Reputation risk is the risk that a loss of trust among customers, counterparties, investors, employees, regulators or the public damages the organisation’s ability to keep its business, win new business and fund itself. It is a consequence more often than a cause (the trust is lost because something else failed: conduct, a product, a breach, a strategy) and it is the category that turns a contained failure into an existential one, because trust leaves faster than it arrived and, since 2023, at the speed of a group chat. It is also the category whose supervisory standing changed most in 2025 and 2026, when the US banking agencies removed it from their examinations and then prohibited themselves by rule from using it. This is the Risk Library reference on the subject: what reputation risk is and how it differs from its neighbours; where it comes from, with the cases; why speed is now the defining feature; how it is assessed and measured; the management framework; what the US supervisory change does and does not mean; how internal audit tests reputation risk management; and a worked engagement at an illustrative nine-billion-dollar bank whose board asked whether to keep the category at all.
It replaces the short introduction that previously stood at this address and sits beside the strategic risk and conduct risk references, the two categories that generate most reputation events.
In this guide
- What reputation risk is
- Reputation risk and its neighbours: a risk of risks
- Where reputation events come from, with the cases
- Speed: the 2023 lesson
- Assessing and measuring reputation risk
- The management framework
- The 2025–2026 US supervisory change, and what it does not change
- How internal audit tests reputation risk management
- Worked example: Lakeshore Bancorp keeps the category
- Frequently asked questions
- Related guides
What reputation risk is
The Basel Committee’s 2009 enhancements to the Basel II framework gave the definition most banks use: the risk arising from negative perception on the part of customers, counterparties, shareholders, investors, debt-holders, market analysts, other relevant parties or regulators that can adversely affect a bank’s ability to maintain existing, or establish new, business relationships and continued access to sources of funding. The Office of the Comptroller of the Currency’s version, until its 2026 rule, was the risk to current or projected financial condition and resilience arising from negative public opinion. Outside banking the same idea is called brand risk, franchise risk or trust risk, and the mechanism is identical: a stakeholder group changes its behaviour because of what it believes about the organisation, and the behaviour has a cost.
Three features of the definition shape how it is managed. The risk is in the stakeholder’s head, not in the organisation’s systems, so it cannot be controlled directly; it can only be managed through the events that create it and the response when they occur. The consequence is behavioural (customers leave, depositors withdraw, counterparties cut lines, employees resign, regulators tighten), so the financial impact is measured through those behaviours. And perception can diverge from fact in both directions: an organisation can suffer for a failure it did not commit, and avoid consequences for one it did, which is why monitoring stakeholder perception is a control in its own right. The risk taxonomy guide places the category and the OCC risk categories guide describes its former place among the eight supervisory categories.
Reputation risk and its neighbours: a risk of risks
Almost every reputation event begins as an event in another category, which is why reputation risk is described as a risk of risks and why taxonomies disagree about whether it is a category or a consequence. The practical answer is both: it is tracked as a consequence of every other category in the impact scale, and it is managed as a category for the events that have no other home (an executive’s conduct, a marketing decision, an association) and for the response capability that every event needs.
| Originating category | How it becomes a reputation event | Example | What the reputation lens adds |
|---|---|---|---|
| Conduct risk | Customer harm becomes public through complaints, media or enforcement | Sales practices that opened accounts customers did not ask for | Severity is set by public reaction, not by the fine; the remediation has to be visible |
| Compliance risk | An enforcement action is published | Consent orders for anti-money-laundering failures | Counterparties and correspondent banks read enforcement actions |
| Operational and technology risk | An outage or a data breach affects customers directly | A payments outage on payday; a breach of customer records | Speed and quality of the customer response decide the reputational cost |
| Product and safety risk | A product harms users or fails publicly | Vehicle recalls; emissions test manipulation; aircraft groundings | Trust in the whole brand, not the one product |
| Strategic risk | A strategy produces losses or a rescue | A bank whose business model fails in public view | Reputation loss accelerates the failure through funding |
| Financial risk | Losses or capital concerns become known | Unrealised securities losses disclosed | Depositors and counterparties react to the disclosure, not the loss |
| Third-party risk | A supplier’s failure or conduct is attributed to the organisation | Labour practices in a supplier; a vendor breach | The organisation answers for the chain; the third-party guide covers the program |
| Associations and positioning | Clients, partners, political or social positions attract hostility from a stakeholder group | Marketing campaigns that alienated customers; client relationships that drew regulatory and public attention | The only events that have no other category; managed through decision governance |
| People and culture | Executive behaviour, workplace culture, discrimination claims | Leadership departures after misconduct | Board-level response; employee trust |
Two neighbours need separating. ESG and sustainability claims create reputation risk through greenwashing, now a legal risk in several jurisdictions; the ESG auditing guide covers the claims review. And crisis management is the response capability, not the risk; it is a control within the framework below.
