Archive

Risk management

Tony Jaques - Crisis ProofingWhey protein concentrate (‘WPC 80’) may not be the best known or sexiest product, but it is certainly big business. Deriving from cow’s milk, and a by-product of cheese production, it is used in baby formula, beverages, and a host of food supplements, including for bodybuilders.

Like other dairy products, WPC 80 is susceptible to contamination, the result of which can be deadly when digested. So when Fonterra, New Zealand’s largest company and the world’s largest dairy products producer discovered in July 2013 that 38 tonnes of concentrate had tested positive for botulism, a recall was quickly announced.

The trouble was, later tests by the government found no evidence of botulism and that the recall had been a false alarm. However, considerable damage had already been done to Fonterra, with several countries announcing milk product import bans and the company’s reputation for product quality in severe jeopardy.

The company’s independent inquiry (summary – pdf) into the incident concluded that, among other things, Fonterra was ‘not ready for a crisis of this magnitude’, that there had been a ‘failure to join the dots’ between botulism, infant food products, consumer sensitivities and the firm’s reputation, and that the company’s risk and crisis processes needed overhauling.

Fonterra’s top brass would have done well to have read Crisis Proofing, Tony Jaques’ book on how organisations should reduce the chances of a crisis happening and minimise the damage that may arise should a crisis occur.

While he gives many useful tips on crisis response, including how to navigate legal advice on apologies, Jaques’ background in issues management means his insights and practical tips on the leadership mindset, strategic approach and planning processes that enable companies to avoid train wrecks in the first place are particularly valuable.

In my experience, many companies undue emphasis on identifying risks (especially, given their slippery nature, reputational risks), at the expense of ensuring their issues management processes work properly – an area Jaques excels in. For example, he lambasts the probability/impact and significance/influence models for prioritising issues as crude and over-simplified, before setting out a more comprehensive and nuanced proprietary model based on an issue’s Impact, Salience, Visibility, Affectability, Proximity and Profile.

Jaques also takes aim at the reactive and ad hoc approach taken by many organisations to managing issues. Too often, he says, companies are overly focused on recording and tracking risks, and tweaking the identification, tracking and decision-making processes for the benefit of management and risk committees, as opposed to actively working to resolve them in a clear and strategic way. By contrast, his Do-it issue management model (chapter 8) is a model of clarity, practicality and focus.

At the heart of Crisis Proofing is a call for mindful leadership of the top-down variety that can seem contrary to the open and horizontal forms of organisational decision-making pushed by some contemporary management thinkers. Yet, as Jaques argues, effective crisis management demands hands-on, decisive and swift decision-making at the very top of the organisation, and a willingness to learn from mistakes and make changes.

As such, while many of the tips in Crisis Proofing are useful in day-to-day risk, issues and crisis management, the book is especially relevant to those leaders and senior decision-makers directly responsible for their organisation’s strategy, culture and reputation.

It is a book I recommend wholeheartedly.

 

Disclosure: I was asked by the author to review the chapter of Crisis Proofing on social media, and was subsequently provided with a review copy of the book by Oxford University Press. I also discuss Fonterra’s WPC 80 botulism scare in my book Managing Online Reputation

 

I was recently asked by Strategic RISK Asia magazine for my thoughts on the reputational risks arising from the use of personal social media accounts by employees.

I was glad to share my views as it is a topic that comes up regularly with clients and prospects.

It is also one I explored in my book Managing Online Reputation.

Below is my full response to the journalist; the published article is here.

SusanAFowler_Uber

Which risks are created for firms from employees’ personal social media accounts?

Research consistently shows the top risk of social media to companies is damage to reputation. Rank-and-file employees may be seen as the most trusted sources of information on, and credible advocates for an organisation, yet the flip side is equally true: inappropriate, offensive, unethical or defamatory behaviour by those seen as the most authentic embodiment of a company has a nasty habit of spilling into the broader public domain and bringing their employer’s name and image into disrepute. 

Understandably, much of the focus concerning employee social media profiles is on internal threats. However, companies underestimate the external risks associated with these accounts, notably the increased risk of social engineering to access personal and/or company information, and greater opportunities for identity theft as a way to embarrass an individual – and perhaps their employer – in public.

Which types of posts from employees on personal social media accounts are the most damaging (political statements, unprofessional conduct, criticising the company etc.?)

The degree of damage depends on factors such as the nature of the post, the resonance of the topic, the credibility of the employee, whether the post is seen as accidental or deliberate, and the visibility and reputation of the company. It can be particularly damaging if it is seen to involve confidential or highly sensitive information, racist, sexist or discriminatory comments, the harassment or smearing of colleagues, customers or competitors, or which point to corporate hypocrisy or double standards – all of which will quickly attract negative coverage and can result in legal action, financial penalties, or lost sales.

