There is, as yet, no commonly accepted definition of reputation risk. The Financial Services Authority (FSA), the Capital Adequacy Department (CAD), the Basel Committee, the Federal Reserve and the Committee of European Banking Supervisors (CEBS) have all published definitions. These have some common elements but also some significant differences.
According to the Basel Committee, 'reputation risk arises from operational failures, failure to comply with relevant laws and regulations, or other sources. Reputation risk is particularly damaging for banks, since the nature of their business requires maintaining the confidence of depositors, creditors and the general marketplace'
The link to failure to comply with laws and regulations makes it seem similar to the legal and compliance risk definitions. The difference should lie in the impact, as reputation risk affects the general confidence of depositors, creditors and marketplace. It thus differs from legal and compliance risk, a sub category of operational risk, in the magnitude and type of impact, the cause being the same. The specific element belonging to reputation is that it must affect the company's marketplace confidence.
In the CEBS C^P10, 'reputation risk is the current or prospective risk to earnings and capital arising from adverse perception of the image of the financial institution on the part of customers, counterparties, shareholders, investors or regulators'. As in the Basel definition, the typical element of reputation risk in CEBS is the company's market perception. CEBS is not including any elements or factors related to causes or processes that could be generating reputation risk.
The American Federal Reserve in a paper by Perry and de Fontnouvelle, indicates that 'reputation risk is the potential that negative publicity regarding an institution's business practices, whether true or not, will cause a decline in the customer base, costly litigation, or revenue reductions'. These elements are combined and possibly best fitted together in a definition that lists causes of reputation risk - negative publicity on the company's business practices - and its effects, such as decline in customer base and revenues or an increase in litigation costs.
All these definitions have differences that could lead to problems of interpretation and distinction from other risk types.
Classifying reputation risk
When you look at events that have actually had an impact on reputation, the risk seems to overlap with other risk types. This is due to the fact that reputation risk is strictly linked to the other risks and is, in fact a consequence of them, emerging when the event becomes public.
In February 2002, as a consequence of the irregular activity of a trader, Allied Irish Bank suffered a severe market loss. A trader in the bank's US subsidiary lost money speculating on foreign exchanges, losses were then covered with fictitious options positions, exploiting inadequate risk management procedures. This kind of risk at the beginning could be classified as market, then it becomes operational, and eventually affects reputation.
Another renowned case is the Enron scandal, where financial statements were sustained mostly by institutionalised, systematic, and creatively planned accounting fraud. At the beginning this can be classified as a credit risk event. After the fake accounting it becomes operational and in the end turns out to be a reputation risk, also affecting creditor banks.
More recently a problem affected BAWAG - Bank fur Arbeit und Wirstschaft AG. In 1995 BAWAG started to speculate with hedge funds but in 2000 it lost the capital invested. This situation was known only by few people. In the period 2001-2003 BAWAG used the strike fund to hide its losses and it falsified its balances. In 2005 it bought Postspartkasse with the aim of restoring its balance and hiding the remaining losses. BAWAG cooperated with REFCO to hide the huge losses collected by the trading company speculating in futures markets. Only after the REFCO bankruptcy was the full situation revealed by the new managing director of the Austrian bank. This is a case that encompasses all the risks: market, credit, operational and at the end, reputation risk.
Measuring reputation risk
A common approach to modelling reputation risk is a multi-factorial asset pricing model, linking the return of the stock to the return of the market portfolio, the industry sector and a variable representing the reputation factor. This last variable is assessed by event study methodology, where one investigates how much of the return volatility, observed during reputation event day, is due to some abnormal returns, providing a measure of reputation risk.
A key element in event study methodology is the identification of the event date. It is in fact a critical issue as it is not clear what date one needs to choose. Is it better to consider the date on which the reputation event started or the date on which the news of the event is published? How long does it take before people and investors, the central point in reputation risk, become aware of the event?
Another possible way of measuring reputation risk is as a residual risk: one can define the total return volatility and subtract from this that volatility attributed to market, credit and operational risks. However, this method produces a measure which can cause some problems, as in many cases reputation risk is strictly linked to other risk types, leading to duplications.
Undoubtedly, in measuring reputation risk there may be overlap with other types of risk. This is because reputation seems to be more an effect generated by other risk types than a specific risk in itself. In view of its complicated nature, it is not surprising that a recent survey reported that the majority of companies interviewed stated reputation risk was the most difficult risk to manage.
- Aldo Soprano is head of group operational risk, and Daniele Ruspantini and Marco Penzo are consultant and senior analyst respectively, UniCredito, Milan, E-mail: aldo.soprano@unicredit.it, DRuspantini.Consultant@unicredit.it and marco.penzo@unicredit.it.