Where reputation events come from, with the cases
The historical record is the best teacher, because the same patterns recur. The table lists cases by pattern, with the lesson each is usually cited for; the cases are drawn from public reporting and regulatory findings.
| Pattern | Case | What happened | Lesson |
|---|---|---|---|
| Incentives that produce misconduct | Wells Fargo sales practices, 2016 onward | Employees under sales-volume targets opened millions of accounts without customer consent; enforcement actions, leadership changes and a Federal Reserve asset cap imposed in 2018 and lifted in 2025 | The reputational cost outlasted the fine by years; the incentive design was the cause |
| Product failure and concealment | Volkswagen emissions, 2015 | Software that detected emissions testing and altered engine performance; criminal and civil penalties in several jurisdictions; the brand’s positioning on clean diesel destroyed | Concealment multiplies the damage; the cover-up becomes the story |
| Safety failure and governance | Boeing 737 MAX, 2018–2019 and after | Two crashes, a global grounding, findings on certification and safety culture, continuing incidents and leadership changes | A safety reputation built over decades is lost in months; the recovery is measured in years |
| Data breach and response | Equifax, 2017 | Personal data of about 147 million people exposed through an unpatched vulnerability; a slow and confused public response; a settlement and leadership departures | The response was judged as harshly as the breach |
| Association and confidence | Arthur Andersen, 2002 | The firm’s role in Enron, an obstruction conviction later overturned, and the loss of clients within months; the firm ceased to audit public companies | For a trust business, reputation is the balance sheet |
| Confidence and funding | Credit Suisse, 2021–2023 | Archegos and Greensill losses, successive strategy changes, client outflows, and a rescue merger in March 2023 | Reputation loss became a funding event |
| Social-media-speed run | Silicon Valley Bank, March 2023 | Disclosure of securities losses and a capital raise, followed by withdrawals of about 42 billion dollars in one day coordinated through investor and founder networks | The run took hours; the speed section covers the consequence |
| Marketing and positioning | Consumer brands, 2023 | Campaigns that alienated part of the customer base and drew boycotts from both sides of a cultural dispute; sustained sales losses | Positioning decisions need the same governance as product decisions |
| Response done well | Johnson & Johnson Tylenol, 1982 | A product tampering that killed seven people; a nationwide recall, public communication and tamper-evident packaging | The reference case for response: act before you are made to, and visibly |
| Environmental disaster | BP Deepwater Horizon, 2010 | An explosion, eleven deaths and the largest marine oil spill in US history; tens of billions in costs and a decade of litigation | Safety culture findings turned an accident into a reputation and strategy event |
Speed: the 2023 lesson
Until 2023 reputation risk was managed on the assumption that a story takes days to spread and that a response window exists. The failures of March 2023 removed the assumption for any organisation whose customers can act online. Silicon Valley Bank announced securities losses and a capital raise on the evening of 8 March; by the close of 9 March depositors had withdrawn about 42 billion dollars, with a further 100 billion expected the next day, and the bank was closed on 10 March. The withdrawals were coordinated through the private messaging networks of a concentrated customer base, and the mobile banking app was the exit. First Republic and Signature followed within weeks. The Federal Reserve’s review and the Basel Committee’s 2023 report on the turmoil both describe the role of social media and digital banking in the speed of the runs, and bank supervisors have since asked institutions to model deposit outflows at rates far above the historical assumptions, as the liquidity stress testing guide describes.
