Insuring your good name

May 2017 | Ingrid Sapona

Reputation is a concept most people have at least a feel for. For example, some describe it as “your good name” or “the way people see you”. People talk of what they’ve done to “earn” their reputation. Also, if someone feels their reputation is being tarnished or harmed, often they’ll become proactive to defend their reputation. Notice how all these things make it sound like reputation is an asset?

For businesses, reputation is most definitely an asset, and a valuable one indeed. Just ask companies whose reputations have been tarnished recently – like VW, Wells Fargo, Mylan, and most recently, Canadian banks – about the importance of reputation. To give you some sense of the investment businesses make in building their reputation, one commentator noted that “HM Treasury estimates that, in 2011 UK businesses invested £126.8bn in knowledge assets, compared with £88bn in tangible assets with approximately 15% of such spending on brand equity. So why not protect that investment?”

If you’re a property and casualty insurance professional used to dealing with tangible, traditional risks, reputation may not seem insurable. But, once you recognize reputation as an asset, looking for ways of insuring it makes sense – at least to a handful of folks who are on the cutting edge of developing insurance-based responses to reputation risk.

In this trend paper we look at:
• what reputation risk is,
• how you measure reputation,
• what reputation loss is, and
• innovative insurance responses that help businesses “transfer the risk associated with reputational damage away from their balance sheets.”

Before looking at reputation risk, let’s consider some definitions of reputation. Those interested in the academic interpretation of reputation will find a large body of literature on it in the management and marketing fields. While there are a variety of ways academics define reputation, “general agreement exists that reputation refers to social cognitions, such as knowledge, impression, perceptions, or beliefs … in the minds of external observers or stakeholders [citations omitted].”

Nir Kossovsky, MD, CEO of Steel City Re, offers a more straightforward definition. According to him, reputation is an expectation held by others about you. In terms of a business’ reputation, Kossovsky points out “Customers have expectations when they buy products, employees have them when they accept jobs, vendors have them when they sell you things, creditors have them, and so on.”

Reputation Risk
Because reputation relates to stakeholder expectation, “reputation risk” is the risk of disappointment, according to Kossovsky. “It’s the risk of losing the battle for the minds of stakeholders,” he says. Though disappointment is an emotional response, “emotion translates into behaviour all the time, and behaviour is an economically consequential phenomenon,” he says. For example, the length of sales cycles, customer willingness to pay a premium for products, terms from vendors and creditors, lower employee costs and turnover, intensity of regulatory scrutiny, and so on, are all related to emotions and all such decisions are measurable. And, from such measurements you can mathematically derive a measure of a company’s reputation and its standing vis-à-vis other companies, which Steel City Re does on a weekly basis for its reputation value database.

In terms of how concerned companies are about reputation risk, according to Allianz Risk Barometer 2017, it’s one of the top ten global business risks. Indeed, loss of reputation or brand value ranked 9th globally, but 8th in Canada. (Interestingly, in the 2016 Allianz survey, loss of reputation or brand value was ranked 3rd by Canadian businesses.)

Measuring Reputation
Though some believe that measuring reputation can be difficult, others disagree.

Ulrike Raible, an underwriter at Munich Re, says that beyond brand valuation theories, “reputational damage can be calculated on the basis of the fall in turnover when clients go elsewhere.”

Kossovsky, who has been in the business of measuring corporate reputations since 2001, takes a big data approach, using tools developed for operations and quality management. Using a variety of factors and data, Steel City Re has developed a reputation value metric for about 7500 public companies. Their reputation value metric data have been used by hedge funds as a stock picking filter for more than a decade; and as the basis for the RepuStars® Variety Corporate Reputation Index (Ticker: REPUVAR), which is calculated by S&P/Down Jones Indexes. They update their database of reputation values on a weekly basis.

