What Is Reputational Risk? Types, Examples and Management

A company may meet its financial targets and still lose the confidence on which its business depends. A product failure can change how customers assess quality. A regulatory case can make investors question management. A supplier's conduct can compromise promises the company made under its own name. A false but credible-looking allegation can also delay a deal before the facts are established.

These events differ, but the commercial problem is the same: stakeholders revise what they believe about the organisation and act on that judgement. Reputational risk management therefore cannot sit with communications alone. It must connect operations, security, legal, compliance, risk and leadership around evidence, controls and clear decisions.

Key takeaways

• Reputational risk arises when stakeholder perceptions of an organisation’s conduct, performance, communications or associations weaken trust and create business consequences.
• A negative mention is a signal, not a confirmed finding. Its source, evidence, reach and relevance must be verified before the organisation responds.
• An effective assessment establishes what happened, who may be affected, how the issue could reach the business and which action the available evidence supports.

What Is Reputational Risk?

Reputational risk is the possibility that customers, employees, investors, regulators, partners or the public will form a less favourable view of an organisation and change their behaviour as a result. The trigger may be misconduct, a legal breach, poor service, a cyber incident, a strategic decision, an executive's actions or a relationship with a third party. The underlying claim may even be false; if credible stakeholders believe it, exposure can exist until the record is corrected.

The effects are practical rather than abstract. Customers may leave, recruits may reject offers, suppliers may revise terms, regulators may increase scrutiny and investors may demand a higher return for perceived uncertainty. In a transaction, an unresolved controversy can slow diligence, affect valuation or end negotiations.

There is no single definition used by every regulator or enterprise risk framework. The Basel Committee, for example, describes reputational risk in banking through negative perceptions that can affect business relationships or access to funding. Other systems assess reputation as a consequence of conduct, compliance, operational or financial risk rather than as a standalone category. The classification matters less than ensuring that the exposure has an owner, thresholds and a response.

Reputational Risk and Related Business Risks

Reputation rarely deteriorates without an underlying event. Separating that event from the perception and commercial outcome prevents double-counting and directs remediation to the right team.

• Conduct risk concerns inappropriate behaviour by the firm, its leaders or employees. Mis-selling, harassment, conflicts of interest and misleading statements can become direct reputation triggers.
• Compliance risk arises from failure to meet applicable rules or obligations. Investigations, enforcement decisions and delayed reporting can change how regulators, customers and partners assess the organisation.
• Operational risk comes from failures involving people, processes, systems or external events. Service outages, fraud, safety incidents and cyberattacks can produce a second-order loss of confidence.
• Strategic risk relates to decisions about markets, products, capital and leadership. A failed acquisition or repeated missed commitments can weaken confidence in management even when no law was broken.
• Environmental, social and governance-related risk arises when conduct or public claims diverge from evidence, stakeholder expectations or applicable rules. The exact duties vary by jurisdiction, sector and company size.
• Third-party risk begins outside the organisation but reaches it through a supplier, distributor, adviser, investor, influencer or joint-venture partner.

An operational outage and the response to it illustrate the distinction. The outage is the initial event. Slow disclosure, inconsistent statements or failure to support customers can deepen the reputational effect. The resulting churn, contract losses and regulatory attention are consequences. One incident therefore needs several owners, but it should still have a single coordinated assessment.

Main Sources of Reputational Risk

Conduct, Culture and Leadership

Executive misconduct attracts attention, but repeated lower-level behaviour may reveal a wider control or culture problem. Sales pressure, retaliation against whistleblowers, conflicts of interest and discriminatory treatment become more serious when management knew about them or tolerated them. The question is not only who acted improperly, but what incentives, reporting lines and control gaps allowed the conduct to continue.

Products, Safety and Customer Outcomes

Unsafe products, misleading descriptions, poor quality and inadequate complaint handling can turn an operational issue into a trust problem. The response matters. A prompt recall with clear instructions may limit harm; denial, delay or inconsistent remedies can make the company's judgement the larger story.

Legal, Regulatory and Financial-Integrity Failures

Bribery, fraud, sanctions violations, money-laundering control failures and misleading disclosures can bring penalties and litigation. They can also lead banks, insurers and counterparties to reassess whether the relationship remains acceptable. A legal settlement may close one proceeding without resolving broader questions about governance or culture.