For reputation risk management the implications are three. Monitoring must be continuous and must watch the channels where the organisation’s own customers talk, not only the press. The response capability must be able to act within hours, with pre-approved statements, decision rights and a channel to customers that works at scale. And the link between reputation and liquidity has to be explicit in the contingency funding plan: a reputation event is a liquidity scenario, and the liquidity risk guide treats it as one.
Assessing and measuring reputation risk
Reputation cannot be measured directly, so the assessment works through scenarios and the measurement through proxies for stakeholder behaviour and perception. The scenario method is the same as for any risk: event, stakeholder reaction, behavioural consequence, financial impact, with the reaction stage the one specific to this category.
| Step | What it involves | Output | Weakness to watch |
|---|---|---|---|
| Stakeholder map | Identify the groups whose trust the organisation depends on, what each expects, and how each would learn of a failure and react | Stakeholder register with channels and sensitivities | Maps that list groups without describing their behaviour |
| Event inventory | Draw the events from every other risk category’s assessment plus the association and positioning events | Reputation scenario list linked to the risk register | Inventory limited to conduct and breaches |
| Reaction assessment | For each scenario, assess how each stakeholder group would react, how fast, and through which channel | Reaction profile per scenario | Assumed to be slow and press-driven |
| Consequence quantification | Translate reactions into behaviour: deposit or customer attrition, lost revenue, funding cost, counterparty limits, hiring cost, regulatory consequence | Financial impact ranges by scenario | Impacts expressed as “high” with no numbers |
| Control and response assessment | Assess the controls that prevent the event and the response capability that limits the reaction | Residual rating | Response capability untested |
| Appetite comparison | Compare residual scenarios to the board’s appetite, expressed through the proxies below | Scenarios outside appetite with actions | Appetite stated qualitatively |
Measurement uses proxies, reported as key risk indicators with thresholds. The indicators that work are the ones that measure what stakeholders are doing or saying rather than what the organisation is doing.
| Indicator | What it measures | Typical threshold logic | Source |
|---|---|---|---|
| Negative media and social mention volume against baseline, weekly | Public attention | Amber at 50 per cent above baseline; red at double or any viral event | Media monitoring |
| Sentiment score in the organisation’s own customer channels | What customers say to each other | Trend-based; any sharp fall investigated | Social listening on customer forums and groups |
| Complaints per thousand accounts, with escalations to regulators | Customer-reported failures | Product baselines; spikes investigated | Complaint system |
| Net promoter or satisfaction score | Customer trust | Two consecutive falls reportable | Survey platform |
| Deposit or customer attrition in the week after an event | Behavioural response | Compared to normal weekly attrition | Core systems |
| Employee review sentiment and voluntary turnover | Employee trust | Trend-based | Review sites, HR system |
| Analyst and rating agency commentary; counterparty line changes | Market and counterparty trust | Any negative change reportable | Investor relations, treasury |
| Response readiness: last crisis exercise, pre-approved statements current, decision rights documented | Capability | Exercise within 12 months; statements reviewed quarterly | Crisis management program |
The management framework
A reputation risk framework has five parts, and most organisations have the fourth and fifth without the first three.
| Element | What it contains | Who owns it | How it fails |
|---|---|---|---|
| Governance and appetite | Board ownership; an appetite statement in proxy terms; reputation as an impact dimension in every risk assessment; a committee that reviews positioning and association decisions | Board; chief risk officer | Reputation discussed only after an event |
| Prevention through the originating categories | Conduct, compliance, product governance, security, third-party and ESG controls operating; incentive design reviewed for reputational consequence | First-line owners; second-line functions | Reputation treated as the communications department’s problem |
| Decision governance for positioning and associations | A review step for marketing campaigns, public positions, high-profile clients and partnerships that asks who could react and how | Marketing, business heads, with risk and legal review | Decisions made by one function with no challenge |
| Monitoring | The indicators above, continuous, with escalation thresholds and a named owner who watches the customer channels | Communications and risk jointly | Monitoring the press and not the customers |
| Response | A crisis plan with decision rights, pre-approved statements, spokespeople, customer communication at scale, regulator and investor notification, and rehearsal at least annually; a link to the contingency funding plan | Chief executive; communications; treasury for the funding link | A plan that has never been exercised; statements that need three approvals at 2 a.m. |
Prevention is where the money is. Every case in the sources table was preventable at the originating category, and a reputation risk program that spends on monitoring and crisis communications while the incentive scheme, the product approval process or the vendor oversight stay weak is managing the consequence while leaving the cause. The ethics and compliance program audit and the auditing ERM guide cover the programs prevention depends on.