“There are empirically measurable economic indicators of stakeholder expectations,” Kossovsky says. He says a business’ reputation is the sum of stakeholder expectations of corporate performance around these six areas:
1. Ethics
2. Innovation
3. Safety
4. Security
5. Quality
6. Sustainability

Reputation Loss
Reputation-related losses businesses can suffer are wide-ranging. They include, for example:
• Reduction in sales, stock price, and net income
• Higher credit costs
• Higher risk transfer costs
• Increased safety and security expenses
• Increased costs of quality assurance and governance

Costs associated with dealing with a reputational event related to an operational failure are estimated at "two to seven times higher than costs related to the failure that harmed the business’ reputation.”

While some reputation-damaging events are obvious – for example, the news of the VW emissions scandal, or the outbreak of E. coli food poisoning that hit some Chipotle restaurants in 2015. Some reputation crises, like the Wells Fargo fake account opening scandal, are more difficult to observe as they are unfolding. But, for those paying attention to reputation risk matrices, often there are early signs of a brewing reputation crisis. In the case of Wells Fargo, for example, Kossovsky says there were “classical manifestations of a reputational crisis … as customers broke off relations, employees sued, customers sued, investors sued, the stock price fell at least 7 percent, executives lost their heads and regulators piled on.”

It’s important to note that an adverse reputational event does not necessarily lead to a reputation crisis. A reputation crisis only occurs, according to Kossovsky, “When stakeholders change their expectations and behaviours.” There are situations when a company may suffer an adverse reputation event but because of the goodwill it has built up, stakeholders are willing to give the company a break or dismiss the event as an anomaly.

How the Concept of Reputation Loss is Evolving
Historically, the majority of empirical studies of reputation risk have focused on operational loss events as the underlying cause for reputational losses. With reputational losses stemming from operational loss, reputation was primarily seen as relating to financial performance.

Thanks to social media and the ability to transmit information instantaneously, the reputation landscape has changed. “In today’s environment of Twitter, Tumblr, and other means to spread ideas widely and quickly, and without editorial barriers, the effect on an organization can be large and occur with lightning speed.”

Indeed, even “fake news” – stories invented that some people wanted to hear but that do not necessarily have any basis in truth – has the ability to severely damage an organization. Though the concept of “fake news” is still relatively new, Kossovsky points out that it will probably be high risk for companies in the near future.

Reputation Risk Hitting Home with Directors
Another indication of how reputation risk is evolving is the recognition by Boards that if the company’s reputation is tarnished, their personal reputation could also be at stake. While concern about directors’ liability lawsuits have long been on directors’ radar, there is growing recognition of damage to directors’ personal reputation in the court of public opinion.

“The average director, for example, earns approximately $250,000 a year to serve on a corporate board and he or she usually serves on multiple boards. If he or she is forced to resign as a result of reputational attacks related to the board's oversight of the company – and if he or she becomes less desirable as a member of other corporate boards, that could represent a loss of millions of dollars over the course of a career.”

Reputation Risk Mitigation
There are a variety of reputation risk management strategies businesses can employ to prevent reputation-damaging events and moderate their influence after they happen. The strategies can be divided into three broad categories:
• Managing the event both before and after it occurs
• Managing the media
• Managing the stakeholders

Proactive communication of awareness of a company’s exposure and its acknowledgement of the duty to deliver on expectations related to the six areas Kossovsky looks at when measuring corporate reputation is key to mitigating reputation risk. Stressing the importance of communication, the director of risk management at Mattel Inc. said, “There needs to be some sense of a plan for how the board will respond to a reputation event.”

It should be noted that an event that could potentially damage a business’ reputation will not create a reputation crisis unless the business poorly manages expectations or the expectations exceed the company’s capabilities.

According to Kossovsky, “Managing expectations speaks to principles of behavioural economics and requires you to address two drivers: shaping what people expect from you and then meeting those expectations. The gap between expectations and reality is the very essence of reputation risk.” Shaping expectations can involve many things, from creating a record of good governance to developing a positive story line as an alternative when criticism may surface, for example. Interestingly, there are times when intentionally shaped expectations can end up backfiring. BP’s efforts to be seen as being “beyond petroleum” likely contributed to public expectations about BP and so when they were unable to control the flow of oil in the Gulf of Mexico, their reputation suffered a greater hit than it might otherwise have.