Cybersecurity, Privacy and Operational Resilience

A cyber incident can interrupt sales, expose personal data and reveal weaknesses in third-party access or recovery plans. The reputation effect depends on the information compromised, the service impact and the quality of the response. Aon's 2025 study reviewed 1,407 cyber events and found that 49 developed into reputational-risk events under its methodology. For those 49 listed-company cases, it reported an average 27% decline in shareholder value beyond the wider market over the following year. This is a finding about a selected group of serious, highly reported events, not a forecast for every cyber incident.

Suppliers, Partners and Other Third Parties

Stakeholders do not always distinguish between a company and the organisations acting on its behalf. Labour abuse in a supplier network, corruption by an intermediary or unsafe practices at a contractor can undermine the buyer's own claims. A contract may allocate duties and costs, but it cannot transfer the association.

Risk-based third-party due diligence should examine ownership, sanctions exposure, litigation, adverse media and network relationships before onboarding. Higher-risk relationships also need incident-notification clauses, ongoing monitoring and workable escalation or exit options.

Strategy, Transactions and Corporate Decisions

Acquisitions, market exits, restructurings and executive appointments signal priorities. A decision can remain lawful and still conflict with commitments made to employees, investors or communities. Reputation analysis should therefore test both the business rationale and the gap between the decision, prior statements and likely stakeholder expectations.

Public Narratives and Information Threats

Criticism can originate from a customer, journalist, employee, activist, competitor or anonymous account. It may be accurate, partly accurate, mistaken or deliberately manipulated. Reach can grow quickly, but high volume does not prove truth, coordination or business impact. Analysts must trace the original source, preserve the evidence and distinguish repeated copies from independent confirmation.

Reputational Risk Examples

Volkswagen: Misconduct Behind a Product Claim

In 2015, US authorities found software designed to circumvent emissions testing in Volkswagen diesel vehicles. The matter combined product claims, regulatory deception, environmental harm and governance failure. In 2017, the US Department of Justice announced a guilty plea and $4.3 billion in criminal and civil penalties, separate from earlier US settlements covering affected vehicles and environmental mitigation.

The case shows why reputation is not repaired by messaging alone. The underlying conduct required customer remedies, legal resolutions, governance changes and years of operational work. Communications could explain those actions, but it could not substitute for them.

Samsung Galaxy Note7: Safety and the Quality of Response

The US Consumer Product Safety Commission first recalled about one million Galaxy Note7 devices in September 2016 because batteries could overheat and catch fire. Replacement devices were included in an expanded recall the following month. Samsung discontinued the product and projected an additional mid-three-trillion-won operating-profit impact across the fourth quarter of 2016 and first quarter of 2017, beyond the effect already reflected in its third-quarter guidance.

The initial defect created a safety risk. Incidents involving replacement phones widened the problem because the first remedy did not resolve the safety issue. This is a useful distinction for crisis planning: stakeholders assess both the failure and whether the organisation can control the response.

Wells Fargo: Incentives, Conduct and Investor Disclosure

Sales practices can become reputational exposure when incentives conflict with stated customer standards. In 2020, the US Securities and Exchange Commission said Wells Fargo had misled investors about its cross-selling strategy while large numbers of unauthorised or unused accounts inflated the reported metric. The bank agreed to a $500 million SEC settlement as part of a combined $3 billion resolution with the SEC and Department of Justice.

The case connected employee pressure, consumer outcomes, management information and public disclosure. Monitoring press sentiment alone would not have identified or corrected the incentive structure behind the issue.

Marks & Spencer: A Cyber Event with Measurable Business Effects

Marks & Spencer's results for the year ended 28 March 2026 show how cyber disruption can move through operations and financial performance. The retailer reported £131.3 million of incident-related costs and £100 million in insurance proceeds. It also described a temporary pause in online trading and systems access that disrupted stock flow and product availability. Adjusted profit before tax declined by 23.8%, although that annual movement should not be attributed to reputation alone.

The evidence supports a narrower conclusion: the incident caused measurable operational and financial effects, while recovery required customer communication, technology work, supply-chain action and management oversight.