The 2025–2026 US supervisory change, and what it does not change
In 2025 and 2026 the US federal banking agencies removed reputation risk from their supervisory programs. The sequence: in March 2025 the OCC and the FDIC announced they would no longer examine for reputation risk and would remove it from their handbooks; the Federal Reserve announced the same in June 2025; an executive order of August 2025, Guaranteeing Fair Banking for All Americans, directed the agencies to remove reputation risk from guidance and supervisory policy; the Federal Reserve proposed a codifying rule on 23 February 2026; the OCC and FDIC issued a joint final rule on 7 April 2026, published on 10 April; and on 2 June 2026 the three agencies announced the removal of reputational-risk references from a range of interagency guidance documents. The rule prohibits the agencies from criticising or taking adverse action against a bank (examination criticism, matters requiring attention, rating downgrades, enforcement, capital add-ons) on the basis of reputation risk, defined as any risk, however labelled, that could harm public perception for reasons not clearly and directly related to the institution’s financial or operational condition. It also bars the agencies from requiring or encouraging banks to close accounts or refuse service because of customers’ political, social, cultural or religious views, protected speech, or lawful but disfavoured activities.
| Question | Answer | Implication for a bank’s risk program |
|---|---|---|
| Does the rule stop a bank from managing reputation risk? | No. It governs the agencies’ conduct and imposes no obligation on banks; banks may weigh reputational or franchise risk in their own decisions provided the decisions do not result from improper supervisory pressure | The category can stay in the taxonomy; the board decides, not the examiner |
| Will examiners still see the consequences of a reputation event? | Yes, through the categories that remain: credit, liquidity, operational, compliance and strategic risk, and the financial and operational condition they affect | A deposit run caused by a reputation event is examined as a liquidity event; the contingency funding plan still has to cover it |
| What changes in account and customer decisions? | Decisions to close accounts or decline customers cannot be attributed to supervisory expectations about reputation; the agencies may not require or encourage them on that basis | Legacy policies that cite reputation risk as a reason for declining or exiting customers need review and a documented basis in financial, legal or operational risk |
| Does it apply outside the United States? | No. The Basel Committee’s framework, the EBA’s supervisory review and the UK PRA continue to assess reputational risk, mainly under the operational and business model headings | International groups keep the category for their non-US entities and their group frameworks |
| Does it change the audit? | Internal audit’s coverage is set by the board and the organisation’s own framework; where the board keeps the category, the audit program below applies. Audit of account-exit decisions should now test that the documented basis is one the rule permits | Add a test of exit-decision rationale to the compliance and conduct programs |
How internal audit tests reputation risk management
A reputation risk audit tests the framework above, and its most informative procedures are the ones that test capability rather than documents: the exercise, the retrieval of monitoring data during a past event, the review of a positioning decision. The audit work program guide covers documentation.
