.png)
Why Reputational Risk Is Managed Too Late
- Julien Haye
- Feb 6
- 13 min read
Updated: Feb 7
Introduction: What Actually Shapes Reputational Risk
Reputational risk is rarely shaped by crisis communications or media strategy. It takes form through the way ordinary decisions are made, justified, and repeated as work progresses, as well as through what is allowed to remain unresolved when attention is elsewhere. Over time, approvals, exceptions, and unchallenged decisions interact to define what the organisation is ultimately prepared to stand behind.
In most organisations, reputational risk processes operate broadly as intended. Potential impacts are discussed, sensitivities are assessed, escalation routes exist, and reporting is prepared for senior forums. From a distance, the system appears attentive and well governed, with reputational considerations visible and formally acknowledged within established governance routines.
Closer to decision-making, the experience is different. Judgement is exercised continuously to balance commercial objectives, regulatory expectations, and delivery pressure. Choices are made about what is acceptable, what can be justified, and what does not require further challenge. These choices are rarely shaped by reputational frameworks in isolation. They are shaped by how the organisation responds when scrutiny is still hypothetical and consequences feel remote.
As these decisions accumulate, patterns begin to form. Choices that are lawful and defensible in isolation combine into exposure over time. Reputational concerns are often acknowledged and, in some cases, do influence outcomes, but doing so typically requires sustained challenge or explicit authority. In most situations, escalation occurs once attention becomes likely rather than at the point where exposure is being created. This does not reflect poor intent or disregard for risk. It reflects how reputational risk has been positioned within governance.
As a result, boards encounter reputational risk through papers that describe potential impact, sensitivity, and escalation status. Management encounters it through day-to-day decisions about what to approve, what to defer, and what can be absorbed locally to keep delivery moving. Both perspectives are rational. The problem is that reputational risk is often designed to connect them only after choice has narrowed and flexibility has already been lost.
This article examines reputational risk through that lens. It argues that reputational risk is not an impact to be managed, but an exposure created through decisions, including judgements about regulatory reaction that are often treated as objective when they are not. It explores why impact-led frameworks satisfy oversight while leaving organisations exposed, how reputational constraints accumulate without misconduct or crisis, and what boards must govern upstream if reputational risk is to shape outcomes and limit reputational damage rather than explain them.
Executive takeaways
For readers scanning rather than reading in full, five governing insights frame the argument that follows:
Reputational risk is created by decisions, not by scrutiny. Exposure forms through ordinary approvals, exceptions, and trade-offs long before impact becomes visible.
Most reputational failures are timing failures, not awareness failures. Frameworks often operate as designed, yet enter governance only after choices have narrowed.
Impact-led reputational frameworks manage reaction, not exposure. They document sensitivity and escalation effectively while leaving decision-making largely unconstrained.
Reputational exposure accumulates through repetition, not misconduct. Lawful and defensible decisions, taken in isolation, interact over time to reduce strategic flexibility.
Boards encounter reputational risk through outcomes, not through formation. Surprise escalation and limited room to manoeuvre indicate when governance has arrived too late to shape choice.
How Reputational Risk Became an Impact Category
Reputational risk is rarely treated as a risk in its own right. In most organisations, it is framed through its consequences rather than its sources. Discussion focuses on adverse media coverage, stakeholder reaction, regulatory scrutiny, or brand damage. These are visible effects. They are not the risk itself.
This framing has become normal because reputational harm is difficult to assess before it materialises and uncomfortable to engage with while it remains hypothetical. Unlike credit losses or operational risk, reputational impact does not follow a stable loss curve or respond predictably to controls. It emerges through perception, narrative, and external judgement, where organisations and their leaders know they are being watched and evaluated. As a result, governance gravitates toward what can be articulated, documented, and defended after the fact, including anticipated regulatory reaction, rather than toward constraining exposure in advance.
Over time, this has repositioned reputational risk as a secondary overlay. It is assessed once decisions are largely formed, often through qualitative descriptors or likelihood of attention. The emphasis is placed on sensitivity, visibility, and communications readiness. The underlying assumption is that reputational risk appears when something goes wrong and must then be managed.
This design choice has practical consequences. When reputational risk is defined by impact, it becomes reactive by construction. It enters governance late, competes poorly with commercial and regulatory arguments, and relies heavily on discretionary judgement without clear mandate. Escalation feels optional rather than required. Challenge becomes advisory rather than decisive.
