Across several posts now, we’ve been exploring the advantages of internal whistleblowing programs. Today I want to explore the related point that a strong incident management program is crucial to managing a very external thing: your organization’s brand reputation.
Incident management and brand management might seem like separate things within a business, but they're not. External perceptions of your organization are very much tied up in how the organization manages its internal challenges. It’s no exaggeration to say that a strong incident management program is the foundation that strong brand management rests upon.
So let’s walk through the logical path from whistleblower program, to incident management, to brand management; and understand how your policies and procedures for all three should be aligned for maximum success.
What Is Incident Management?
Incident management is what happens after the organization receives a whistleblower report. Every report must be triaged, handed off to appropriate personnel for an investigation, and resolved. Sometimes the report might be baseless, where the investigator should document that conclusion and close the case. Many times, however, the internal report will have merit — which means the company will need to follow up with appropriate disciplinary action and document that, too.
The bigger challenge for large organizations is how to manage all of those steps at scale: when you are handling hundreds or even thousands of incidents at the same time, each one involving different facts and proceeding at its own pace. Corporations need to assure that every incident receives an appropriate amount of attention and follows the standard investigation and disciplinary procedures. Otherwise, the business leaves itself open to accusations of favoritism and covering up misconduct, and won’t meet the standards regulators have spelled out for an effective corporate compliance program.
What Is Brand Reputation Management?
Brand reputation management is how the business preserves its good reputation with external stakeholders: customers, business partners, consumers, and investors.
Brand management can involve many issues that have little to do with the law and regulatory compliance. For example, a company could decide to eliminate generous return and exchange policies or make financial contributions to controversial political figures. Neither of those actions is illegal, but they can tarnish the company’s reputation with consumers, customers, vendors, and others.
On the other hand, brand management also can have plenty to do with the law and compliance. For example, if senior managers are discovered to encourage or participate in a culture of sexual harassment, that might alienate customers and consumers, and leave the company open to civil litigation from employees to boot.
A paramount goal for brand management, then, is to demonstrate that the company’s ethical values and behaviors align with those of key stakeholders. When those external stakeholders perceive that the organization is “on the same side” that they are, those stakeholders will continue to give the business their support.
Where Incident and Brand Management Intersect
Incident management and brand management intersect in the sense that both have the objective of preserving corporate value for stakeholders. The stakeholder groups are somewhat different, but they do overlap. For example, a strong incident management function demonstrates that the company is serious about addressing misconduct within its ranks; that pleases employees, regulators, investors, customers, and consumers.
Teams in charge of brand management can then point to that strong incident management capability and say, essentially, “See! We are a highly ethical business that takes misconduct seriously. So you should buy our product, invest in our shares, or work with us in a joint venture.”
The deeper point here, then, is that since a strong internal whistleblower program is crucial to incident management, a strong internal whistleblower program is also crucial to effective brand management.
The Difference Between Internal and External Whistleblowing
We could frame all of this another way, too. The advantages of internal whistleblowing programs are that employees are bringing concerns to management so that those problems can be solved. It means that employees feel invested in the company doing well and that they trust the company wants to be an ethical organization. That’s an excellent corporate culture to have, and one that leads to better business performance across a host of metrics.
A business without a strong internal whistleblower culture, on the other hand, leaves itself open to external whistleblowing. Regulators, plaintiff lawyers, and the media might like hearing those complaints, but that won’t do the company itself much good.
External whistleblowing means the people with misconduct concerns (usually employees or business partners) believe management doesn’t want to address its problems. External whistleblowing distracts management from other business objectives, can create dissension within the enterprise, scare away customers and business partners, and harm share price. Internal whistleblowing, no matter how many concerns it might reveal, is always preferable to external whistleblowing.
Protect Your Brand With Incident Management Technology
Go back to our earlier point about incident management: that the big challenge for large organizations is managing the task at scale when you might have thousands of incidents demanding attention. A compliance function cannot do that work well without technology to guide and automate the process. Using spreadsheets is a recipe for disaster.
Why? Because using spreadsheets to manage so much work inevitably means that at least some incidents will be overlooked or mishandled. That leads the company down the path toward external whistleblowing, and all the perils we mentioned above. Regulators will think less of your compliance program, and employees will think less of the corporate culture. A poor incident management program ultimately means that your corporate brand will suffer.
Hence the use of incident management technology is important — not just to your overall compliance program (although that’s certainly true), but to your brand management efforts overall. An effective compliance program, built on a solid foundation of incident management, can be a strategic advantage that helps to position your business ahead of its competitors.
Or, more simply — people like to deal with companies they believe are ethical. And handling issues in a fair, prompt, competent manner is a way to demonstrate that your company is.
Matt Kelly is an independent compliance consultant and the founder of Radical Compliance, which offers consulting and commentary on corporate compliance, audit, governance, and risk management. Radical Compliance also hosts Matt’s personal blog, where he discusses compliance and governance issues, and the Compliance Jobs Report, covering industry moves and news. Kelly was formerly the editor of Compliance Week. from 2006 to 2015. He was recognized as a "Rising Star of Corporate Governance" by the Millstein Center in 2008 and was listed among Ethisphere’s "Most Influential in Business Ethics" in 2011 (no. 91) and 2013 (no. 77). He resides in Boston, Mass.