Failure to meet expectations leaves a business vulnerable to shareholders or activists coming after the Board. Further complicating reputation risk management is the fact that different stakeholders may have different expectations, creating conflicting expectations, according to Kossovsky.

Insurance Products Available - Reputation Risk Transfer Solutions
Reputation risk coverage does not appear to be widely available and details about existing products are limited. So, the discussion here, which aims to provide an idea of the types of solutions currently available, is fairly general in nature.

Policy Add-ons
When it was first introduced, reputation risk coverage was available as an add-on to another policy – often a cyber liability policy, a kidnap and ransom policy, a product recall policy, or a Directors & Officer’s liability policy. Such endorsements usually just cover crisis management costs. For example, AIG’s CrisisResponse® is an example of reputation coverage that can be added to an AIG WorldRisk package. CrisisResponse® provides insureds access to resources to help manage a “man-made crisis event.” It includes a hotline to an AIG approved PR firm and crisis management experts to assist in maintaining a positive brand reputation.

Over the past half-dozen years or so, standalone reputation insurance coverage has emerged. These policies vary quite a lot in terms of: covered losses, limits and deductibles, coverage triggers, and insurance payout and measurement of insured losses resulting from reputational crisis events.

A key distinction among standalone policies relates to types of losses covered. Most policies basically only cover crisis management and communication costs (for example, AIG’s ReputationGuard® and Allianz’s Reputation Protect). With such coverage, often the insured must use communications and public relations experts the insurer makes available or approves. This type of coverage is pretty traditional, according to Peter Gerken, co-founder and senior vice president of Steel City Re. “It’s coverage that’s more like business interruption insurance. Something’s happened and you have to do something about it and so the insurance provides crisis management services, but no payment for financial loss such as loss of profits,” he says.

Munich Re’s Reputation Risk Insurance covers loss of profits and financial support for crisis management. It is intended to provide liquidity while the company recovers its market share. The reduction in revenue must relate to a decline in consumer perception and change in consumer behaviour.

Rather than offering a product that responds only after a reputation-damaging incident happens, Steel City Re has taken another approach. Its multi-pronged strategy includes innovative insurance and risk financing products. Its Reputation Assurance product provides clients with sigma-styled tools for managing enterprise reputation risk, including monitoring the company’s reputation using Steel City Re’s proprietary reputation risk metric. Built on principles of parametric insurances, the product provides enterprise-wide loss indemnification by paying out when the insured’s reputational value metric falls below a certain threshold. Steel City Re’s policy is underwritten by Tokio Marine Kiln, which is a Lloyd’s Syndicate.

Limits and Deductibles
Because Steel City Re’s policies are tailored to each customer, they do not have a standard limit, according to Gerken. Policy limits on the other standalone policies described in this paper range from €10 million to €50 million or more. As the head of Munich Re’s Risk Solution team noted in an early news report about their reputation coverage, if the policy has, say, a €150 million limit, since that figure relates to profit, that could translate into a drop in turnover of over €1 billion.

Deductibles are fairly common and they vary in terms of how they are structured.

Coverage Triggers
As with any insurance, a key question is how a claim is triggered. With respect to the policies described in this paper, the triggers vary.

AIG’s ReputationGuard®, which covers crisis communication costs to manage an incident, does not have a trigger, per se. Coverage starts when the insured hires a communications firm from AIG’s list of approved vendors. Another unique feature of AIG’s policy is that it covers crisis management services to manage threats the insured becomes aware of but that have not yet become public.

Based on the information I’ve found on Allianz’s Reputation Protect, the policy is triggered by a crisis event that is defined as the triggering of any other insurance policy the insured has, regardless of who that other policy is with. The rationale for reference to another insurance policy is because this ensures the triggers are clearly defined, tested insurance triggers. As well, the policy may be tailored to the insured’s unique needs and may specify other named triggers that do not relate to other insurance policies.

Munich Re offers two options: named perils and all risk. The named peril option has a two-step trigger. The first is the occurrence of a basic risk event (for example, product recall, discrimination or harassment, loss of client data/breach of data privacy, loss of key person, misconduct of key person, and so on); the second is a significant drop in revenue. The all risk option has as an initial trigger a significant, measured increased in negative media related to specific types of issues (for example, products, clients, key persons, or ethical, social or environmental matters) with a revenue decline of a stated percentage compared with estimated revenue. This option is more costly because it requires constant media monitoring by a third party marketing organization.

