Deflect Reputational Risk
When a crisis threatens, can campus leaders quickly activate your risk management plan to counter the slings and arrows? Experts advise steady vigilance and repeated hands-on practice.
By Margo Vanover Porter
Reputation is a major driver of value for a university," says Mark S. Beasley, Deloitte Professor of Enterprise Risk Management, North Carolina State University (NC State), Raleigh. "Anything that paints your reputation in a bad light is a ding in that asset. We've seen a host of reasons—athletic scandals, a security event, or a research debacle—that can harm reputations."
Underscoring that reality, the 2012 Annual Crisis Report, released in June by the Institute of Crisis Management, notes education in its list of top 10 crisis categories.
In a Business Officer article in November 2012, authors from United Educators Insurance noted that changes in attitude and environment have placed immense pressure on institutions' ability to respond appropriately to emergency and crisis situations. "With every large-scale event ... the federal government raises the bar for crisis readiness through issuance of regulation, guidance, and funding," the article explained. Add the compressed news cycle to the mix, and you have the ingredients for many a misstep when responding to an emergency or a high-profile situation that puts the university—and its leadership—in a bad light.
The bottom line: Your institution's reputation requires careful and constant protection, say risk management experts.
Kathy E. Hargis, director of Lipscomb University's office of risk management in Nashville, divides a university's risk into four—maybe five—categories. "We have financial, operational, strategic, and compliance risks," she explains. "A lot of people believe that not monitoring or managing any of those four risks could have direct impact on your reputational risk. It can be a cause and effect. By not paying attention to those four, you create the fifth risk. Others believe reputation is its own separate category. I think it's a little bit of both."
In a Perfect World
To respond to the multiple threats that can arise on campuses, institutions need a comprehensive plan of attack, according to Beasley, which is why NC State has adopted an enterprise risk management (ERM) system.
"Not all universities have a formalized process to pinpoint their most significant risks," he says. "Their major mistake is being ill-informed about the big risks on the horizon, which puts campus leaders in the position of reacting to an event rather than proactively managing a risk before it occurs. The lack of risk management oversight leads to a reputation issue, because the university can't manage the process fast enough to contain negative reactions once the crisis starts unfolding." (For suggestions on ways to develop an effective risk management approach, see the companion article, "En Garde With ERM.")
Hargis reports that Lipscomb University also takes an ERM approach. "A risk management program has proven to be an effective way to mitigate not only reputational risk but financial, operational, and compliance risks to a university," she says. "It helps students, administrators, and board members know the most likely events to prepare for.
"By identifying those in advance, institutions can put plans in place to help mitigate the related impacts before they converge into a crisis event that could damage reputation. No matter your institution's size or type, don't ever think, 'This could never happen to us.' We don't have to look too far in the past to find lessons learned the hard way from a this-will-not-happen-here mentality."
In a perfect world, an institution's risk management plans could identify and mitigate upcoming threats before they reach maximum warp, she says. "Obviously, we don't live in a perfect world. Reality is that some things are unavoidable, such as a tornado hitting our campus. We can't control natural disasters, but we can be prepared for them by developing crisis management plans and business continuity plans."
Each institution's plan is unique, Hargis continues, because no two institutions face the same threats. "What works well in one institution may not work exactly the same way or may be ineffective in another," she emphasizes. "It's important on the front end to do a vulnerability assessment to determine the hot topics within your organization."
While Janice Abraham endorses creating a formal written plan, the president and CEO of United Educators in Chevy Chase, Maryland, advocates spending equal or more time on conducting simulations that will identify areas that need more attention or that haven't been addressed. She mentions the 80/20 rule in which most time is spent on developing the plan rather than practicing it; she believes the effort should be the other way around—20/80.
Susan Whealler Johnston, executive vice president and chief operating officer, Association of Governing Boards of Colleges and Universities, Washington, D.C., agrees that practice is critical to an acceptable outcome in times of trouble. "Any time you have a well-developed process that you don't practice, what you've got is good writing," she says. "Without practice, you may not get the result you need when you need it. At least annually, review lines of communications, first things to do, and who talks to whom. Practice sharpens everybody's focus."
All Hands on Deck
David Pajak, director of risk management and chief emergency management officer, Syracuse University, believes that testing crisis response plans has become a common occurrence on campuses these days. He points out that two conditions—the objectives of the exercise and availability of resources—typically determine whether the tests are tabletop or full-scale exercises.
"If an exercise has the potential to be picked up or noticed, the general population should be notified prior to the event that it is a simulation," he warns. "This can be accomplished by press releases as well as signage in the area where you are conducting the practice. Syracuse University has done this for its summer exercises."