Much hinges on the local political, social and media context. For example, political and social online activism across Asia is less widespread but certain topics are guaranteed to raise hackles and with civil society gaining ground and personal online activism on the rise, a loose statement can prove immensely damaging. And while smears are commonly regarded as below the belt in the west, in China and elsewhere there is a pervasive culture of trashing other individuals, companies and just about anything and everything else, many of which are surprisingly overt. Many die at birth, but others take on a life on a life of their own if the employee is trusted. It often also helps if the target is western.

How can firms mitigate these risks? Is employee training necessary, or does it need to go further into rules in contracts and disciplinary action?

The blurring of employees’ personal and professional lives online presents a tricky challenge for any organisation. While some companies continue to limit workplace access to social media, or to personal social media accounts during working hours, most accept that the great majority of their people have a personal presence on social media and understand it is unreasonable, and in some countries illegal, to clamp down on or to monitor personal online activities, particularly outside of working hours.

At one level, the risks of rogue social employees can be reduced by having strong values and culture, ensuring good behaviour across the corporate ecosystem, having a healthy working environment and fair compensation, and being open and honest whenever possible. Understanding that there is little to stop aggrieved employees sounding off on employer review sites such as Glassdoor, or taking to anonymous workplace communities like Blind, many companies are also strengthening employee reviews, complaint procedures, and putting in place more substantive and constructive exit interviews.

It is also essential to have strong social media governance, most obviously in the form of a corporate social media policy and a set of guidelines that spell out the expected parameters of online behaviour, highlights the link between poor personal behaviour and reputational damage on the company, and which threatens disciplinary action for breaches of policy. Many companies now refer to or embed these terms in employment, contractor and supplier contracts, and feature them in formal onboarding processes.

Of course, social media policies and guidelines must also be understood and lived, which is where training and communication come in. The challenge is often that these dry, rather formulaic policy documents have many grey areas. For example, is it appropriate for employees to talk about, let alone criticise, their employers’ activities on Facebook and, if so, when and how? Should they respond to third-party criticism of the company on their social profiles, or the open web? Are there any topics employees should expressly steer clear of, even in their personal lives? Should employees be talking up their company’s products on social media and, if so, how? In what circumstances (if any) should an employee use his employer as an online platform for his own personal activities and views? Smart organisations have training programmes that get into these awkward nooks and crannies, bring them alive, clearly spell out the dos and don’ts, and issue regular reminders.

Companies like L’Oreal have taken this educational approach a step further by hand-holding their people personally through the social media maze, showing them the merits and risks of different kinds of social media strategies, platforms and profiles, and teaching them how to segment users, limit access to their opinions and content, and keep their profiles secure. Corporate personal branding programmes not only help employees and their employers protect their reputations day-to-day, they also instil residual goodwill and help reduce the likelihood of alumni disparaging the company once they have moved on.

It would be great to know your thoughts on this necessarily messy and difficult topic. Is there anything you find particularly challenging about employees’ personal social media accounts? And what do you find are the best ways of minimising these risks?

The web is now the medium of choice for campaign groups like Greenpeace, Oxfam and the WWF to raise funds, expand their networks, and mobilise supporters.

Little wonder: online pressure played no small part in Shell exiting its longstanding partnership with Lego, Nestlé reconfiguring its palm oil supply chain, SeaWorld halting its breeding of captive orcas, and the collapse in shark fin consumption in Hong Kong.

Then UK Culture Secretary Jeremy Hunt admitted that online pressure had ‘significantly influenced’ his decision on the Rupert Murdoch’s 2010 bid to take full control of BSkyB.

finishedwithfins

 

But it is not just the big campaign groups that have benefited. Once the preserve of students, tree huggers and political dissidents, activism is now the opium of suburban housewives and white collar workers across the world. It is particularly evident in the huge popularity of online petition sites:

  • Change.org counts over 140 million members in 196 countries
  • Avaaz boasts some 43 million members in 194 countries
  • Care2 has almost 35 million members
  • A UK member of parliament recently told me she receives dozens of emails every day supporting various causes from the 3 million+ members of 38 Degrees, all of which she feels compelled to respond to.

People power has never felt so real, or so daunting. And in an age in which business is increasingly expected to play the role of a concerned and actively engaged ‘citizen’, the numbers involved and the sheer unpredictability of public opinion raises real challenges and risks, as firms supporting ostensibly mainstream causes have discovered.

