Reputation Resilience

Report 2013/2014

Reputation resilience

A study into the emerging professionalisation of corporate reputational risk management

Reputation Resilience Def: The ability to prevent, withstand and recover from negative reputation incidents.

We believe that ability is based on: 1. Organising factors: systems, processes and compliance 2. Operational behaviours: responsibility, knowledge and attitude 3. Leadership qualities: values, culture and governance

Page 1

CONTENTS 3 5

Introduction Methodology THE BIG LEARNINGS A discussion of the top ten insights revealed by the research

9 11 13 17 19 21 25 27 29 33

Reputation Resilience a growing concern The emergence of a distinct discipline New media, new rules Information feeding activism The board, the buck starts here Responsibility for reputation resilience is falling through the cracks The most resilient companies have experienced crisis True resilience is the reserve of the few Reputation demands a more systematic approach The Holy Grail: Being fast whilst being considered Towards Best Practice What practical steps can we all take from the collective knowledge of our interviewees?

37 38 39 40 41 42

Start with a review Choose the right language to engage the board Reputational risk requires a different approach Bridge the gap between legal and communications Plan for a crisis to prevent a crisis Building your reputation resilience

Page 2

Reputation resilience: Introduction

Introduction Those tasked with protecting corporate reputation find themselves on uncertain ground. Anecdotally we can see the penalties for failing to protect reputation escalate - whether that means serious issues receiving attention on campaigning websites, newspaper pages or the uncomfortable chairs of the Public Accounts Select Committee.

At the same time many of the tools businesses use to protect themselves are still evolving to meet the pace of social and technological change. Managing public perception by managing the mainstream media retains a role, but it is clear online publication is eroding the comfortable certainty that used to come from knowing that dissuading a newspaper from airing an issue would keep it unaired forever.

How should those of us who strive for better answers and take up the challenge of thinking differently begin to address this issue? A helpful starting point is to examine what it is that makes us feel that our businesses are resilient to reputation risk. By seeking to confirm the accuracy of our anecdotal observations on where threats and opportunity arise and by testing the assumptions we work on, we can begin to identify what might be done differently. The ultimate aim is to start rebuilding that assurance that, by doing the right things, reputations can be protected.

Page 3

So where do our results suggest we are? It is no surprise to see the additional time devoted to reputation confirmed, but the trend is with CEOs and lawyers as well as communications teams, with nearly two thirds spending more time on reputation than two years ago.

But perhaps the most significant trend is the variation in how businesses are meeting the challenge of change. No two interviewees responded alike, and across a wide array of public companies we heard a multitude of different models by which they seek to capture and deal with reputation threats. Many businesses spoke of missed opportunities, citing inadequate communication across teams leaving risk, legal or communications departments making decisions that could have benefitted from colleagues’ insight earlier. Allied to behavioural points, others cited a lack of clear process and awareness of the right approaches to take. Perhaps summing this up we found senior staff, including CEOs, to be surprisingly unclear as to where accountability for reputation lies. Against this context it is perhaps unsurprising that only just over a quarter of our respondents had a high degree of confidence in the resilience of their reputation.

Reputation resilience: Introduction

So far, so uncertain. Emerging from our findings though was a rather more hopeful picture. For all our interviewees who spoke of the difficulty engaging the board in reputation problems until something that worried them arose, others spoke of CEOs leading frequent, cross-business reputation committees. Likewise for the many tales of exasperation our research team heard of times when legal and communications teams worked at cross-purposes, others talked compellingly about how they help each other do their job better through the right behaviour and the right approaches. All the while, the greatest perceived threats expressed were those that seem uncontrollable, the actions of third parties and nebulous information outside the protection of the company. Recognising what it is that concerns us and what it is we must address, lets us start to focus on what can be done to guard against it.

Change to how we protect corporate reputation will not stop. Technology will advance and legislation will change, bringing fresh challenges, opportunities and accountability. As we understand what threatens us and what inhibits our ability to defend ourselves better, businesses allow themselves to face change with confidence. We hope this research aids that understanding.

Schillings.

“I don’t think we’re masters of our own destiny anymore.”

Head of Legal, FTSE 100 Company

Page 4

Reputation resilience: Methodology

Methodology The research targeted those reported to be responsible for reputation from UK FTSE 350 and leading private companies. The respondents questioned comprised of Communications Directors, Heads of Legal, CEOs and Risk Managers.

