Operational risk management for brands

Brand protection

If a company’s brand is so important, it’s crucial to understand what affects and influences it. There’s no singular answer for what influences a brand. The traditional view of the brand has been that it’s strengthened by what consumers experience through advertising, marketing, product positioning and pricing, and interactions with representatives of the brand. In addition, characteristics, such as a consistent offering of leading products and services and providing a distinctive customer experience, certainly help.
 
More recently, however, many organizations are considering the connection between brand and their underlying business operations and business practices (that is, how they do business, with an emphasis on how the effective performance and delivery of the promise can have an impact on brand health).
 
Aside from brand-enhancing strategies to create value, preventive measures are necessary for protecting the brand. Staying out of the news for the wrong reasons; focusing on product quality through operations excellence; and having the capability to respond, timely and appropriately, when crisis events do materialize are crucially important, as well.
 
Without a doubt, there’s a benefit to the above. But how do you articulate the value of these risk management measures to mitigate brand risk? How do you quantify the cost and benefit and make them measurable enough to invest in capabilities to become resilient? And finally, how do you calculate the return on investment you expect on the cost to build that capability?

Back to top

Decomposing brand

Brand differentiation can happen at any point in the supply chain, from procurement, production, and distribution to marketing, sales, and post-sales support. In both regulated and less-regulated industries, organizations should be sensitive to brand risks, the vulnerabilities that could potentially hurt their brand. How, then, should a company ensure processes, procedures, and controls are built to prevent or reduce operational risk incidents from occurring? And when they do occur, how can a company ensure that the brand will be resilient enough to recover?
 
One approach may be to start with a deeper understanding of what makes your company distinct among its peers. What is it about the products or services offered that illicit a positive response from consumers—the experience or the emotions that are evoked from the use of the product or service that makes a customer choose your product or service over that of your next direct competitor? Whatever that may be, it’s a big part of your competitive advantage.
 
Next, consider everything that should go right across all business operations—through product creation, manufacturing, production, marketing and positioning, point of sales and fulfillment, and post-sales service—that will continue to reinforce and even build your competitive advantage. Or stated differently, what could go wrong and what is it that you should protect against to maintain your real or perceived competitive advantage? This consolidated list is your risk inventory or risk register.
 
After you have articulated your competitive advantage and started to build your risk inventory, consider other mandated requirements (for example, safety standards or regulatory requirements). These help you ensure that your risk register is complete, that it includes all risk management expectations—internal or otherwise—and that it becomes the golden source of your operational risk requirements.
 
Risk identification is a critical step in building your operational risk program. There’s likely a long list of risks that can be identified. Therefore, an important lens to use in building the inventory is understanding the potential impact to your brand should that risk materialize. If the inherent impact of the risk to your brand isn’t significant, you might want to move ahead and only identify those risks—material risks—that have an outsized impact to avoid building a bloated operational risk management program.
 
Once you have understood and assessed your material risks, and in advance of any of these operational risks actually occurring, you should now design your risk response. What protocols—policies, procedures, and standards—will you design and implement to protect your franchise from the consequences of the identified risks materializing? These are your key controls and, together with the identified material risks, they form the bedrock of your operational risk management programs.
 
Additional considerations as part of the build-out of an operational risk management program include:

• Articulating your tolerance for those brand risks that you will accept, mitigate, or transfer
• Developing brand risk monitoring and reporting mechanisms
• Implementing technology solutions to help ensure sustainability and efficiency of brand risk management efforts
  

Back to top

Brand risks

Across industries, there are multiple vulnerabilities that may have a significant impact on a brand. Although these vulnerabilities may appear as normal elements of business operations, they can manifest into risks that hinder brand longevity. A few of these vulnerabilities are discussed below:

• Customer experience can be described as the emotion attached to the assistance and advice provided by a company to those people who buy or use its products or services. This encompassing emotion associated with the brand is amassed through every step of the solicitation, buying, and servicing processes. Whether it be the ease of access to a company’s website or the sensory associated with setting up a product for first-time use, a quality customer experience is arguably just as important as the quality of the product or service itself. Perhaps most crucial in the retail industry, outstanding customer service can create brand loyalty and trust in an ever-changing consumer base. Following the emergence of e-commerce platforms and dissipation of brick-and-mortar locations, many retailers lost touch with their customers. As retailers attempt to take control of their data and go direct-to-consumer in a competitive marketplace, customer experience is of the utmost importance in obtaining and retaining customers.
• Supply chain is the sequence of processes involved in the production and distribution of a commodity. Organizations today face multiple risks as they diversify their supply chain and globally outsource production to third parties that have better economies of scale. Attributable to the complexity and size of supply chains today, managing supply chain risk becomes crucial in an environment where there might be multiple suppliers tied to the design and manufacturing of a product. Besides the actual quality and timing of input delivery, businesses are subject to geopolitical risks, trade disputes, capacity limits, supply shocks, and other industry forces that affect proper delivery of manufacturing input and end products to the consumer.
• Resilience is the ability of an organization to quickly adapt to disruptions while maintaining continuous business operations and safeguarding people, assets, and overall brand quality. Businesses should have continuity planning in place to prevent and recover from potential threats while continuing ongoing operations before and during the execution of disaster recovery.
  
  An all-too-common example of this is cyber risk. There’s a broad consensus that cybersecurity is the risk type increasing the most in importance, with 67 percent of respondents to a recent Deloitte Touche Tohmatsu Limited survey naming cybersecurity as one of the three risks that would increase the most in importance for their business during the next two years, far more than for any other risk.¹

¹ Deloitte’s Global risk management survey, 11th edition is the latest edition in the ongoing survey series that assesses the industry’s risk management practices and the challenges it faces. The survey was conducted from March 2018 to July 2018 and was completed by CROs or their equivalents at 94 financial institutions around the world that operate in a range of financial sectors and with aggregate assets of $29.1 trillion.

Back to top

What’s next?

The majority (79.2 percent) of C-suite and other executives recently polled by Deloitte say significant operational risk events have an impact on shareholder value over the long term.² Specifically, a company’s ability to leverage its brand may be limited following an adverse operational risk event.
 
It may sound trite to say, but you will want to build an operational risk management capability before you need it the most. Certain industries, most notably banking, require rigorous programs as part of capital adequacy directives and safety and soundness standards. Beyond financial services, it’s a sliding scale of regulatory requirements. Though there might not be explicit regulatory requirements to establish operational risk programs in all industries, exposure to various operational risks and the upside to proactively managing them should prompt companies across industries to consider establishing mechanisms and capabilities to manage operational risks in a programmatic and coordinated way to protect their brand and build competitive advantage.
 
A programmatic, enterprise-wide operational risk management framework commonly includes components that can be tailored to specific risk areas. Some areas of an operational risk management capability to be developed include:

• Putting governance in place over the management of risk
• Understanding and assessing the sources of risk
• Articulating your tolerance for those risks that you will accept, mitigate, or transfer
• Putting in place controls
• Introducing risk monitoring and reporting mechanisms
• Implementing technology solutions to ensure sustainability and efficiency of risk management efforts
  

² On March 28, 2019, a Deloitte Dbriefs webcast, titled “Operational risk management: Implementation, data, and analytics,” polled more than 955 C-suite and other executives online about operational risk management. Answer rates differed by question and respondents differed by webcast poll.

Back to top