The result is a pattern that will be familiar to many boards and regulators alike. In supervisory reviews and post-incident assessments, reputational risk is rarely found to have been ignored. It is typically identified, discussed, and documented, often with clear escalation and reporting. What is less frequently evidenced is early constraint on the decisions that created exposure. Organisations become increasingly well prepared to respond to reputational impact, while the accumulation of exposure through repeated approvals and exceptions remains largely unaddressed.
Reputational Impact vs Reputational Risk
Reputational impact and reputational risk are often used interchangeably. They describe different things and sit at different points in time. Confusing them weakens governance.
Reputational impact refers to what is observed after an issue becomes visible. It includes loss of trust, adverse media coverage, regulatory discomfort, or stakeholder pressure. Impact is retrospective, describing how an organisation is judged once a narrative has formed. It is typically captured in risk impact matrices and underpins most reputational risk frameworks.
Reputational risk exists earlier. It is created when an organisation makes decisions that may later prove difficult to defend under scrutiny. These decisions can be lawful, commercially rational, and aligned with stated strategy. They still carry exposure because they rely on assumptions about tolerance, context, and interpretation that sit outside the organisation’s control.
The issue is that impact cannot be governed in advance. But exposure can.
When reputational risk is framed through impact, governance is pulled toward prediction. Management is asked to assess the likelihood of attention or severity of reaction. These judgements are inherently unstable because reputation is shaped externally. The organisation does not control when scrutiny will arise, who will amplify it, or which aspects of a decision will be questioned.
When reputational risk is framed through exposure, governance shifts to defensibility. The focus moves from anticipating reaction to testing whether the organisation is prepared to stand behind a decision if scrutiny occurs. Reputational risk becomes a function of choice, not perception.
The consequence is practical rather than theoretical. Impact-led approaches prepare organisations to manage reaction once visibility increases. Exposure-led approaches constrain decisions before commitments are made. Boards that rely on impact reporting therefore see reputational outcomes, not reputational formation. By the time impact is discussed, the window to shape exposure has already closed.
Reputational Risk Definition
Reputational risk is the exposure created when an organisation takes decisions that may later be difficult to defend under stakeholder, regulatory, or public scrutiny.
It arises ex ante, through choices that are lawful, commercially rational, and strategically aligned, yet rely on assumptions about tolerance, context, or interpretation that sit outside the organisation’s control.
Reputational risk is governed by constraining decisions, not by managing reaction.
Reputational Impact Definition
Reputational impact is the observable consequence that occurs once a decision, action, or exposure becomes subject to external judgement.
It manifests through loss of trust, adverse attention, regulatory discomfort, or stakeholder pressure. Reputational impact is retrospective and shaped externally.
Impact can be managed. It cannot be prevented once exposure has crystallised.
Where Reputational Risk Is Actually Created
Potential reputational risks are rarely created by exceptional events. They emerge through ordinary business decisions taken within established governance processes. These decisions are typically lawful, commercially justified, and aligned with strategy at the time they are made.
Common sources include client acceptance and retention, product design choices, geographic expansion, and the selection of partners or third parties. Each decision is assessed independently against policy and regulatory requirements. Each appears reasonable when viewed in isolation.
The exposure forms through accumulation.
In practice, reputational concerns are often raised during approval discussions, typically framed around optics or defensibility. They are acknowledged and debated, yet remain informal and judgement-based rather than systematic. Where such concerns are not anchored to explicit decision rights or escalation requirements, they tend to influence outcomes inconsistently increasing both risk and supervisory response. Similar decisions are therefore repeated, exposure accumulates gradually, and reporting remains stable.
This pattern is not unusual. Reputational risk frameworks often rely on qualitative judgement without clear thresholds or ownership. As a result, escalation depends on individual discretion rather than mandate. Decisions proceed unless someone chooses to stop them. The governance system signals that reputational risk is advisory rather than decisive.
Aggregation further weakens visibility. Dashboards and registers assess items individually. They do not capture how repeated approvals shape an external narrative or reduce future flexibility. By the time exposure becomes visible, it is already embedded in commitments, relationships, and public positioning.
Reputational risk is therefore not located in a single decision. It is located in the pattern those decisions create. Governance that focuses on individual compliance misses the cumulative effect. The organisation becomes exposed not because it ignored risk, but because it never treated reputational exposure as something that needed to be actively constrained.