The research, which was in three parts – online questionnaires, in-depth interviews and desk research – took place between February and May 2013 and was led by independent research company RSG Consulting.

RSG Consulting, established in 2001 and specialises in the legal sector. Its clients include most of the major law firms in the UK, Europe and the USA and publishing houses.

Data Sample Sizes

Online: 47

43

10

100

Comms

Legal

Risk

Total

22

13

3

7

45

Comms

Legal

Risk

CEO

Total

In-depth interviews:

Page 5

My number one job is reputation management especially if things go wrong. As the CEO of the business I own the responsibility.

CEO, Leading Private Company

Page 6

The Big LearniN A discussion of the top ten insights revealed by the research

GS

Reputation resilience: The big learnings

1. Reputation Resilience iS a growing concern Insight The clearest indication that reputation risk management is moving up the corporate agenda is the increased amount of time being dedicated to it. Overall 63% of respondents said they spent more time on managing reputation than they had two years ago, with the figure rising to 80% amongst Risk Managers.

Data

“Reputation is everything” Head of Corporate Affairs, FTSE 350 Company

“ I’m constantly thinking, ‘have I got everything in place to combat the threat?’”

CEO, Leading Private Company

Page 9

Reputation resilience: The big learnings

Data How haS youR approacH tO managinG reputational risk changed in the last two years?

Risk

More time spent on it Stayed the same Less time spent on it

80% 20%

Communications

68% 30% 2%

Legal

53% 47%

Sample: 100 quant responses

0%

10%

20%

30%

40%

50%

60%

70%

80%

What this means That more time is being spent on this issue than ever may be due to a number of macro factors; heightened expectations around corporate transparency, new laws and regulation, the ability to mobilise campaigns quickly in the digital environment. On a more human level it may also be the result of a greater awareness amongst individuals of their own reputation. It is now far easier to find out information about particular people within a firm and to assess them individually.

Page 10

Reputation resilience: The big learnings

2. The emergence of a distinct discipline Insight For the majority of those interviewed (72%), reputation risk is dealt with under the broader risk management framework. There is however, evidence that a group of pioneers (17%) are starting to treat the management of reputation risk as a separate function with formal reporting to the board.

As reputational risk management grows in importance, a number of companies have restructured their leadership team and reporting systems. Indeed five of the FTSE 100 have introduced steering groups to focus on reputation risk.

Data HoW does the board have the reassurance that reputation risK is being adequately dealt with?

Reputation risk part of broader risk management

73%

Formal reporting to board on reputation risk

17%

Reputation risk dealt with separately

10%

Sample: 29 qual responses

Page 11

0%

10%

20%

30%

40%

50%

60%

70%

Reputation resilience: The big learnings

Data

“ Reputation risk is one of our key risk factors on our risk register. It is considered both at board level and by the risk committee.”

Head of Legal, FTSE 100 Company

“ I think you always need to factor in (reputation) risk at the beginning, that’s part of the reason why things go wrong.”

Head of Communications, FTSE 350 Company

What this means Whether a new job role dedicated solely to reputational risk management is necessary or not, a clear point of leadership is important. Where Communications Directors are good at the intuitive elements of reputational risk management, some felt they were lacking in the more structured tools required to capture risk information. Similarly, whilst Risk Managers are good at applying processes for assessing and managing uncertainty, they admit to finding the assessment of reputational risk more difficult. This is largely because they felt they do not have a deep understanding of how reputational issues can flare in the hands of media and third party detractors.

Page 12

Reputation resilience: The big learnings

3. New Media, New Rules Insight There can be few topics that have had more articles, seminars, webinars and general evangelism dedicated to them over the last five years than social media in business. Despite the heralding of a brave new world, the study shows that a portion of businesses still remains cautious, with over a quarter feeling that the new media landscape carries with it a serious threat.

Data Do you currently seE sociaL mediA more as a threaT oR aN opportunity in youR organisation?

Currently more of an opportunity

56%

Currently more of a threat

27%

Currently neither a threat or an opportunity

14%

3%

Don’t know Sample: 100 quant responses

Page 13

0%

10%

20%

30%

40%

50%

60%

Reputation resilience: The big learnings

Data

“ The press is no longer the only medium, reputation is managed through immediate global channels where all views are expressed and can be heard.”

