What Is Reputational Risk in Business? Definition, Sources and the 2026 Board Playbook

Cracker Barrel unveiled a simplified logo on 19 August 2025, dropping the Uncle Herschel figure that had sat on its sign since 1977. Within days the stock had fallen close to 15 percent and more than $100 million in market value had gone, and the company reversed the decision entirely.

No product failed, no data leaked and no law was broken. Chief executive Julie Felss Masino was midway through a $700 million brand transformation when the reaction arrived, and restaurant traffic still fell around 8 percent in the weeks that followed.

Reputational Risk: Key Takeaways
Reputational risk is the loss of enterprise value that follows when customers, employees, investors or regulators revise their view of the organization. It is a consequence of other failures, which is why it cannot be owned by communications alone.
Cracker Barrel lost roughly 15 percent of its share price and more than $100 million in market value in the days after its 19 August 2025 logo change, and reversed the decision within a week.
US banking regulators removed reputation risk from supervision. The OCC stopped examining for it in March 2025, the Federal Reserve followed in June 2025, and the OCC and FDIC final rule took effect on 9 June 2026.
The agencies concluded that reputation risk had not proven useful in predicting bank failures and had injected a high degree of subjectivity into examinations. The exposure did not go away, the external enforcer did.
The 2026 Edelman Trust Barometer found seven in ten people hesitant to trust those with different values, so the audience that judges a reputational risk event now starts from a more skeptical position.
Measure reputational risk with leading indicators such as complaint velocity, employee sentiment, supplier incident rates and time to first statement, rather than with media sentiment after the fact.

Reputational risk is the exposure that episode illustrates. It is the loss of enterprise value that follows when customers, employees, investors or regulators revise their view of an organization, and it converts into revenue, hiring and cost of capital faster than most registers can track.

What Reputational Risk in Business Actually Means

Most definitions of reputational risk describe a feeling rather than a measurable exposure. A workable one names the mechanism instead: stakeholders revise their assessment of the organization, then change how they behave toward it, and that behavioral change eventually shows up in the accounts.

Reputational Risk Is a Consequence, Not a Cause

This distinction decides where the risk sits on your register. Nothing generates reputational risk on its own, because it is always downstream of a conduct failure, a safety event, a breach, a supplier scandal or a decision that stakeholders reject.

Treating it as a standalone risk pushes the whole exposure toward communications, which is the single most common structural error we see. The communications team owns the response, but it cannot own the conduct, the product or the supplier that caused the event.

How Reputational Risk Differs From Brand and Operational Risk

Three neighboring terms get used interchangeably in board papers, and that imprecision costs real time during an incident. Separating them by what is damaged and who has to repair it makes the ownership argument much shorter when something actually happens.

Term	What is damaged	Who repairs it	Time to recover
Reputational risk	Stakeholder willingness to buy, work, invest or grant license	The executive who owns the underlying failure, supported by communications	Months to years, and sometimes never fully
Brand risk	Recognition, positioning and the promise the brand makes	Marketing, with board sign-off on repositioning	One or two campaign cycles
Operational risk	Process, systems, people and delivery capability	Operations and technology owners	Hours to weeks, measured against recovery objectives
Conduct risk	Fair treatment of customers and market integrity	Compliance, business line leadership and internal audit	Regulatory cycle, often multi-year

The practical test is who has to change behavior for the damage to stop. If the answer sits with operations or compliance rather than marketing, you are managing reputational risk correctly, and our guide to operational risk management covers the layer beneath it.

Why US Regulators Just Deleted Reputational Risk From Supervision

Here is the development that reframes reputational risk for 2026, and most writing on the topic has not caught up with it yet. US banking supervisors have removed reputation risk from their examination programs entirely, deliberately and on the record.

Figure 1. Fifteen months from the first announcement to a binding rule.

The sequence began on 20 March 2025 when the OCC said it would stop examining for reputation risk. The Federal Reserve followed on 23 June 2025, and the OCC and FDIC published a final rule on 10 April 2026 that took effect on 9 June 2026.