Figure 1. How Reputational Risk Accumulates Before Impact
Why Boards Are Often Surprised
Boards are rarely surprised by the nature of reputational issues, be it negative feedback on social media or headlines arising from a data breach. They are surprised by how quickly those issues escalate and by how little room remains to manoeuvre once scrutiny begins. Issues shift from 'not on the radar' to full-scale crisis management in a matter of hours.
This reaction is often misinterpreted as a failure of information or foresight. In reality, it reflects a structural gap in how reputational risk is governed. Most board reporting is designed to provide visibility over individual decisions and discrete risks. It does not capture how exposure accumulates across time or how patterns form through repetition.
Each approval appears manageable when viewed in isolation. Reporting remains stable because policies are met and thresholds are not breached. Reputational risk does not trigger escalation because it is framed as an impact rather than an exposure. By the time it becomes visible in board materials, the organisation has already made commitments that limit its options.
External scrutiny accelerates this dynamic. Once a narrative forms, judgement is applied to the organisation’s overall posture, not to the rationale of individual decisions. Boards are asked to respond to a consolidated perception that they have never been shown as a consolidated risk.
This creates a timing mismatch. Governance processes operate on a linear, item-by-item basis. Reputational exposure emerges through aggregation and context. The board sees the issue at the point where reaction is required, not at the point where direction could still be changed.
Surprise, in this sense, is not a failure of diligence. It is the predictable outcome of a framework that reports compliance rather than exposure. Boards are informed about what has been approved. They are not shown what those approvals add up to.
If reputational risk is only escalated once it becomes visible externally, the board’s role shifts from governing risk to managing consequence. The opportunity to shape outcomes has already passed.
The Risk Within provides a roadmap for embedding psychological safety into risk management. It identifies critical touch points across the risk lifecycle and offers clear actions to align leadership, culture, and governance. It is designed to help risk functions integrate more deeply into the business and strengthen decision-making at every level.
The Limits of Impact-Led Reputational Frameworks
Most reputational risk frameworks work as intended. They provide structure, support escalation, and help organisations demonstrate that reputational considerations have been identified and discussed. From an oversight and audit perspective, they perform reliably.
Their limitation lies in what they are designed to measure.
Impact-led frameworks focus on consequences. They assess visibility, stakeholder reaction, and severity of attention. These judgements inform ratings and response planning. They help organisations prepare for scrutiny once it becomes likely.
What they do not do is shape decisions before exposure is created.
Reputational risk therefore enters governance late. By the time impact is assessed, commitments have already been made and options have narrowed. Escalation becomes a discussion about mitigation rather than a mechanism for constraint. Reputational concerns compete poorly with commercial, regulatory, or delivery imperatives because they arrive without decision authority.
Boards experience this as a gap. They receive papers describing sensitivity, scenarios, and response readiness, but little visibility into how exposure has accumulated through repeated approvals and exceptions. Governance remains focused on managing reaction rather than interrogating choice.
This creates an imbalance. Many organisations invest heavily in crisis communications and stakeholder management. These capabilities matter. They do not reduce exposure embedded in earlier decisions.
Impact-led frameworks are effective at demonstrating awareness and preparedness. They are not designed to constrain behaviour upstream. Treating them as a complete governance solution leaves organisations well prepared for scrutiny and structurally exposed to its accumulation.
Reputational risk cannot be governed solely through impact assessment. It must be governed through decision discipline before scrutiny becomes likely.
Table. Impact-Led vs Exposure-Led Reputational Risk Governance
Reputational Risk as a Strategic Constraint
Reputation does more than influence how an organisation is perceived. It defines the range of actions the organisation can credibly take as conditions change. In this sense, reputational risk operates as a strategic constraint, shaping future optionality long before any visible impact occurs.
When reputational exposure accumulates, strategic flexibility narrows. Growth options become harder to defend. Portfolio shifts attract greater scrutiny. Decisions that might otherwise be acceptable require additional justification or are no longer available. This effect is rarely visible in advance because it does not present as a single risk event. It emerges as a reduction in room to manoeuvre.
This constraint becomes most apparent during periods of stress, transformation, or expansion. Organisations carrying latent reputational exposure have less tolerance for error and less capacity to adapt. External judgement accelerates precisely when strategic choices need to be made quickly. The organisation is forced to prioritise defensibility over opportunity.
Impact-led frameworks do not capture this dynamic. They focus on managing reaction once visibility increases. They do not surface how today’s decisions shape tomorrow’s strategic envelope. As a result, boards are often asked to make consequential choices without a clear view of how reputational exposure limits their range.
