Companies and other organizations must constantly be prepared to respond to threats to their integrity, and, thus, their reputation. The consequences for erring in response to such threats can be fatal to an otherwise successful organization. Even if not fatal, reputational threats harm a company's value in countless economic and noneconomic ways. This is especially true today, where social media and the 24-hour news cycle sensationalizes stories, and public opinion often turns on the content of 140 (now 280) characters. In this environment, companies and other complex organizations, through their senior executives and boards of directors, must be ready to respond to threats in ways that will protect the organization but also are true to the organization's values. Put another way, organization's must respond with integrity.

Why Prepare for Reputational Threats?

Since at least the sixteenth century, it has been said that practice makes perfect. The adage holds true in preparing to deal with reputational threats. Just like companies prepare for other disasters today—from strikes to natural disasters to cyberattacks—companies should prepare (and practice) for how they would respond to reputational threats. There are many reasons for this, but here are the top four:

• First, reputational threats can be extraordinarily harmful to an organization. Imagine the possible outcome to a pharmaceutical manufacturer, for example, if word of lax patient safety practices swirled around the internet. Consumers may stop purchasing products, putting the entire business at risk. Companies must be prepared swiftly to mitigate these threats at the moment they emerge.

• Second, reputational threats can take many forms. Some stem from questions about safety (as in the above example) while others may emerge out of alleged fraudulent financial practices, a #MeToo-type allegation, crimes and civil frauds, and a host of other real or perceived misconduct. While effective responses to reputational threats often require specific tactics aligned with the nature of the specific threat, general response processes—including an emphasis on corporate values—provide critical guides.

• Third, reputational threats can occur without notice and spiral quickly. Many, like a news story, a tweet, or some other posting, can go viral in minutes, limiting the amount of time an organization has to respond. Given the intricacies corporations face in reaching senior leaders and, where appropriate, board members, to plan a response, there is never time to craft a strategy from scratch. Rather, companies need already to have a baseline on how they will process and handle such threats and responses quickly.

• Fourth, reasonable minds can differ on how an organization might respond in these circumstances. Different executives and board members may prefer different approaches to responding to reputational threats. Some individuals prefer an aggressive denial, while others gravitate toward a wait-and-see approach. Either of these approaches may be appropriate depending upon the threat. Rehearsing how to resolve differences of opinion—and what value to emphasize in responding to a threat—may make settling on a response less contentious and more timely.

How to Prepare for Reputational Threats?

The question then becomes how should organizations prepare for currently unknown, but possible, future reputational threat? How can a company prepare for something that is, at present, vague and undefined? By practicing before the threat occurs. The military, police departments, top flight athletic teams, and other highly functioning organizations routinely engage in scenario-based role playing to ensure they are not surprised by future threats. Companies can do the same thing. Fortunately (albeit, unfortunately for some), our newspapers are filled with meaty illustrations of reputational threats that provide great material for in-house training.

Because reputational threats often require the attention—and action—of company officials at all levels, preparation for such threats also should involve organizational leaders at all levels. Corporations and other organizations should devote time at board meetings and senior executive meetings to thinking through how they will respond to these types of threats. For example, companies should arrange for "table top" exercises at these meetings to role play how the organization will respond to threat X or Y. The exercises should incorporate open discussions regarding various response options. Would the organization issue a denial Commence an investigation? Terminate an employee or officer? Or, as many organizations have done historically, do nothing? These table top exercises should include the following elements:

• A specific factual threat and source of threat, whether consumer, employee, internet or government regulator (among others):
• A discussion of options about how the organization might respond in the short-term, including the pros and cons of various suggestions;
• A discussion of which option is best, and why that option is preferred over others; and
• A change in the factual threat, i.e., new information emerging, that challenges the initial decision and asks the participants to reconsider their choice.

The goal of the exercise is to generate a discussion among key leaders about what the organization values most and how those values translate into responses. It is also to make leaders think about what they should bear in mind in the event a real reputational threat is encountered. These exercises should result in a general framework for the company to rely on in the future when the threat arises.

An Example

The Acme Corp., a publicly held automobile parts manufacturer, decides to conduct one of these table-top exercises under the auspices of its general counsel. Working with outside counsel, a meeting is arranged among the company's CEO, CFO, head of communications, head of manufacturing, head of investor relations, head of sales, audit committee chair and a few independent board members.  At the meeting, counsel presents the following scenario:

On Monday, the company's CEO received a letter from an internal whistleblower that its turn signal light bulbs may be unsafe, can spark and may ignite a fire. The letter does not suggest that the whistleblower, who worked on the design of the light bulbs, is prepared to raise their concerns to anyone else. Over the last five years, over 15 million of the light bulbs have been sold and revenue from these sales account for approximately 12% of the company's revenue.

The table-top exercise then commences. What options are there for the Acme Corp.? Should it do anything? Should it investigate? How? Should it recall all of the light bulbs? Should it notify the government? Must it notify the government? Should it interview the whistleblower? What does the organization's value statement tell us about how we should react? And, importantly, how did it happen?

In these sorts of exercises, various leaders tend to favor one approach over others. After a discussion of the relative merits of each and the organizational value they represent, the discussion should drive toward a decision. Let's say that the group in Acme determines not to recall the bulbs, but to undertake a review of their design. Once that decision has been taken, new information emerges:

It turns out the whistleblower had also sent a copy of his concerns to the National Highway Transportation Safety Administration and the Department of Justice  In the weeks following the meeting, the company receives formal inquiries from each, including a federal grand jury subpoena from the local U.S. Attorney's Office.

The exercise then continues, with the ongoing discussion driven by the "new" facts. First, the discussion might focus on whether the previous decision proved helpful in light of the new information (here it likely would). Then the discussion might focus on what to do next. The goal of the "new information" part of the exercise is to prepare leaders to adjust their thinking as circumstances change during a reputational crisis. It is also important to see whether the organizational value emphasized by the response chosen changes with the new information.

In this day and age where reputational threats can result in myriad economic and noneconomic harm in minutes, organizations must be prepared to confront them. To prepare for them, corporations should practice using real-life scenarios and evaluating their effectiveness and emphasis on corporate values. The day will come when the threat is real and organizations can fall back on their preparedness to respond as effectively as possible and minimize potential harm.

A. Joseph Jay III is a white-collar defense and government investigations partner at Sheppard, Mullin, Richter & Hampton. He has represented companies, universities and other organizations in preparing for and responding to reputational threats. He is a co-founder of the firm's organizational integrity group.