expectations and behaviors,” Kossovsky writes. “Customers stop buying, employees leave, vendors lose interest in servicing, and regulators, litigators and reporters inevitably pile on.”

This view helps to turn the nebulous concept of reputation into concrete, measurable components. Events that cause a dip in enrollment, the loss of key faculty, reductions in budget funding, or lower application rates for international students all stem from reputational risk because stakeholders have changed their actions. Kossovsky emphasizes that it is resulting actions, not press coverage, that defines reputation crises: “While adverse media events can be embarrassing, they do not become reputation crises if stakeholders’ behaviors are unchanged.”

How colleges and universities currently manage reputational risk

The title of a report by United Educators (UE), ERM and reputational risk: More talk than action?, hints (not so subtly) at the results from a survey of 145 higher education institutions. Nearly 8 in 10 responding institutions have suffered at least one major reputational event. This widespread firsthand experience partially explains why a similar percentage considers reputational risk management more important now than it was just three years ago.

While the UE report is encouraging in that 79% of respondents had a process in place to know when a reputational risk event occurred, how they managed such events is less clear. “Knowing is not managing the risk,” the report notes. Slightly more than half of respondents could identify the outcome of these events, leaving a large percentage of institutions with no defined management process beyond identification.

The increasing likelihood of an institution facing a major event, the widespread lack of post-identification management processes, and the fact that a majority of respondents indicated that they did not have the resources and capabilities to withstand a major reputational event form the basis for the report’s dire conclusion: “Given that even one major reputational risk event could have a prodigious impact, these numbers should be a wake up call to college and university leadership to be prepared and take the lead in managing all risks, especially reputational risk.”

Leveraging technology to help manage reputational risk

The UE report offers several recommended strategies for moving organizations toward intentional reputational management. These include:

• Assess and strive to steadily improve the culture of the institution and other factors that significantly contribute to the institution’s reputation.
• Identify ownership and lines of communication for specific reputational risks.
• Manage reputational and other risks in a portfolio and understand how the risks are connected.
• Share the risk register and mitigation plans regularly with the board to gain its confidence in the institution’s developing expertise in deploying appropriate resources to prepare for and respond to future events.
• Establish a monitoring system that will give early notification to emerging reputational damage to your institution.

In much the same way that organizations work to establish a culture of safety, the report recommends a similar process with reputational management. “Institutions cannot successfully manage reputational risks unless they build a governance and culture component, which can help set the tone, engage leaders, raise accountability, and promote desired behaviors around reputational risk.”

Formalizing ERM

The higher-performing institutions in the study took a different approach to ERM. “For starters, higher performers are more likely to have ‘a formal ERM process and structure’ than non-high performers (85% versus 59%),” the report states.

Formalizing the ERM process means moving beyond spreadsheets and using technology that helps carry out the UE recommendations of clarifying ownership, understanding the relationships between risks, and providing the board with the reports it requires. Additionally, systems with strong integration capabilities, such as Origami Risk, allow for much more seamless monitoring and alerts.

Leading indicators, which may include noticeable spikes in the number of neighborhood complaints, requests for dorm transfers, or the number of helpline calls, can be signs foretelling future crises. Connecting this data to your ERM program with automatic monitoring and notifications can trigger the conversations and actions that tackle root causes before they morph into reputational hits.

As mentioned in Creating a successful ERM program: Why ditching spreadsheets isn’t enough, the goal of the ERM program should be one thing: taking action. “The ERM platform needs to support providing actionable information to stakeholders. Risk registers and heat maps are not the end goals. It only matters if those things move the organization towards its objectives in a measurable way. As far as stakeholders are concerned, ERM technology is essentially a vehicle for producing intelligence that shapes decisions.”

Engaging the board

Another key trait found in high performers is the board’s connection with the risk management process. The report states, “When asked to rate board engagement, 82% of high performers agreed their board was appropriately or over engaged as compared to 53% of non-high performers.”

Internal audits are an ideal tool to generate engagement with the board. As boards grapple with how the institution is preparing for and managing reputational risks, internal audits can provide the objective measurement of progress necessary to make strategic decisions. Data and the value of internal audit expands on this point:

As Norman Marks points out, fully inhabiting the role of change agent and sounding board requires internal audit leaders to push beyond audit practices that adhere to the way things have always been done or narrowly focus on policies and standards requirements. When internal audit begins the process of becoming an advisor to the board, audit practices must shift from the bureaucratic to the strategic.

Viewed this way, the internal audit process becomes a critical tool for board engagement. This type of hard data helps remove the “intangible” quality associated with reputational management and replaces that with a traditional risk management model.

Conclusion

The gulf between the high levels of concern colleges and universities share about reputational risk and the low levels of confidence in their capacity to effectively manage it is disconcerting. As the high performers demonstrate, however, this gulf can be bridged. A clear definition, technology that helps establish a reputation management culture, and following the best practices laid out by UE can help higher education institutions protect their reputations as ruthlessly as Warren Buffet.