Drawing on discussions and interviews with Greenpeace, the WWF and high profile individual activists, I argue in my book Managing Online Reputation that online activism is now mainstream, activist networks are becoming more amorphous, and campaign groups are deliberately making their lines of attack less predictable, before going on to detail three current and emerging strategies and tactics used online in the ongoing battle for public support.

The relevant chapter – on the social and environmental threats of the web – is now available online as a free sample:

 

With propaganda swirling online, a Change.org petition fast escalating and Greenpeace all over your Facebook page, an online activist attack can feel terrifying and remorseless. But while some activist campaigns meet or even exceed their objectives, most fail to convince the public of their merits, or simply succumb to slacktivism.

How you choose to respond requires a close understanding of your detractors’ playbook, a smart reading of the public mood, and an appreciation of your tolerance for business and reputational risk – factors I’ll explore shortly.

Image courtesy of WWF Hong Kong

 

 

Drawing on my experiences in journalism, government, IPO-ing one of Europe’s top digital agencies, and working at WPP, I had the pleasure earlier this week of talking to early stage entrepreneurs and assorted others at Paperclip Hong Kong about the importance of building trust from the get-go.

The second half of the talk focused on online reputation, specifically how companies should handle threats on the internet and social web and draws on my book Managing Online Reputation.

A single negative review, badly handled, can be disastrous for a small company so it is all the more important that business owners have a decent understanding of the many options, tools and techniques available to help them evaluate and respond to common problems.

Here’s the deck:

Enjoy!

 

One of the pleasures of working in a start-up office space is being surrounded by entrepreneurs and would-be entrepreneurs, which makes for an interesting, exciting and positive environment.

In the rush to get up-and-running, generating revenue and turning a profit, most start-ups focus on product and marketing. This is eminently sensible: both are building blocks of a strong and healthy reputation.

But long-term reputation and communications are often overlooked in the mix. Uber’s current travails are an obvious example of this, with its perceived arrogance and willingness to play dirty resulting in severe friction with local authorities and access issues in multiple markets.

Here’s an article I penned recently for Jumpstart HK magazine on how start-ups can build trust from the get-go.

Enjoy!

 

Caution, shameless self-promotion: my book Managing Online Reputation launches today.

You might ask – perfectly legitimately – why I have taken the trouble of writing 60,000+ words about something that should now be well understood. Surely it hardly needs saying that Google, Twitter and Weibo make it harder to manage a company’s name and image, opening it to the whims, prejudices and ulterior motives of disappointed customers, aggrieved employees, malicious competitors, enraged activists and recalcitrant algorithms?

pownall-book-0006

Yet it remains the case that many organisations (and individuals) remain unclear how best to insulate themselves from trouble online, and continue to mess up their response when things go public.

It has not helped that there remains a dearth of practical, common sense advice in this area. There are many reasons for this, from a tendency to see social media as a business and marketing Holy Grail while overlooking the hazards of the conquest, to the fact that most existing guidance is written from a social media marketing, public relations, technology or legal perspective when effective online reputation protection and defence is about all of these working together. Things have also not been helped by a cottage industry of  ‘online reputation management’ specialists selling puffed-up search engine solutions.

Managing Online Reputation draws on what I have learned over many years as a communications strategist, PR practitioner and digital marketer mining the seam where communications and reputation, and the internet and social media meet. Accordingly reputation is tackled primarily from a communications perspective – albeit a broad one – and I make no apologies for this: if issues are left to fester long enough they will almost inevitably become reputational – and hence PR – problems and must be tackled as such.

However, to understand more clearly the risks to reputation posed by social media, and to appreciate the many different response options, I talked with experts in fields such as media and IP law, social and environmental activism, IT security, digital forensics, crisis management,  emergency response, social media monitoring, search engine marketing and Wikipedia management.

Given that the social web impacts so many areas of an organisation it should come as little surprise that online reputation is a complex topic. However Managing Online Reputation tries not to over-complicate or over-sell the issue. You’ll find it avoids talk of ‘social media crises’ and other hyperbolic marketing phraseology, just as it makes no grand claims about what the many social media business and listening tools now available can do for you. Rather it looks at social media in a broader context, and offers practical, realistic, common-sense advice in plain English.

It is also intended to be interesting. Sprinkled amidst tried and tested ways to categorise, assess and respond to potential problems online, and detailed guidance on how to develop (or update) your crisis plan, you’ll find vignettes about the culture of smears in China and political protest in Hong Kong, the easy and pungent opium of online petitions, the perils of companies attaching themselves to social movements, and what a black swan looks like online. There are also detailed case studies of companies of all shapes and sizes responding successfully to and recovering from fast escalating negative incidents and bone fide crises.