In early summer, when NC State practiced a simulated event for a physical threat, Beasley indicates he received advance notice. "You want to make it as real as possible, but you don't want to alarm the public and create a disaster from the simulated disaster," he says.
A group of Nashville universities collaborated in July on a tabletop exercise involving an aggressive shooter, reports Hargis. They started out by setting the scenario and every 30 minutes or so updating the first responders with changes. "With each new piece of information, you have to reassess and modify your responses," she says. "As in real life, you never have all of the information until after the fact. It's easy to be a Monday morning quarterback, but you have to make the best decision with all of the information you have at the time."
Abraham suggests picking a specific event—perhaps a major accident or an athletic scandal—to rehearse your institution's response. "Without a doubt, just like a fire drill, you need to practice who you are going to call; who is going to speak; who is going to develop talking points and key messages; what kind of notices go out to the public, the campus, and the external community; and who talks to the press, both local and national."
If the practice run does involve your athletic program, you will need to rehearse how you would reach out to donors in real life, she adds. "Who would make the calls, and what would they say? Who would craft the message? Thinking through those answers should be part of your crisis response."
"The lack of risk management oversight leads to a reputation issue, because the university can't manage the process fast enough to contain negative reactions once the crisis starts unfolding."
Mark S. Beasley, North Carolina State University
It's also a good idea to watch how other organizations respond to tragedies. Hargis tweaked her institution's risk management plan after both the Sandy Hook elementary school shooting and the Boston Marathon bombing, particularly in the area of social media updates. "We try to monitor events as they are unfolding at other places to determine what works well and what doesn't, and then make comparisons to our plan," she says. "Our plan is a living document. You can't create a plan, put it on the shelf, and pull it out when something happens. Things change. You need to update it and test it to see what works. Every time we have a tabletop, we test our plan and try to find ways to improve it."
After each tweak, she ensures that the appropriate stakeholders understand any plan changes and their related roles. "With any type of crisis management plan, no one person can do it all," she says. "It takes a village, so to speak, to implement."
What Not to Do
Abraham indicates that a leader's actions immediately after a crisis can cause more problems and greater harm to reputation than the original crisis. "We have found in 26 years of serving higher education that the unexpected must be expected," she says. "It's not 'Will your campus have a crisis?' It's when. Even with perpetual reminders in newspapers and the media, campuses don't spend enough time preparing to respond to these crises, which can create more harm than healing after the event occurs."
According to Abraham, many senior leaders don't have enough expertise on hand to adequately address a major campus scandal. "The tragedy at Virginia Tech, the ongoing challenges at Penn State, the issues that occurred at Duke University: These are the big, above-the-fold headlines that nobody on a campus is prepared to address. Even the very best campus communication experts are not prepared for the satellite trucks and onslaught of attention and questions that accompany such catastrophes."
"If you don't tell your story, someone else will paint that picture—and that someone else may not have all the pieces and give misinformation."
Kathy E. Hargis, Lipscomb University
In Abraham's opinion, ill-prepared institutions typically have four responses to a crisis, all of which will cause reputational damage:
1. Providing no response. Leaders ignore the situation and hope it goes away. It seldom, if ever, does. Meanwhile, members of the press-whose curiosity has been piqued—keep digging.
2. Replying "No comment." "This is almost worse than no response," she says, because it implies guilt.
3. Offering disorganized, conflicting statements. "One person says one thing, and someone who is not authorized says something else," she explains. "People talk at cross-purposes, sort of like Keystone Cops."
4. Issuing a verdict before examining the facts. Abraham indicates that she has seen examples of presidents and chancellors who—without conducting an investigation or knowing all the facts—have immediately responded to the press with, "I have complete confidence that we did nothing wrong." Or just the opposite: "These people are guilty. We're getting them off campus. They did something that doesn't uphold our values."
Any one of these approaches can have catastrophic consequences, she says. "If we look at where reputational harm occurs, it's usually one of these four responses that make it worse rather than better. A leader's role after a crisis is to begin to take immediate steps toward healing and getting the campus refocused on its mission. Those four responses delay that process and divert energy."
To prevent mishandling the media, Abraham advocates identifying and developing a relationship with an expert in crisis communication or public relations long before a tragedy occurs.
"These crises tend to occur off-hours when the president isn't there, and somebody else is not able to respond," she says. "Identify an expert ahead of time, so he or she knows the culture and value of the institution and can help the leadership team immediately craft a response. It's not going to control what faculty and students stay, but if the institution and leadership are responding in a thoughtful and honest manner, the press will be less inclined to stand outside the dining hall interviewing people."
