Risk managers need a broad vision when monitoring company social media policies

Monitoring and adjusting a social media risk management policy requires a broad vision on the part of risk managers, as well as a willingness to embrace new technology and work within enterprise risk management frameworks, experts say.

Shawn Ram, managing director and national technology practice leader at Aon Risk Solutions in San Francisco, said a social media policy has to be plain and strict. What may seem like an innocuous tweet or Facebook posting to an employee can easily divulge valuable trade secrets or put an organization afoul of U.S. Securities and Exchange Commission rules regarding insider information.

“At its very core, managing social media risk starts with a policy inside an organization,” Mr. Ram said. “However, it's one thing to create a social media policy. The difficulty comes in monitoring it.”

Monitoring social media risk is a ceaseless process requiring the efforts of individuals throughout the enterprise. In addition to the risk management department and natural allies in areas such as the finance and legal departments, prudent risk managers will build bridges to area such as marketing, communications and investor relations.

“Oftentimes, the group within an organization that is tasked with addressing this risk won't have all the skills necessary,” Mr. Ram said, adding that companies should also leverage expertise from third parties if necessary. “If you have a social media account being managed by a third party, as many organizations do, you should have somebody managing that experience, so I would encourage risk managers to ask questions around social media expertise within their organizations.”

Mr. Ram said risk managers also should prioritize getting buy-in from top executives about the unique array of challenges social media technology presents.

“The C-suite needs to be cognizant of the risks associated with social media and provide the resources necessary for risk professionals to manage this risk,” he said.

Fortunately for risk managers, a wide variety of tools exist to monitor both internal and external social media activity. While many monitoring tools are based on mature Web-crawling technology, some newer tools make greater use of semantic Web technology, Mr. Ram said.

%%BREAK%%

“You need to take unstructured data from social media and structure it in a way that makes sense for your organization,” he said.

Peter J. Gerken, senior vice president of risk transfer agency and insurance for Steel City Re L.L.C., a Pittsburgh-based broker/adviser specializing in corporate reputation measurement and risk transfer, said his company has created reputational value metrics that help risk managers track sentiment about their companies on a weekly basis. The metrics are expressed in two algorithmically based indices that track sentiment based on data pulled from public information.

One index known as the corporate reputation ranking measures the risk of reputation for a given public company, while the second index, a reputational value metric, ranks companies against peers in their given sectors. “We set algorithms that look at what a company's stakeholders do,” Mr. Gerken said.

To help risk managers mitigate the risk further, the company also provides reputational value insurance through the syndicates of underwriters at Lloyd's of London and various insurers.

Nir Kossovsky, co-founder, CEO and director of Steel City Re, said reputational value insurance can help risk managers know that the messaging of a company's public relations and marketing team comports with the reality perceived by risk managers. “Overpromising is a huge risk,” Mr. Kossovsky said. “The moment that your stakeholders figure out that you are painting a picture that is not substantive, they will punish you.”