Head of Corporate Communications, FTSE 100 Company

“ Social media and the internet mean that unfair or incorrect articles or messages about the company can spread very quickly.”

General Counsel, FTSE 100 Company

What this means In our more connected world companies have to consider both how they act as a publisher of content and how they react to content created about them. The rules of engagement are far less clear cut, some respondents believe that saying nothing can often be as damaging as saying the wrong thing.

Social media’s ability to contribute to the snowballing of negative stories is well documented. The flipside of this phenomenon is its ability to operate as an early warning system and is seen as crucial to safeguarding and enhancing reputation by both communication and legal professionals with over half (56%) seeing it as currently more of an opportunity than a threat. Consumer facing businesses in particular are using social media to enable a real time feedback loop with their customers to quickly pick up when something goes wrong.

Ten years ago, the first you heard of a negative story might have been its appearance on the front page.

Today it is possible to spot stories building online before they ‘break’ in the mass media, leaving greater scope for preventative action. Handled sensitively knowledge of the law together with an understanding of the rules of engagement online can be coordinated to minimise an issue escalating into a crisis.

Page 14

The press is no l medium, reputat through immedia channels where expressed and c Head of Corporate Communications, FTSE 100 Company

onger the only ion is managed te global all views are an be heard.

Reputation resilience: The big learnings

4. Information feedinG activism Insight The majority of respondents agreed that the main causes of reputational risk are as a direct consequence of business under-performance. The second most cited cause however, is a direct result of the actions of third parties. Specifically, respondents identified the issue of misinformation about the business entering the public domain either via an unprofessional press, competitors or disgruntled external stakeholders. Several interviewees mentioned “spurious accusations” that are difficult to counter as being serious concerns.

Data

“ There are numerous portals for people to express their views now and they get away with it. That’s an extra risk. Being able to manage that proactively is a challenge.”

CEO, Leading Private Company

“ Working for a well-known ‘brand’, it makes us vulnerable to attack from stories that are a good read, but not necessarily in the public interest or our own.”

Head of Communications, FTSE 350 Company

Page 17

Reputation resilience: The big learnings

Data What do you personally fear the most in terms of threats that will significantly damage your company's reputation?

1

Business Under-performance

2

Information Risk

3

Operational Risk

4

Health And Safety Incidents

5

Employee Behaviour

6

Social Media

7

External Conditions

8

The Unknown

9

Non-Compliance

10

Industry Reputation

11

External Stakeholder Mismanagement

12

Data Security

What this means In the old regime the command and control model was sufficient to assert authority over the major third party conduit, the mainstream media. Many organisations feel that today the greater availability of information is feeding activism from a broader range of third party groups, from disgruntled employees to NGOs, trade unions and even irate foreign governments.

The more varied nature of these threats requires a more diverse mix of skills to deal with them. The same tactics traditionally used for a media owner may be less effective when your antagonist is an unknown activist operating anonymously. In these situations investigative, forensic and technological services become of far greater importance.

Page 18

Reputation resilience: The big learnings

5. The board, the buck startS here Insight Despite the extra time being dedicated to it, it is clear that for many organisations reputation risk is still not a top table issue. Over a third (37%) of those interviewed cited lack of interest from the board as the biggest obstacle to making the changes they thought necessary to reputation risk management.

A recurring theme is the request for the board to become more aware of reputation risk as a stand-alone item in the risk register.

Data What are the obstacles to you being able to make the required changes to reputational risk management?

CEO/board removed from reputation risk; lack of focus without a crisis and too much reporting

37%

Individuals attitude/behaviour/habits/culture

18%

Lack of budget/difficulty of allocating budget to non-present threats

18%

Lack of time, resources and control

15%

Company structure/confusion over ownership

12%

Sample: 33 qual responses

Page 19

0%

5%

10%

15%

20%

25%

30%

35%

40%

Reputation resilience: The big learnings

Data

“ You need to build it from the top, you need the chief executive to lead.”

Head of Corporate Affairs, FTSE 100 Company

“ The challenge is not knowing where something is going to hit and when it’s going to happen. In a sense I don’t know what I should be worrying about” Corporate Affairs Director, Leading Private Company

What this means This is a significant issue given the rapidly changing political, economic and environmental worries across the world. This high level strategic thinking requires the board to be agile in a volatile world. “Being a global business, you have to know what’s happening in parts of Asia and South America”. These external forces can mean that organisations get caught out as the political mood changes. For example, one interviewee mentioned receiving funding from a country some years ago which has recently come to be viewed as repressive, and is now being called to account for a potentially unethical investment.