An exposure-led approach reframes reputational risk as a condition of strategic freedom. It integrates reputational judgement into decisions that commit the organisation to a path. This does not mean avoiding difficult or controversial choices. It means making them consciously, with a clear understanding of the constraints they create.
Boards that govern reputational risk in this way retain control over direction. They understand not only what the organisation is doing, but what it will still be able to do next. Reputation becomes a managed dimension of strategy rather than an external force that reacts to it.
Board Test: Are We Governing Reputational Risk Early Enough
Decision timing: Is reputational exposure considered before major decisions are approved, not after they are formed
Defensibility: Can we clearly explain which decisions we would stand behind under external scrutiny
Aggregation: Do we see how similar decisions add up over time, not just individual approvals
Escalation: Does reputational concern trigger challenge by design, not by individual discretion
Strategic constraint: Do we understand how today’s decisions limit what we can credibly do next
Regulatory Focus and the Wrong Outcome
Regulators are not asking organisations to manage reputational risk badly. They are asking them to evidence that it was considered. The difference matters.
Supervisory frameworks focus on what can be observed, documented, and reviewed after the fact. Reputational impact fits this requirement. It can be described, scored, escalated, and audited. As a result, regulatory attention naturally gravitates toward impact, response readiness, and documentation of challenge.
This focus is incomplete. It encourages organisations to optimise for demonstrability rather than effectiveness.
When regulatory scrutiny centres on impact, firms tend to design reputational risk frameworks that perform well under review. Risks are articulated, heatmaps completed, escalations recorded, and boards can demonstrate that reputational considerations were discussed. What this does not guarantee is that exposure was meaningfully constrained before commitments were made.
The unintended consequence is predictable. Reputational risk enters governance late, once decisions are largely settled and optionality has already narrowed. The framework proves awareness. It does not shape outcomes.
This reflects the limits of supervisory perspective, not the purpose of regulation. It is a failure of translation. Regulators assess governance retrospectively. Reputational risk must be governed prospectively. Treating supervisory signals as a complete governance model collapses these two timelines into one and leaves boards exposed.
The most concerning outcome is not regulatory pressure itself. It is how organisations respond to it. Many conflate regulatory sufficiency with good governance. They assume that if reputational impact has been assessed and escalated, reputational risk has been managed. In practice, it has often only been described.
This creates a paradox. Firms appear well governed to supervisors and well prepared for scrutiny. They remain vulnerable to the accumulation of exposure that those same frameworks never surface.
Regulators are effectively pushing for the wrong outcome only when their expectations are treated as the finish line rather than the floor. Impact-led supervision is necessary. It is not designed to constrain decisions. Organisations that rely on it to do so are outsourcing governance to a process that was never meant to carry it.
Boards that recognise this gap do not resist regulation. They go beyond it. They meet supervisory expectations on impact and escalation while deliberately governing reputational exposure upstream. Those that do not remain compliant, articulate, and surprised.
Our Risk Leadership Diagnostics help leaders identify behavioural blind spots and shape more accountable risk decisions.
Closing Perspective
Reputational risk is not primarily a communications challenge. It is a governance challenge rooted in how decisions are framed, tested, and approved.
Organisations that focus on reputational impact invest heavily in response. They prepare to explain, mitigate, and recover once scrutiny arises. This capability has value. It does not address how exposure is created.
Reputational risk forms earlier, through ordinary choices that appear reasonable in isolation. When governance treats reputation as an outcome, these choices proceed unchecked. By the time impact becomes visible, the organisation’s options are already constrained.
An exposure-led approach shifts attention to defensibility before commitment. It integrates reputational judgement into decision-making rather than treating it as a post hoc overlay. This does not eliminate difficult decisions. It ensures they are taken consciously, with a clear understanding of the constraints they create.
Boards that govern reputational risk in this way retain strategic freedom. They shape what the organisation is prepared to stand behind, rather than reacting to how it is judged. The difference lies not in awareness, but in when governance intervenes. Reputational risk is governed most effectively when it never needs to be explained.
About the Author: Julien Haye
Managing Director of Aevitium LTD and former Chief Risk Officer with over 26 years of experience in global financial services and non-profit organisations. Known for his pragmatic, people-first approach, Julien specialises in transforming risk and compliance into strategic enablers. He is the author of The Risk Within: Cultivating Psychological Safety for Strategic Decision-Making and hosts the RiskMasters podcast, where he shares insights from risk leaders and change makers.