Why Reputational Risk Matters

Trust affects the terms on which an organisation can operate. When confidence declines, the consequences may appear in several places at once:

• Customers: more cancellations, lower repeat purchase rates, increased complaints and higher acquisition costs.
• Revenue and capital: delayed sales, lost contracts, valuation pressure, more expensive funding or stricter insurance terms.
• Partners: enhanced due diligence, contract renegotiation, suspended onboarding or exit from a relationship.
• Regulators and courts: enquiries, enforcement, remediation duties, litigation and disclosure obligations.
• People: lower offer acceptance, higher attrition, reduced engagement and difficulty recruiting for sensitive roles.
• Strategy: delayed transactions, lost market access and management time diverted from planned growth.

Not every incident produces each result, and timing differs. Customer churn may appear before a regulatory decision; recruitment problems may emerge months later. That is why teams need leading indicators as well as financial outcomes.

How to Assess Reputational Risk

A useful assessment follows the pathway from event to decision. Start with six questions:

1. What happened? Separate observed facts from allegations, commentary and assumptions.
2. Who is involved? Identify the organisation, individuals, third parties and any undisclosed relationships.
3. Which stakeholder expectation is at issue? Safety, honesty, service, legality, privacy and responsible sourcing create different exposure.
4. How could the issue reach the business? Map the route to customers, regulators, employees, partners, capital or transactions.
5. How serious and time-sensitive is it? Rate evidence strength, potential impact, velocity, duration and controllability separately.
6. What decision could change? Define the action under consideration: investigate, disclose, remediate, pause, renegotiate, terminate or monitor.

Before a partnership, senior appointment or investment proceeds, reputational due diligence can test public claims, ownership links, litigation, adverse media and undisclosed affiliations. The review should record conflicting evidence and source limitations rather than forcing every issue into a binary pass-or-fail result.

From Reputation Signal to Decision-Grade Finding

An increase in negative mentions is not, by itself, a confirmed crisis. An evidence-led progression helps prevent both overreaction and delay:

1. Signal: one post, complaint, article, database record or regulator query indicates a possible issue. Preserve the original item, author, time and context.
2. Corroborated issue: primary records or genuinely independent sources support the core claim. Reposts and services drawing from the same upstream source do not count as separate confirmation.
3. Material exposure: the verified issue has a plausible pathway to a stakeholder and business consequence. Assess reach, geography, decision relevance and the controls already in place.
4. Decision trigger: the evidence crosses a defined threshold for escalation, disclosure, remediation, transaction terms, suspension or exit. Record the decision owner, deadline and residual uncertainty.

Virality is not evidence of accuracy. The reverse is also true: a low-volume regulatory notice or private customer complaint may carry high material risk. Signs of coordinated distribution justify further analysis but do not prove coordination without evidence of shared actors, infrastructure, timing or direction.

A Six-Phase Reputational Risk Management Framework

1. Identify Stakeholders and Triggers

Map the groups whose decisions matter to the organisation and the expectations relevant to each relationship. Then identify internal and external triggers across conduct, product safety, compliance, cyber, suppliers, strategy and the information environment. Assign each trigger to the business function that controls the underlying activity.

2. Assess Exposure and Set Thresholds

Rate likelihood, potential impact, velocity, duration and controllability. Define escalation thresholds before an incident occurs. A threshold might involve a safety event, verified executive misconduct, regulator contact, sustained service disruption or a third-party issue affecting a critical contract. Scenario exercises help expose gaps between written policy and actual decision authority.

3. Prevent the Underlying Failure

Prevention depends on operational controls: sound incentives, product testing, complaint handling, cyber safeguards, employee reporting channels, accurate disclosures and third-party oversight. Policies matter only if people understand them and breaches lead to consistent action. Risk and compliance functions should challenge the control design; internal audit or another independent function can provide assurance.

4. Build Early Warning Without Treating Noise as Fact

Monitor regulator correspondence, unresolved complaints, whistleblowing patterns, safety defects, control exceptions, litigation, third-party changes and credible adverse media. Ongoing brand reputation and adverse media monitoring can help teams distinguish isolated criticism from a developing issue while response options remain open.

Social and media monitoring needs limits. Collect only information necessary for a defined risk purpose, follow applicable privacy law and platform rules, preserve the original source and label allegations clearly. Automated sentiment can show changes in tone or volume; it cannot determine truth, intent or materiality.

5. Respond to the Event and the Information Gap

Activate a cross-functional team with named authority. Verify facts and preserve records, stop continuing harm, identify affected stakeholders and determine notification deadlines. Operations, security, legal, risk and communications should work from the same confirmed timeline.