"Chief business officers need to recognize that reputation is probably the greatest asset the campus has."
Janice Abraham, United Educators
Hargis likes the idea of bringing in outside PR experts for a major disaster, as long as they are ready to go. "You have to have a great team of people who are on the front line from the very minute the story is unfolding," she says. "I can't stress that enough. If you don't tell your story, someone else will paint that picture-and that someone else may not have all the pieces and give misinformation."
When You Have Nothing to Hide
Risk experts repeatedly emphasize the need for transparency. Without it, they say, reputations will surely suffer.
"At our institution, we want to be transparent in all of our dealings," Hargis says. "The reputation of any institution relies on ethical and moral decisions. Anything other than that undermines reputations."
Beasley recounts a situation in which an institution became ensnared in an athletic scandal, eventually resulting in the resignations of the football coach, the athletic director, a major fundraiser, and ultimately the chancellor. "Where did they make missteps?" he asks. "They were very slow in being transparent to the root causes of major problems. It took newspaper lawsuits to force the university to release information, so the newspaper kept digging around and finding more information—all starting with poor management of a football player and his relationship with a professional sports agent. If the institution's leaders had been more transparent about what they were finding and what they knew, the perception is that the damage to the university's leadership team and reputation may not have been as severe."
He recalls another situation, this one at his own university, a number of years back, over lack of transparency about a hiring decision that eventually culminated in resignations by the chancellor, provost, and chair of the board of trustees. The person being hired: the governor's wife. "In that particular case, the chancellor denied having conversations related to this specific hiring decision," he explains. "When the press found an e-mail to the contrary from the chancellor, his credibility was destroyed and he had to resign."
In Beasley's opinion, this problem originated over a lack of transparency and was magnified when the chancellor responded off-the-cuff—and inaccurately—to media questions. Instead of saying, "Let me get back to you on that," the chancellor chose to say, "I don't recall having a conversation about that hiring decision."
"There is wisdom in preparing," he says, "and part of that preparation is to have prearranged relationships with organizations that can help you manage and communicate in a crisis. Don't try to wing it."
What About the Board?
Where does the board of trustees fit into risk management? Trustees shouldn't be involved in day-to-day operations, Johnston points out. "Their job is to hold the administration accountable for risk management and to receive regular reports on the top issues that have the greatest potential to damage the institution's reputation, such as treatment of the endowment or safety of students. Those issues vary according to the institution."
Of course, the board should be made aware that the institution has an up-to-date crisis plan that is practiced regularly, Abraham notes. "As part of the plan, the president should reach out to the board during a crisis, explaining what is happening and what the institution is doing."
The conversation might go something like this: "You could see us on ESPN or in a story in the Wall Street Journal. This is how we are responding."
Abraham emphasizes that board members should not take questions from the press. "Boards should know who speaks for the institution—usually the president," she says. "Unless it's a specific crisis about the president, the board should support the president in his or her plan. The board's role is to make sure the campus has a plan that is practiced and they should support fulfillment of the plan when the crisis occurs."
At Lipscomb University, Hargis does not leave board communication to chance. "In our plan, we designate one person, in our case the chief of staff, who is the right-hand person of our president, whose primary role in our crisis management plan is to stay abreast of developments and communicate with the chairman and members of the board about the situation as it develops and get information back from them. Our board members live all over the country so it's not always easy to convene a meeting. What you don't want to happen is have a board member be uninformed and caught off-guard by an outside entity or agency."
Other tips shared by risk managers include:
- Predetermine when to mobilize a response team. At Syracuse University, Pajak coordinates with predetermined departments when a crisis, such as a blizzard, affects the entire campus or a situation overwhelms the ability of one department to continue to fulfill its mission. For example, if the student health center were overrun by a pandemic and the public relations office swamped by calls, the university's response team would mobilize to assist the affected department.
- Get acquainted with your local emergency responders. "You need to know who your partners are," Hargis says. "Build relationships with emergency responders before a crisis occurs. Trying to build relationships in the midst of a crisis will hurt you."
- Take crisis management seriously and devote resources to training. "Chief business officers need to recognize that reputation is probably the greatest asset the campus has," Abraham says.
In the end, says Abraham, "We go to extraordinary efforts to protect our fiscal and physical and human assets. Do we put the same energy into our reputation?"
MARGO VANOVER PORTER, Locust Grove, Virginia, covers higher education business issues for Business Officer.