Steel City Re’s Reputation Assurance, a parametric product, has a three-step trigger. First there must be an adverse event related to one of six critical areas (ethics, innovation, safety, security, quality, or sustainability). Second, the event must be known publically, and third, the insureds reputational value metrics (the parameters) must fall. “Claims are really quite easy to manage,” says Kossovsky. “Did the event happen, is it publicly known, and did the metrics fall by whatever amount is specified in the policy. If there’s a yes to each of these, then we write the cheque.”

Because reputation crises may not cause an insured’s reputation to fall immediately, the first 90 days are sort of a discovery period, according to Gerken. “To make a claim, the reputation metric has to have fallen below the specified trigger amount starting on the 91st day. Then we monitor the value for the next 20 weeks – 140 days. If the metric stays below the trigger for this period, we write a cheque,” he says. And, because the damage to their reputation could get worse beyond this period, Steel City Re continues to monitor it for the balance of the policy period and the payout could be increased.

Key exclusions
Typical policy exclusions include:
• Known prior matters
• Willful managerial conduct
• Direct and foreseeable consequences of an insured’s decision to change or discontinue use of a business strategy, manufacturing process, vendor, supplier or distributor
• Loss that touches or concerns the whole or part of the industry sector
• Any event that is a direct consequence of a business decision of the policy holder’s top and second level management

Underwriting Reputation Assurance
I was unable to find specific information on what underwriters with Allianz, Munich Re, or AIG consider when assessing reputation risk insurance applications.

Kossovsky says that Steel City Re’s underwriting assessment involves reviewing the business’s governance structure. “We look at what the firm’s policies and procedures are and evidence of controls. We’re interested in how the Board keeps track of incidents, how they react when something happens, and so on. We do a 6 Sigma-style process audit on their governance”, he says. “As well, we look at their reputation volatility metrics – the objective metrics of their reputation value.”

In terms of how long the underwriting process takes, Kossovsky says it depends on how well documented the business’s governance structures are. “If it takes them weeks to get the information about their policies and procedures, that in itself can be a sign of a problem,” he says.

Industry Claims History for Reputation Risk Insurance
I could not find any information about the claims history with respect to any insurers other than Steel City Re (it was the only insurer to respond to my request to provide information for this Trends Paper).

As Gerken noted, just as with the early years of D&O liability insurance, at this point, the product is attracting “good risks” that value the strategic signaling features to proactively protect enterprise value. On the direct question of their claims history, Gerken underscored that their experience matches their expectation and he reports that to date they have not had any claims.

Conclusion
One academic who has studied reputation risk insurance believes that in the future, such insurance will become one piece of a companies’ risk management processes. “Interest in reputation risk coverage … is high, particularly with increasing exposure to cyber-related losses, the rapid spread of information through social media, and changing cultural norms that are more focused today on socially responsible organizations. We anticipate that these demands will lead to innovative and sustainable products in the long run.”

In terms of the demand for reputation insurance, Kossovsky says that as an industry segment, reputation insurance is booming. “The (reputation insurance) activity has doubled between 2015 and 2016,” he says, though he would not provide any firm numbers related to demand or sales for reputation insurance. Where captives are bearing 100 % of the risk, from a baseline of zero in 2012, Steel City Re has provided pricing and underwriting support for reputation risk solutions in over 200 captives of non-public companies valued in the billions. For public companies, Steel City Re recommends bundling loss absorption in a captive with the signaling power of Reputation Assurance.

As with most products, demand “will depend on the cost of the insurance relative to the cost of self-insurance and prevention, as well as the policy design and firm-specific needs.” But, borrowing from an ad campaign about the intangible value of some things, Kossovsky thinks directors may consider the value they’d assign to their personal reputations as “priceless,” and therefor may find reputation risk insurance a reasonable cost. Indeed, he can foresee a day when directors may require a company to have reputation insurance before they will accept a position on the company’s board.