| Area | Key tests | Evidence | Typical finding |
|---|---|---|---|
| Governance and appetite | Board ownership; appetite in proxy terms; reputation as an impact dimension in the risk assessment scale; committee review of positioning and association decisions | Charters, appetite statement, assessment scale, minutes | Appetite qualitative; reputation absent from the impact scale |
| Linkage to originating categories | Trace the reputation scenario list to the conduct, compliance, product, security, third-party and ESG assessments; check that incentive design is reviewed for reputational consequence | Scenario list, assessments, incentive reviews | Scenarios limited to breaches and misconduct; incentive design never reviewed for consequence |
| Decision governance | Select recent campaigns, public positions and high-profile client or partner decisions; test for a documented review of stakeholder reaction | Decision records | Marketing decisions made without any reaction assessment |
| Monitoring | Which channels are monitored, how often, by whom; thresholds and escalation; reperform the indicators for a past event | Monitoring configuration, reports, escalation records | Press monitored, customer channels not; no escalation threshold |
| Response capability | The crisis plan’s decision rights, pre-approved statements, spokespeople, customer communication capacity, regulator notification; the last exercise and what it found; whether the plan links to the contingency funding plan | Plan, exercise reports, statements, CFP | No exercise in two years; statements out of date; CFP does not include a reputation scenario |
| Past events | Select the last two or three reputation events; reconstruct detection time, decision time, response time and outcome against the plan | Event timelines | Detection through a journalist’s call; response slower than the plan |
| Account and customer exit decisions (US banks) | For a sample of exits and declines, test the documented basis against the organisation’s policy and the 2026 rule’s permitted grounds | Decision records | Legacy rationale citing reputation risk without a financial, legal or operational basis |
| Reporting | What the board sees: indicators, events, response performance, trend | Board packs | Narrative only; no indicators |
Worked example: Lakeshore Bancorp keeps the category
Lakeshore Bancorp is the illustrative nine-billion-dollar public regional bank used across this site, with a twenty-two person internal audit function. After the OCC and FDIC rule took effect in 2026, the board risk committee asked management whether reputation risk should remain in the bank’s taxonomy, and asked internal audit to audit the reputation risk framework as an input to the decision. The 240-hour engagement ran the program above.
| Area | What the audit found | Rating |
|---|---|---|
| Governance and appetite | Reputation risk was in the taxonomy and in the impact scale of the enterprise risk assessment; the appetite statement said “no appetite for reputational damage”; no proxy measures were defined | Medium |
| Linkage | The reputation scenario list had six scenarios, all breaches or misconduct; the mortgage sales incentive plan, revised in FY26, had been reviewed by compliance for fair lending and by no one for reputational consequence; the vendor program did not score suppliers for reputational exposure | Medium |
| Decision governance | Eleven marketing campaigns and two community partnership decisions in the year; none had a documented stakeholder reaction review; one campaign had drawn a local boycott that cost the branch an estimated 4 per cent of deposits over two months | High |
| Monitoring | Media monitoring daily by communications; the bank’s own customer channels (a regional business forum and two community groups where depositors discussed the boycott) were not monitored; no escalation threshold | High |
| Response | A crisis plan from FY23, last exercised in FY24; pre-approved statements referred to a former chief executive; the plan had no link to the contingency funding plan, which contained no reputation-driven outflow scenario | High |
| Past events | The boycott was detected through a branch manager’s email four days after it began; the response statement took six days to approve | High |
| Exit decisions | Of 40 account exits sampled, 7 cited “reputational risk” as the sole basis in the decision record; the underlying reasons were financial crime or legal in 6 and undocumented in 1 | Medium |
| Reporting | The board saw an annual narrative on reputation; no indicators | Medium |
The engagement was rated Needs Improvement with four High findings. Internal audit’s report to the committee made no recommendation on whether to keep the category, which was the board’s decision, but set out what each option required: keeping it meant funding the framework above; dropping it meant assigning the response capability, the monitoring and the decision governance to other owners, since the events would occur either way. The board kept the category with a revised appetite expressed through proxies (complaint rates, deposit attrition after events, sentiment in customer channels, response readiness); management added customer-channel monitoring with thresholds, a reaction review step for campaigns and partnerships, a reputation-driven outflow scenario to the contingency funding plan, an annual exercise with current statements, and a rewrite of the exit-decision policy so that every exit records a financial, legal or operational basis. Internal audit validated the actions under the issue validation standard and added the proxies to its continuous monitoring; the regulators guide describes how the revised exit policy was presented at the next examination.
Frequently asked questions
What is reputation risk?