The stated reasoning matters more than the mechanics. The agencies concluded that reputation risk had not proven useful in predicting bank failures and had introduced a high degree of subjectivity into examinations, which is a fair criticism of how the category was applied.

What changed	What it means in practice	What it does not change
OCC stopped examining for reputation risk, March 2025	Examiners no longer cite reputation risk as a standalone finding	The underlying conduct, credit and operational findings remain fully examinable
Federal Reserve dropped it from examinations, June 2025	Supervisory letters stop using reputation as a criticism	Consumer compliance and fair lending obligations are untouched
OCC and FDIC final rule effective 9 June 2026	References removed across regulations, manuals and interagency documents	Boards keep their fiduciary duty to protect franchise value
Conforming amendments across agency materials	The vocabulary disappears from supervisory guidance	Investors, customers, employees and the press continue to price reputation

Our reading is that this raises the stakes for boards rather than lowering them, whatever the headlines suggested. OCC Bulletin 2026-23 and the matching FDIC letter on interagency documents remove an external forcing function, and so far nothing has replaced it inside the firm itself.

Non-bank organizations never had that examiner in the first place, which makes the point sharper rather than softer. If a reputational risk program existed mainly because a regulator asked about it, the honest question now is whether it ever existed for the right reason.

Where Reputational Risk Actually Comes From

Sources matter more than definitions once a reputational risk program is actually being built. Plotting them by how fast they arrive and how visible they are to the board exposes the one quadrant where most organizations have no coverage at all.

Figure 2. Fast and unseen is the dangerous quadrant, because response time is shortest there.

Slow and visible sources are the easy ones to manage. Culture drift and questionable climate claims give years of warning, and FTC advertising guidance alongside a greenwashing risk assessment or a structured ESG risk management process will surface them long before a journalist does.

Source of reputational risk	Why it converts to loss	Leading indicator to watch
Conduct and culture	Internal tolerance of behavior that stakeholders will not tolerate	Whistleblower volume, exit interview themes, repeat grievance patterns
Product and safety failure	Direct harm creates immediate media and regulatory attention	Complaint velocity, near-miss reports, warranty claim trend
Data breach and disclosure	Timing of notification is judged as harshly as the breach	Detection-to-notification lag, unpatched critical asset count
Third-party and supplier conduct	Stakeholders attribute supplier behavior to the buyer	Supplier incident rate, unresolved audit findings, concentration by spend
Executive behavior	Personal conduct transfers to the institution within hours	Governance gaps, expense exceptions, unreported conflicts
AI systems in production	Automated decisions scale a single flaw across every customer	Model drift alerts, override rates, unexplained decision volumes

The supplier row deserves separate budget because attribution is unfair and immediate. Pair a third-party risk management framework with active monitoring of concentration across vendor relationships, since one shared supplier can put a dozen brands in the same headline.

Artificial intelligence is the newest entry and the least governed. A biased or hallucinating model touches every customer at once, which is why an AI governance framework now belongs in the reputational risk conversation rather than only in the technology one.

What Reputational Risk Costs, and Who Is Judging

Cost is where reputational risk arguments usually collapse, because the number arrives late and looks like an opinion. The honest position is that the loss is real but lagging, and it is measured through customer behavior rather than through media sentiment.

The audience doing the judging has hardened as well, which changes the arithmetic. The 2026 Edelman Trust Barometer surveyed more than 33,000 people across 28 countries and found seven in ten hesitant to trust someone holding different values or drawing on different information sources.

Figure 3. US audiences sit exactly on the global average, with 70 percent hesitant.

That insularity is the mechanism behind slow recoveries. An organization that damages trust is no longer arguing with a neutral audience, it is arguing with one already inclined to discount what it says, so remediation takes longer and costs more than the incident itself.

There is a genuine opportunity buried in the same research, and it cuts against the gloom. Business overtook NGOs on ethics for the first time on record, rising four points while NGOs fell two, which means credibility is currently available to firms that behave consistently.

Figure 4. Business gained the ethics advantage in 2026, which is a position that can be lost quickly.

Boards should treat that crossover as a perishable asset rather than a trophy. Trust earned across a decade converts into pricing power and hiring advantage, and a single mishandled reputational risk event can return the balance to where it started.