Today CEOs are more likely than ever to pay for a poorly handled reputational issue with their job. It is interesting therefore, that many interviewees felt reputational issues needed to become potential crises for the CEO to sit up and take notice.

This may be the result of many CEOs labouring under the perception that their reputation is purely the result of organisational performance, unaware of the myriad of less predictable threats. The findings show that some CEOs are asking their legal and communications teams to demonstrate exactly how they are protected. They are regularly discussing their lists of potential reputation threats and preparing for different scenarios for what today seems to be the inevitability of an eventual reputational crisis.

Page 20

Reputation resilience: The big learnings

6. Responsibility for reputation resilience is falling through the cracks Insight Across the full sample of companies interviewed, there was no consistent answer to the question of who is responsible for reputation risk on a day-to-day basis. Many directors of legal or communications do not feel directly responsible for reputation risk and there is little consensus across companies on precisely who is responsible for the company’s reputation. Around a quarter of the guardians (23% of communications and 28% of legal) did not feel directly responsible for the risks to their company’s reputation.

Data

“ The reality is you need the front line embedding an approach to reputation risk. “ Head of Corporate Affairs, Leading Private Company

Page 21

Reputation resilience: The big learnings

Data Do you feel directly responsible for the management of risks to your company's reputation?

23% 28%

Yes No Unable to answer

4%

Legal

Communications 72%

9% 63%

Sample: 100 quant responses

What this means Whilst an increasing number of firms are appointing a dedicated reputation risk manager, this is not necessarily the magic formula. Where the board can see external strategic threats in political and economic areas it is the operational staff that are the closest to emerging threats on the ground. The key is to have clear and simple processes in place so that every individual in the organisation understands why and how to identify a threat and who to escalate it to. Leadership at every level, embedding the company values and a culture of ‘reputation guardianship’ can go a long way to creating a spirit of ownership of the reputation amongst every employee. Ensuring information is being shared efficiently internally is crucial to achieving this.

Complex organisational structures risk confusing responsibility and a number of businesses have recently tried to simplify reporting structures to ensure clear reporting lines. This connects key managers to both the front line and allows direct access to the CEO for when crises hit.

Page 22

I know the managem risk is there becaus the legal team. If I'm not sure how much t know and think abou Legal Counsel, FTSE 100 Company

ent of reputation e of my role within honest though, I'm he wider company t it.

Reputation resilience: The big learnings

7. The most resilient companies have experienced crisis Insight In business as in life, the lessons that stick are often those that have been learnt the hard way. The companies most likely to be confident in managing a negative reputation incident were the ones that had gone through a crisis in the last decade.

Page 25

Reputation resilience: The big learnings

Data

“ Recent history tends to colour your tolerance of reputation risk.”

Head of Communications, Leading Private Company

“ Given my experience when I move to a new company one of the first things I do is ensure that we have a crisis communications plan.”

CEO, FTSE 100 Company

What this means It is not surprising that those who have experienced crisis invest more time and money in preventing future crises. For those yet to experience crisis it is always going to be more difficult to put money where you cannot see growth results. It is therefore vital for the reputation guardians in these companies to make the threat real to the decision makers. When the potential cost of reputation damage is taken into account, from a board reshuffle to a mass loss of customer base, the cost of a preventative measures are easy to justify.

We also found that those most satisfied with how their company managed reputation risk had the closest working relationships between their departments.

Page 26

Reputation resilience: The big learnings

8. True resilience is the reserve of the few Insight When it comes to reputation it seems few companies are resting on their laurels. When asked how confident they were in the resilience of their reputation the majority (55%) were ‘confident enough’, with 29% ‘very confident’ and the remaining 16% ‘not confident at all’.

Data

“ It is part of the responsibilities of larger companies to share policies with smaller ones. I say why not steal with pride.

These are policies that are scalable.”

General Counsel, FTSE 100 Company

Page 27

Reputation resilience: The big learnings

Data How confident are you that your organisation is resilient against challenges to reputation?