Early communication should state what is known, what remains under investigation, what action has been taken and when the next update will follow. Transparency does not mean publishing personal data, confidential material or an unverified accusation. Accuracy, consistency and visible remediation matter more than speed alone.

6. Recover, Test and Learn

Recovery requires evidence that the cause was addressed. Track remedies, validate revised controls and monitor whether complaints, attrition or partner concerns return to an agreed baseline. Where the organisation caused harm, an apology is useful only when paired with corrective action.

Close the incident with a documented review: which warning signs were missed, which decisions were delayed, whether authority was clear and whether third-party or insurance terms worked as expected. The board or senior leadership should oversee material exposures; communications should manage messaging, not own the underlying risk.

How Is Reputational Risk Measured?

There is no universal reputation score. The right indicators depend on the affected stakeholders and business model. Useful measures include:

• control failures, unresolved complaints, product defects and regulator correspondence;
• verified adverse-media events, source credibility, reach, velocity and stakeholder relevance;
• customer churn, cancellations, repeat purchase, complaint resolution and acquisition cost;
• lost or delayed contracts, enhanced partner checks and changes in payment or insurance terms;
• employee engagement, attrition, offer acceptance and whistleblowing patterns;
• transaction delays, funding costs, enforcement outcomes and market-adjusted valuation effects.

Set a baseline, threshold and owner for each measure. Net Promoter Score, brand surveys and sentiment analysis can add context but should not be treated as proof of trust. Likewise, a share-price fall may reflect market conditions and other events; causal claims need a defined event window and comparison with the broader market.

Conclusion

Reputational risk is not another name for bad press. It is the business exposure created when stakeholders change their decisions because of an organisation's conduct, performance, claims or relationships. Managing it means correcting the underlying issue, testing the evidence and coordinating action across the functions that control the risk.

Intelligence-led risk management connects public narratives with legal, regulatory, cyber and counterparty signals instead of treating reputation as a communications-only issue. If a transaction, controversy or emerging narrative requires independent assessment, contact Molfar Intelligence.

This article provides general information, not legal advice. Disclosure, privacy, employment, consumer, securities and sector-specific duties vary by jurisdiction.

Frequently Asked Questions

What is reputational risk?

Reputational risk is the possibility that stakeholders will form a less favourable view of an organisation's conduct, performance, communications or associations and change their behaviour in a way that affects the business.

What are the main causes of reputational risk?

Common triggers include misconduct, legal or regulatory failure, unsafe or poor-quality products, negative customer outcomes, cyber incidents, flawed strategic decisions, third-party conduct and inaccurate or manipulated public narratives.

What is the difference between reputational and conduct risk?

Conduct risk concerns harm arising from inappropriate behaviour by a firm or its people. Reputational risk concerns how stakeholders perceive and respond to an event. A conduct failure can trigger reputational exposure, but reputation may also be affected by product, cyber, strategic or third-party events.

Is reputational risk the same as operational risk?

No. Operational risk concerns failures involving people, processes, systems or external events. Those failures can damage confidence, but the reputational effect is a separate pathway of stakeholder response and business consequence.

How should a company manage reputational risk?

Identify stakeholders and triggers, assess materiality, prevent underlying failures, monitor early indicators, prepare decision and communication protocols, respond with verified facts and remedial action, then test recovery and update controls.

What should a crisis response plan include?

It should define escalation thresholds, decision authority, the response team, evidence preservation, legal and regulatory review, stakeholder notification, media and social protocols, approved communication channels, alternative operating arrangements and recovery criteria. Teams should test the plan through realistic exercises.

How do sustainability issues affect reputation?

Environmental, labour, human-rights or governance issues can create exposure when a company's operations or public claims diverge from evidence, stakeholder expectations or applicable rules. The legal duties and reporting requirements depend on jurisdiction, sector and company size.

Can reputational risk be insured?

Some policies may cover defined costs connected to cyber response, crisis advisers, business interruption or liability claims. Abstract loss of trust, customer departure or valuation decline may not be covered. Coverage depends on the wording, exclusions, event and jurisdiction, so the policy must be reviewed against the scenario.

Where does reputational risk sit in enterprise risk management?

Some organisations maintain it as a standalone risk. Others apply reputation as an impact dimension across conduct, compliance, operational, strategic and third-party risks. Either model can work if it avoids double-counting, assigns ownership and links thresholds to decisions.