How to Build a Reputational Risk Program in Six Steps

With the examiner gone, the program has to justify itself internally on evidence, and only 32 percent of organizations call their risk oversight mature. These six steps are the sequence we use when a board asks what owning this exposure involves, and each produces something a director can inspect.

Step	What you do	What proves it is finished
1. Map stakeholders	Name the groups whose changed behavior would hurt: customers, employees, investors, regulators, communities	A ranked stakeholder list with the specific behavior that would signal lost trust
2. Trace to causes	Link each reputational scenario back to the conduct, product, data or supplier failure that would trigger it	Every scenario has a named operational owner, not a communications owner
3. Set tolerance	State how much stakeholder harm the board will accept before escalation, in observable terms	Quantified triggers such as complaint velocity or attrition thresholds
4. Instrument early warning	Stand up leading indicators on the causes rather than sentiment tracking on the outcome	A dashboard where every top scenario has at least one leading indicator
5. Rehearse response	Exercise the first 48 hours with the executive team, including the decision to say nothing yet	Timed exercise showing who approves the first statement and how fast
6. Close the loop	Convert every incident into a design change in product, contract or governance	Board-tracked actions that changed something other than the messaging

Step two is the one that separates a real program from a communications plan. If a reputational scenario cannot be traced to an operational cause with a named owner, it is not yet a managed risk, and the three lines model and the IIA position paper behind it supply the accountability language.

Step five surprises executives most often. The hardest call in the first hour is usually whether to speak at all, and teams that have never rehearsed it default to speed over accuracy, which is how a manageable event becomes a credibility problem.

Reputational risk belongs inside the wider risk architecture rather than beside it. Fold it into an integrated risk management program so it is scored on the same scale as everything else, and align the escalation path with business resilience arrangements you already exercise.

Measuring Reputational Risk Before the Crisis

Most reputational risk reporting is a media clipping service with a sentiment score stapled to the front. That measures the weather after the storm has passed, and the indicators worth a board slot are the ones that move before anybody outside the organization notices.

Indicator	What it tells you	Why it beats sentiment tracking
Complaint velocity	Rate of change in complaints on a single theme, not the absolute count	Acceleration precedes escalation, while volume alone is background noise
Employee sentiment on ethics	Whether staff believe reported concerns are acted on	Internal tolerance predicts external exposure by months
Detection to notification lag	Elapsed hours from incident detection to stakeholder notice	Stakeholders judge the delay more harshly than the incident
Supplier incident rate	Frequency of conduct or safety events across the vendor base	Attribution is immediate, so supplier trend is your trend
Time to first statement	Measured in exercises, not estimated	Reveals whether decision rights are real or theoretical
Trust-weighted attrition	Customer and employee departures citing values or conduct	The only metric that connects reputation to cash directly

Build these into the reporting you already run rather than standing up a parallel reputational risk pack. Our key risk indicator library and the legal and compliance indicator set both slot into a standing board dashboard without adding a new committee.

Appetite deserves the same treatment as any other category. Writing a reputational risk appetite that says the firm has zero tolerance for reputational damage is a way of saying nothing, and our worked appetite statement examples show what a defensible threshold looks like.

Where Reputational Risk Programs Go Wrong

The most common reputational risk failure is easy to name and hard to fix. The program sits with communications, so it can describe every scenario in detail while changing none of the conditions that produce them, which becomes obvious the first time something real happens.

Failure	Root cause	Correction
Reputational risk owned by communications	It was treated as a messaging problem rather than a conduct outcome	Assign each scenario to the executive who owns the underlying cause
Appetite stated as zero tolerance	Nobody wanted to defend a threshold in front of the board	Set observable triggers such as complaint velocity or attrition rates
Media sentiment used as the metric	It is available, cheap and lagging	Report leading indicators on causes, keep sentiment as context only
Supplier conduct treated as the supplier’s problem	Contracts transfer liability but not attribution	Monitor supplier incidents as your own and build exit options
No rehearsal of the first 48 hours	Crisis plans exist as documents rather than as drills	Run a timed exercise including the decision to hold a statement
Incidents closed with an apology	Root cause recorded as a communications lapse	Require a product, contract or governance change per incident
Program dropped after supervisors moved on	It existed to satisfy an examiner, not the board	Re-anchor the program to franchise value and customer economics

That last row is the live risk in 2026. Banks that built reputation risk capability to answer examiners now have a defensible reason to quietly stand it down, and the ones that do will discover the exposure never depended on supervision to exist.