The risk that negative perception among customers, counterparties, investors, employees, regulators or the public damages the organisation’s ability to keep existing business, win new business and fund itself. The Basel Committee’s 2009 definition is the standard one for banks; brand, franchise and trust risk are the same idea elsewhere. The risk lives in stakeholders’ beliefs and is realised through their behaviour, which is why it is managed through the events that create it and the response when they occur.
Is reputation risk a separate risk category or a consequence of other risks?
Both. Most reputation events originate in another category (conduct, compliance, operational, product, strategic, third-party), so reputation is an impact dimension in every risk assessment. It is also managed as a category for the events with no other home, such as positioning and association decisions, and for the response capability that every event needs. Taxonomies that choose one answer tend to lose either the prevention or the response.
How is reputation risk measured?
Through proxies for stakeholder perception and behaviour, reported as key risk indicators with thresholds: negative media and social mention volume against baseline, sentiment in the organisation’s own customer channels, complaints per thousand accounts and regulator escalations, satisfaction scores, deposit or customer attrition after events, employee sentiment and turnover, analyst and counterparty changes, and response readiness. Scenario assessment quantifies the financial consequence of each event through the behaviour it would cause.
What did the US banking agencies change in 2025 and 2026?
They removed reputation risk from their supervisory programs. The OCC and FDIC announced it in March 2025, the Federal Reserve in June 2025; an August 2025 executive order directed the removal; the OCC and FDIC issued a final rule on 7 April 2026 prohibiting the agencies from criticising or taking adverse action against a bank on the basis of reputation risk and from requiring or encouraging account closures based on customers’ views or lawful activities; the Federal Reserve proposed its own rule in February 2026; and interagency guidance was revised in June 2026. The rule governs the agencies, not banks, which may still manage reputation risk in their own decisions.
Should a bank keep reputation risk in its taxonomy after the rule?
That is the board’s decision, and both answers have to pay for the same things. The events will occur regardless, and examiners will see their consequences through liquidity, operational, compliance and strategic risk. Keeping the category means defining appetite in proxy terms, monitoring customer channels, governing positioning decisions and exercising the response. Dropping it means assigning each of those to another owner. What the rule does require is that account-exit and customer-decline decisions carry a documented financial, legal or operational basis rather than a reputational one.
Why did 2023 change reputation risk management?
Because the bank runs of March 2023 showed that a loss of confidence can move tens of billions of dollars in a day through private messaging networks and mobile banking, before a response window opens. Silicon Valley Bank saw withdrawals of about 42 billion dollars on 9 March 2023. Monitoring has to watch the channels where the organisation’s own customers talk, the response has to act within hours, and a reputation event has to be a scenario in the contingency funding plan.
What does internal audit test in a reputation risk audit?
Governance and appetite in proxy terms; the linkage from every originating category’s assessment to the reputation scenario list, including incentive design; decision governance for campaigns, positions and partnerships; monitoring channels, thresholds and escalation; the response plan, its last exercise and its link to the contingency funding plan; the reconstruction of past events against the plan; the documented basis of account-exit decisions; and what the board sees. The capability tests (the exercise, the event reconstruction) tell more than the documents.
What is the best-known example of a reputation crisis handled well?
Johnson and Johnson’s response to the 1982 Tylenol poisonings: a nationwide recall before it was required, open communication, and tamper-evident packaging that became the industry standard. It is cited because the company acted on the stakeholder’s interest ahead of the legal minimum and did so visibly, which is the pattern every response plan tries to institutionalise.
Related guides
- Strategic Risk — the category whose failures most often become reputation events
- Conduct Risk — customer harm and the incentives behind it
- Compliance Risk — enforcement actions as reputation events
- Risk Taxonomy — where reputation sits and whether it is a category or a consequence
- Key Risk Indicator Examples — the reputation indicators with thresholds
- Liquidity Risk — the funding consequence of lost confidence
- Liquidity Stress Testing — modelling the 2023-speed outflow
- Third-Party Risk Management — answering for the supply chain
- ESG Auditing — greenwashing and the claims review
- How to Audit the Ethics and Compliance Program — prevention at the source
- What Regulators Expect From Internal Audit — how examiners read the function’s coverage
- Reputation Risk category — every guide on the subject in one archive
Leave a Reply