Here’s more of a taster:

 

More than anything you should come away from reading Managing Online Reputation with the notion that, despite the scepticism in which companies and institutions are held today, and the innate tribalism and volatility of life online, your organisation’s reputation is eminently knowable, manageable and redeemable – as long as you prepare well, keep your head and play it straight.

Managing Online Reputation is available in paperback and as an e-book via Amazon, Barnes & Noble, 800-CEO-READ and other outlets.

You can find out more about the book and how to order it here.

 

We live in the age of the leaky corporation in which the wrong information slips easily into the wrong hands.

Some organisations think the best solution is to restrict access to the internet and/or social media. But at what cost to an organisation’s ability to communicate externally?

I recently met with the regional communications lead at a major global bank who turned out to be the only person in Asia with access to Twitter. Little surprise that the individual felt restricted in what could be achieved online.

So it is good to hear IT exponents on this HBR podcast argue cutting internet access is not a simplistic, impractical and ineffective solution.

Happy listening!

 

This week I was fortunate to visit the Middle East to give a two-day workshop on ‘Reputation Risk and Communication’.

It was my first trip to Dubai for a number of years and it was a privilege to return and witness at close quarters the extraordinary flowering of the emirate and the optimism and drive of its people. It was also a welcome antidote to the shocking and numbing images of riots and massacres that so easily shape perceptions of the broader region.

The visit also provided a chance to hear direct from senior communications, marketing, risk management and legal professionals from the UAE, Bahrain, Egypt, Kuwait, Oman and Pakistan about their professional observations, experiences and challenges.

The workshop focused on how organisations can mitigate and manage corporate reputation in a broad sense, including during crises, with much of our discussion focusing on social media, which is clearly a major concern, in part due to its role in the so-called Arab Spring.

Here are a few slides from the workshop outlining how companies and governments can safeguard corporate reputation in social media.

 

I am glad to say my take on this issue appeared to resonate positively with my workshop delegates.

That said, there’s always so much to learn.

It would be great to know your comments or suggestions.

Shukran.

new survey on crisis communications by law firm Freshfields Bruckhaus Deringer reveals 28% of crises spread internationally within an hour, and 69% within 24 hours. The accompanying report (pdf) goes on to state that there ‘is no longer such a thing as a national crisis’.

This makes some sense in the context of a report on multinationals, yet despite the reach of CNN and other 24-hour news operations, and the pervasiveness of social media, there are plenty of scenarios when crises do not go global.

These include:

  • Footprint: if the company has no foreign operations, stakeholders or relevance and where its reputation is essentially local or national
  • Language: where the language in which the company operates is little spoken outside its domestic borders eg. Japan
  • Affinity: where potential for word of mouth is limited to due to local/small-scale or weak online affinity communities.

The role of social media in spreading a crisis - Freshfields Bruckhaus Deringer, 2013

Source: Freshfields Bruckhaus Deringer, November 2013

 

A case in point is Hoi Tin Tong, a herbal medicine retail chain based in Hong Kong that was recently hauled into the spotlight by a study finding that its turtle jelly – the firm’s signature product – has very little or no turtle shell, on the heels of a video purporting to show mouldy jelly being prepared for sale.

Covered in detail by the local press, including the venerable South China Morning Post, and the subject of considerable speculation in Hong Kong’s highly active online communities, the story has proved immensely damaging to the firm, whose founder is now talking of shuttering stores.

Despite the firm operating stores in mainland China and Macau, the story has failed to catch light in other markets.

Why?

Perhaps because the company is principally a local Hong Kong player and online/offline coverage has been principally in Cantonese, a language not understood even by most mainland Chinese.

 

A recent report (pdf) by Forbes for Deloitte on risk management reveals social media to be the fourth largest vulnerability to companies over the next three years, on a par with financial risk.

This underscores the impact of social media for firms as a whole, and the necessity to approach social media as a company-wide as opposed to a marketing, PR or customer service initiative.

To quote the report: “Social media risk may magnify the threats from a diverse array of risks, including reputation, strategic, operations, and compliance. Confidentiality may be breached, corporate secrets spread or malicious rumours started that can put a company in a tailspin.”

Aftershock-GRAPHIC-2

As noted in a previous post, the impact of social media on reputation looms large, even if senior business leaders do not view it as potentially damaging as technology risks.

I was recently asked to talk at a conference in Hong Kong on the risks inherent in social media marketing. Here’s my ten cents – or 10 basic principles – on how to limit social media marketing risks.

 

In short, much can be gained from careful business and campaign planning and governance.

Though, given the tendency for social media still be operated in siloes, some lateral thinking would also not go amiss.