The Reputational Risk Questions Boards and Executives Keep Asking

What is reputational risk in business, in plain terms?

Reputational risk is the loss an organization suffers when stakeholders change their opinion of it and then change their behavior. Customers buy less, talent leaves, investors demand a higher return, and regulators look harder, all without any single accounting entry naming the cause.

Is reputational risk still a regulatory requirement?

Not for US banks in the supervisory sense. The OCC, Federal Reserve and FDIC removed reputation risk from examinations between March 2025 and June 2026, though the underlying conduct, consumer protection and safety obligations that generate reputational risk remain fully enforceable.

Who should own reputational risk inside a company?

Each reputational risk scenario should be owned by the executive accountable for its underlying cause, with the chief risk officer coordinating and communications owning response delivery. Handing the whole category to communications is the most frequent structural mistake we encounter in review work.

How do you measure reputational risk before something goes wrong?

Track leading indicators on the causes: complaint velocity, employee sentiment about whether reported concerns get acted on, supplier incident rates, and detection-to-notification lag. Media sentiment is useful context, but it moves after the reputational damage has already been done rather than before it.

Which industries face the highest reputational risk?

Sectors where trust is the product carry the most exposure, including financial services, healthcare, food and consumer brands. Any organization whose customers can leave quickly and whose failures are visible to the public should treat reputational risk as a board-level category.

How long does it take to recover from a reputational risk event?

Recovery from a reputational risk event ranges from weeks for a well-handled single incident to several years where conduct or safety was involved. Speed depends far more on whether the organization changed something material than on how quickly it issued a statement.

Can insurance cover reputational risk?

Policies exist that fund crisis communications and recover some lost income, but no policy restores stakeholder trust or replaces the customers who left. Treat reputational risk cover as a way to fund the response, never as a substitute for managing the causes.

Three Shifts That Will Rewrite the Reputational Risk Playbook

The first shift is already underway in the supervisory record. With reputation risk out of US bank examinations, the discipline has to be justified by franchise economics, and programs unable to make that case internally will lose their funding within two budget cycles.

The second is automation of the failure itself. AI systems making customer-facing decisions turn an isolated error into a systematic one, and the World Economic Forum Global Risks Report 2026 ranks misinformation among the severest near-term risks, which shortens the window for correcting a false narrative.

The third shift is the compression of disclosure timelines. The SEC cybersecurity rule already compresses material incident reporting into four business days, and IBM’s breach cost research shows the expense concentrated in lost business and customer churn rather than in technical remediation.

Anchor the reputational risk program to something durable before those three pressures land together. ISO 31000:2018, COSO ERM, ISO 37301 for compliance management and the DOJ evaluation of corporate compliance programs all reward demonstrable process over stated intent, which is precisely the quality that survives an examiner’s departure.

 

Get Ahead of Your Next Reputational Risk Event

Pick the scenario you would least like to read about on Monday morning, then find out who owns the condition that would cause it. Most organizations discover the answer is nobody, or a committee, which is the same answer wearing a better suit.

We map reputational risk scenarios back to their operational owners, set observable tolerances, and run the timed first-48-hours exercise that shows whether decision rights hold under pressure. Browse our advisory services or send us the scenario that worries you most.

Teams working without outside help can start with the enterprise risk management framework, tighten supplier exposure using a vendor risk assessment questionnaire, and check whether governance sits in the right place with our comparison of GRC and ERM.

Tooling helps only after ownership and tolerances are settled, never before. When you reach that point, weigh crisis management platforms, third-party risk software and compliance management tools against the scenarios you actually mapped rather than against a vendor feature list.

zz