Obviously there are many types of organizations — and crises — not tracked by this study.

That said, I agree with you completely that detecting the warning signs of crisis, in advance — i.e., fire prevention versus fire-fighting — is the smart way to go. I use a process called a “vulnerability audit” for this purpose.

Jonathan Bernstein
President
Bernstein Crisis Management, Inc.

First time stopping-by your blog - great post!

On the issue of managing risk, I found this post interesting for two reasons. The first is that as a vendor in the online reputation monitoring (ORM) space and maker of ORM tools like RepuTrace™, we are constantly striving to achieve the best possible ways to identify risk, and to properly apply metric and value judgement to more important matters of online risk. The second is based on my belief that metric’s best point of reference is context, and I think that in order to make the two meaningful in terms of developing some kind of “risk radar”, the right balance of careful review, weight of intensity/influence and human judgement needs to be struck between the two.

Where I see the most opportunity for maturity within the ORM space is in terms of melding the two (metric and context) to arrive at some level of interpreting risk. I have blogged about this topic to some extent in the past, but the points you raised here articulated to a much greater extent some of the relevant points and challenges of assigning categories of risk.

While I’m in complete agreement about using categories or some type of score to interpret risk thresholds, I’m also of the view that each business is unique in its tolerance to online risk. When speaking of reputation risks, I can see ORM vendors flocking to incorporate risk interpretation if they haven’t already done so - the only question will be whether the approach they use will rely more heavily on automated or machine analysis rather than human review.

Joseph

Well said and worthy of recognition.