Guidelines on Reputational Risk Management

1114

Annex A Appendix 146/Q-89 REPUTATIONAL RISK MANAGEMENT TOOLS FOR IDENTIFICATION AND ASSESSMENT (Appendix to Secs. 155/151-Q on Reputational Risk Management) The Bangko Sentral Supervised Financial Institutions (BSFIs) may employ any or a combination of the following tools in identifying and assessing reputational risk: 1. Internal expert judgments – Self-assessments or in-depth interviews with the institution’s area experts (e.g. C-suite or senior executives) provide an inside-out view of the major enterprise strategies and risks, vulnerability points, as well as threats and opportunities including competitive positioning and industry pressures. 2. Stakeholder analysis – Stakeholders’ perceptions and expectations are considered leading drivers of reputation. Stakeholder analysis involves the identification of key stakeholders in terms of their influence and impact on the institution’s business and reputation. These critical stakeholders provide an outside-in perspective of their demands and expectations, and allow the institution to gauge the likely impact of the stakeholders’ adverse reaction should these concerns not be met. The report may also flag interconnected threats across the various stakeholder groups, which individually may seem insignificant, but when viewed together require action. As stakeholders’ concerns and expectations are evolving, regular monitoring should be conducted to account for emerging issues or threats. 3. Reputational risk and control assessment – This tool can be used to identify, categorize and rank the potential threats based on the likelihood that the reputational risk will materialize and the estimated impact. Such an assessment tool looks into the root causes of the risk, the controls in place to mitigate such risks, the effectiveness of such controls, and any resulting residual risk exposure. The past experience of similar institutions and the changes within the institution (e.g. personnel, system, or structural changes) as well as in the external environment should be taken into account in assessing the likelihood and impact of identified reputational threats. The determination of whether the controls are effective shall consider the internal and external audit reports, compliance reports, and management exception reports, among others. The outcome of the reputational risk and control assessment may be documented using the following: a. Risk register – A risk register provides a comprehensive view of the status and materiality of the identified risks which may impact the organization’s reputation as well as the response actions taken. This aids in risk prioritization and allows for an in-depth understanding of the drivers, impacts, and vulnerabilities. At the minimum, details for each identified risk include the following:

Annex A Appendix 146/Q-89 i. risk category to group similar risks; ii. risk description; iii. root causes of the risk or the core issue(s) involved; iv. existing controls to manage the risk and their effectiveness; v. risk assessment on the likelihood and impact on the institution’s reputation; vi. designated risk owner; and vii. response plan and agreed actions. b. Risk heat map – A risk heat map or matrix is used to visualize and communicate the outcome of a risk assessment process. In particular, this tool aids in contrasting and prioritizing risks by categorizing the likelihood and impact of identified risks. 4. Stress-testing – The impact of stress scenarios to all material risk factors, including reputational risk, should be taken into account. Reputational risk scenarios should be included in the stress testing procedures to obtain a firm understanding of the effect of reputational risk in terms of other risk types (e.g. credit, liquidity, market or operational risk), and the possible second round effects. BSFIs should measure the reputational risk impact, including the amount of implicit support of securitizations or losses that might be sustained under adverse market conditions. In assessing the potential amount of the impact, both the on- and off-balance sheet exposures shall be considered. In this regard, banks, including material NBFIs are expected to adhere to the standards set forth under Sec. 151 on the Guidelines on the Conduct of Stress Testing Exercises. Similarly, NBFIs may refer to such guidelines in their conduct of stress testing taking into account the nature, size and complexity of their operations. The results of the stress testing shall feed into the internal capital adequacy assessment/capital planning process of BSFIs. 5. Risk sensing – This can be embedded into an organization’s risk governance program to allow continuous identification of emerging threats as well as to complement crisis management response. Such a program may require human- and technology-enabled functions to facilitate data analysis and interpretation as inputs to business decisions. Listening posts is a form of risk sensing program which uses advanced technology to gather the opinion of stakeholders as well as detect and track trends by selectively scanning the internet and social media for risk indicators, emerging risks and potential risk events. These include blogs, interviews, industry fora, academic papers, media commentaries and other social media and news sources. Listening posts can also be used to monitor changes in the customers and employees’ sentiments and regulatory expectations. In this respect, BSFIs are expected to comply with the standards under Secs. 150/149-Q1 on Social Media Risk Management. 1 For other NBFIs, please refer to Secs. 144-P/147-S/127-T/128-N, as applicable.