Confident enough Very or extremely confident Not at all confident or unsure

16%

29%

55%

Sample: 100 quant responses

What this means The figures are not surprising, in today’s climate nobody should feel 100% confident. It could be argued that the 55% who identify themselves as just ‘confident enough’ are in a healthier frame of mind than those who felt they were ‘extremely confident’. While nobody can ever be 100% certain of resilience however, a certain level of confidence can be achieved through a number of easily implemented measures, covered in the next section ‘Towards Best Practice’.

Page 28

Reputation resilience: The big learnings

9. Reputation demands a more systematic approach Insight Several participants in the study keenly felt the lack of resources in terms of time, budget and manpower, to spend on prioritising reputation risk management. A theme throughout the interviews was a sense that senior management, in particular the board, needed to become more aware of reputation risk as a stand-alone item in the risk register. One communications director said that if she had a magic wand, she would use it to create budget to spend on issue training for senior managers and the board. Others felt that it would benefit the organisation if there was a non-executive board director who had responsibility for reputation.

Page 29

Reputation resilience: The big learnings

Data What single improvement would you make to your organisation's approach to reputation risk management?

Improve communications between departments/individuals

24%

Better processes and more measured approaches

21%

More proactive external/media communications

11%

Foster more awareness and ownership of reputation risk amongst staff

11%

No change necessary

9%

Increase budgetary spend on reputation risk

9%

Greater awareness from CEO/Board level needed

8%

Horizon scanning

4%

Sample: 41 qual responses

0%

5%

10%

15%

20%

25%

“ If you get the foundations right then reputation management becomes more about things such as increasing staff engagement.

These should be the essential building blocks to reputation risk and you can reap huge results if you get this right.�

Head of Corporate Affairs, Leading Private Company

What it means The spread of solutions put forward by respondents demonstrates that currently there is a difficulty in seeing the wood for the trees in this area. The creation of adequate systems and processes to deal with these issues will require a joined up approach and some form of centralised oversight.

Page 30

We should probably ha monitoring and reporti division, so being proac reactive is tough. We w better off putting bar than trying to build th Head of Communications, FTSE 100 Company

ve a budget for ng risk. We're a small tive rather than ould probably be riers up rather em afterwards.

Reputation resilience: The big learnings

10. The holY grail: Being fast whilst being considered Insight There is a fundamental tension at the heart of reputation risk management between communications and legal teams. It could be summed up as, legal departments are slow but considered, communications departments are fast but inherently reactive in their approach.

Data The holy grail: Being fast whilst being considered

Legal • Say nothing • Considered response

Page 33

Communications • Say something • Fast response

Reputation resilience: The big learnings

Data

“ If we’re the market leader and part of our business integrity is our professionalism we shouldn’t be making knee jerk reactions.”

CEO, Leading Private Company

What this means Respondents felt that by their very nature lawyers tend to be cautious and will generally act only after careful consideration. Communications professionals tend to be fleeter of foot. However, relying purely on leveraging relationships with influences to smooth over reputational crisis will mean the balance of power is always tipped against you. Where respondents worked best together the ideal solution has been to use the power of law, applied with the nimbleness and sensitivity to the potential negative fallout expected in the world of communications.

Page 34

TowarD Best PR What practical steps can we all take from the collective knowledge of our interviewees?

S actice

Reputation resilience: Towards best practice

Start with a review As we have seen there is some evidence of the emergence of a dedicated Reputation Risk Manager role. In most cases a full-time appointment will not

be necessary provided an individual or group within the organisation is assigned ownership of the issue and is clear on remit and accountability.

Their first action should be to perform a discrete tactical review in this area.

Before starting the review ask yourself these crucial questions:

1 2 3

Page 37

Have you taken account the broad scope of reputation risks? For example, have executive privacy risks been considered or the impact of your CEO’s reputation? Half the respondents felt the company reputation is linked to their CEO’s reputation.

Have you considered the full range of stakeholders? Too often reputation impact assessments are limited to media impacts. Who really matters to your business, and what matters to them?

Have you asked your staff if they feel responsible for the company’s reputation? Staff should know who and how to inform decision makers of intelligence relating to a potential reputation issues.

Reputation resilience: Towards best practice

Choose the right language to engage the board Our cohort told us the lack of a clear profit motive can make it difficult to secure buy-in for defensive reputational risk activity. Reputation cuts across the whole business, so it should be possible to frame the need and form a language most persuasive to the individual decision makers on your board.

