5/2/19

1

BRAND AND REPUTATIONAL RISKKnowing how you are perceived by others.

IIA Spring Summit – May 5th, 2019‘Elevating Performance - Taking a Leadership Role in Raising the Standards’

BACKGROUNDDaniel Tucci • Audit Director focusing on consumer lending products, pricing, and production audit strategy, as well as

ensuring coordinated coverage across all of the company’s consumer lending products. • 20+ years audit experience in the financial services sector. • B.S. in Accounting from Pennsylvania State University, Certified Internal Auditor (CIA) and Certified

Investments and Derivatives Auditor (CIDA) designations.

Tiffany Brown• Senior Audit Manager leading the Commercial Real Estate Audit Team

• 16 years’ experience in banking, public accounting, and pharmaceuticals having covered a number of Wholesale banking businesses, including Commercial and Corporate Banking, Treasury Management, International and Domestic Operations, Trade Finance, and Correspondent Banking

• BA in accounting from Temple University and Certified Financial Services Auditor (CFSA).

Although we are employees of Wells Fargo, the views expressed by us in this presentation are our personal views and do not necessarily reflect or state the views of Wells Fargo & Company, its affiliates, or subsidiaries.

2

ASSESSING THE ROOM

• Show of Hands: What is your confidence in audit’s assessment of reputation risk at your company?

(High Confidence, Confident, Not Confident)

• Show of Hands: What is your confidence level in your own audit department’s reputation with internal business partners?

(High Confidence, Confident, Not Confident)

3

5/2/19

2

AGENDA• Auditing Brand and Reputational Risk for your organization

• Tactics for assessing brand and reputational risk

• Reputational Assessment Scenarios

• Building Audit’s brand and reputation

• Having a seat at the table

• Building your reputation

4

AUDITING REPUTATIONAL RISK FOR YOUR ORGANIZATION

5

REPUTATIONAL RISK

Business Audit

Reputational Risk: The threat or danger to the good name or standing of a business entity. Reputational Risk can occur in the following ways:

• Directly, as the result of the actions of the company itself

• Indirectly, due to the actions of an employee or employees

• Tangentially, through other peripheral parties, such as joint venture partners or suppliers

Consideration for inherent and Residual Risk

6

5/2/19

3

INHERENT RISKAn assessed level of raw or untreated risk; that is, the natural level of risk inherent in a process or activity without doing anything to reduce the likelihood or mitigate the severity of a mishap, or the amount of risk before the application of the risk reduction effects of controls.

Considerations:• What customers are impacted by your activities?

• What about secondary customer impacts?

• How do you determine an impact to customer (i.e. $ or something else)?

What residual risk exists after you have adopted controls based on the considerations above?

7

Residual risk is risk that remains after considering the application of controls and other risk management activities in place to mitigate the risk.

Considerations• Risk appetite • Retrospective reviews• Go forward methodology

8

RESIDUAL RISK

REPUTATIONAL RISKConsiderations:

• Where present, call out reputational risk as a factor in annual risk assessments

• Ensure proper governance and oversight over reputational risk • Conduct Office• Sales Practices

• Corporate Values to Performance / Compensation Structures

9

5/2/19

4

WHY DOES REPUTATIONAL RISK MATTER?

Reputation maters to businesses, large and small• Fischer Price• Gucci• Beverage Industry (Pepsi, Coca Cola )• NFL• Facebook• Boeing

10

REPUTATIONAL RISK HELPFUL HINTS

• Is reputational risk a standing management agenda item? • What is the risk appetite of board, CAE, and senior management?• Perception vs. Reality• Diversity on Board, Senior Management?• “Don’t‘ read too much of your own press”• Understand reputation trends in other industries

11

HANDLING REPUTATIONAL RISK EVENTS

• When issues are identified, understand the number of customers affected and the impact.

• Assess regulatory impact (i.e.: regulatory scrutiny)

• Determine what customer remediation is necessary?

12

5/2/19

5

ASSESSING CUSTOMER IMPACTConsiderations:

• Identify the number of impacted customers – typically requires data analytics and establishing parameters for types of errors.

• Understand / Determine level of impact / harm to each customer.

• Assess root cause to ensure actions can be taken to prevent the risk exposure from happening in the future.

• Review what practices drove behaviors that resulted in the issue (i.e.: incentive compensation)

13

ASSESSING CUSTOMER IMPACT

• Coordinate with other audit teams

• Leverage data analytics• Build strong relationships with Third Party Assessors within the business

14

REPUTATIONAL ASSESSMENT SCENARIOS

• What do you see as the level of customer impact at the start of the scenario?

(1 being no impact, 5 being high impact)

• What is the impact on brand and reputational risk in the scenario?(1 being no impact, 5 being high impact)

15

5/2/19

6

REPUTATIONAL RISK SCENARIO 1

16

REPUTATIONAL RISK SCENARIO 2

17

BUILDING AUDIT’S BRAND AND REPUTATION

18

5/2/19

7

INSIDE THE COMPANY

Building a collaborative relationship with business partners will drive successful engagements. Transparent Independent Operations

Considerations:• Educate the business • Stressing a need to be at the table • Audit’s value add to the business and the company• Credible Challenge

19

INSIDE THE COMPANY

Educate the Business• Explain audit and what we do• Risk and control mitigation • Provide independent perspective• Ability to conduct project work• Ensure independence

20

INSIDE THE COMPANY

Seat at the Table• Business Monitoring • Non-voting risk committee seats• Regulatory calls• Management reporting / meetings

21

5/2/19

8

INSIDE THE COMPANY

Audits Value and Credible Challenge• Third line of defense• Navigate emerging risk factors• Industry knowledge • Increase scrutiny and how to navigate

22

EXTERNAL STAKEHOLDERS

Develop a reputation as trusted, disciplined, and effective at identifying risk AND influencing change

Considerations:• Stakeholders• Investors • Audit Committee• Regulators

23

Questions?

24