For example, if the board are accountants talk in numbers, if they are marketeers speak the language of brand equity.

You could pose this as a question to the board and ask them what would stop the organisation meeting its corporate objectives. What you learn could help you create the business case for greater investment in building your reputation resilience.

Doing so enables risks to be made real without waiting for something to go wrong. The statistics show that a CEO will experience a critical reputation issue at least once in their term, make sure they understand that and its consequences.

“ Accountants dominate boards and so you need vocabulary to get their attention onto things that are not immediately money measured.�

General Counsel, FTSE 100 Company

Page 38

Reputation resilience: Towards best practice

Reputational risk requires a different approach The need for sophisticated risk management processes might appear obvious, but many participants in this study were not satisfied with what is currently available. Improvements to reputation risk management were the second most identified area for change.

Enterprise risk management is often inwardly focused or else focuses exclusively on tangible impacts when looking at risks emanating from the business.

Conversely reputation risk management needs to take an external, multi-stakeholder view when assessing the impact of emerging issues, as well as strategic, operational and leadership risks on all stakeholders.

Identified prevailing issues should be a standing item on the agendas of the board, reputation risk steering groups and all operational front line teams.

Doing this enables a business to get the right people involved in deciding whether to accept a risk and what step to be taken to mitigate it. Issues such as tax planning offer a clear example of entirely lawful and high performing behaviour from one team generating a reputational risk which may not be considered as a reputation issue at the time the decision was made (or at least might not have been in the past).

This area is emerging and is still fragmented. An analysis of FTSE 100 annual reports, corporate responsibility reports and sustainability reports revealed the following practices:

6

Companies have commissioned reputation research

5

Companies have set up dedicated committees or management groups to deal with reputation matters

4

Companies specifically mention reputation risk as a consideration for investment and acquisition

3

Companies conduct ‘reputation risk deep dives’ from identified operational risks

2

Companies mention the policy of claw back of executive pay with regards to reputation damage

Page 39

Reputation resilience: Towards best practice

Bridge the gap between legal and communications CEOs and communications directors included in the study both felt that the legal team was more likely to be responsible for blocking effective collaboration or understanding between the two functions. Where legal directors or team members had some professional or industry exposure to communications and PR, the working relationship ran most smoothly.

One trend highlighted was for legal directors to move into corporate affairs or similar roles, allowing them to act as bridges between the functions.

Placing a General Counsel in a role with a heavier external communications responsibility for a short stint could potentially help organisations become more proactive in promoting positive reputation with the backing of their legal guardians.

“ As a group CEO you have to make sure it is a healthy conflict which essentially gets you the right advice.

The difficulty is to not undermine each other’s messaging.�

CEO, FTSE 250 Company

Page 40

Reputation resilience: Towards best practice

Plan for a crisis to prevent a crisis Confidence in the company’s reputation resilience often came only after hard fought lessons learnt in crises. In a major crisis, people rally around one another and the CEO and the Board can step in to give strategic direction. However, most companies understand that they should not wait until after the event to ensure they have strong and well-rehearsed crisis management plans in place.

In a major crisis the CEO may step in and provide a strong hand of control, but in the day to day, many felt there needed to be a single individual responsible for crisis management and arbitrating

Page 41

between conflicting priorities. Where there is a dedicated Reputation Risk Officer, or dedicated committee or group, they also need to have “teeth.�

To ensure fast decisions can be taken, this requires a direct reporting line to the CEO. Both legal and communications directors say they need to be involved earlier in risk assessment and planning, and to have more strategic input into commercial decisions. Communications directors in particular felt that their role was too often limited to one of fire-fighting after the crisis had happened.

Reputation resilience: Towards best practice

Building your reputation resilience Most major companies face a business environment in which reputation risk is unavoidable which over three quarters of our interviewees agreed with.

Complicated by compliance, heavy regulation and growth in emerging markets, the risk profile of these companies is not a simple one to manage.

The associated potential for reputation damage is ever more immense with the growing importance of the ‘reputation economy’.

Building a resilient reputation is in your control.

1

Understand what will prevent strategic objectives being met

2

Achieve buy-in and leadership from the board

3

Mobilise a steering group who continually assess intelligence

4

Develop a culture of responsibility from front line to board

5

Enable internal communication for rapid escalation of issues

“At the end of the day business is about risk.”

Director of Corporate Affairs, Leading Private Company

Page 42