Few things are more important than one’s reputation, whether a company’s or a person’s. How one is viewed in the marketplace, and by those with whom we come into contact directly, affects our well being. In the business environment a positive reputation provides tremendous benefits, including attracting and retaining top human talent, business partners, and the most desired customers and clients. It affects dealings with suppliers, lenders, and shareholders, among many more.

Certainly the words of Warren Buffett are on point: “It takes 20 years to build a reputation and five minutes to ruin it.” We can look to what happened to companies whose reputations were damaged, such as Firestone Tire, Arthur Andersen, BP, News Corp., SAC Capital—and others too numerous to cite. Some survived, some didn’t, but all paid a significant price.

Because of that critical importance, if you’re a member of a board or directors or otherwise active in corporate governance, you probably spend considerable time and energy focusing on your company’s reputation. You read about it in board journals, hear it at conferences, and address it in board meetings. There’s an urgent call for directors to consider the company’s reputation, to monitor it in various forums, and to be prepared to act if it is threatened or damaged.

Recognize What Drives Reputation

There’s no doubt that directors need to give attention to their company’s reputation, to nurture it, and ensure it has achieved and maintained a positive glow in the marketplace. How to do that is open to debate.

We’re seeing the suggestion, or rather the demand, that boards look at reputation first and foremost, as the primary focal point in managing corporate risk. And much of a board’s responsibility is said to revolve around close monitoring of how the company is perceived, from customer surveys to monitoring reactions to products, service, and other events in a range of venues including social media. Another primary focus is establishing response plans to deal with a crisis should one arise.

Yes, knowing how your company is viewed, and being prepared to deal with a crisis, are both important. That being said, logic and experience show that focusing first on reputation itself as a way of mitigating the associated risks is badly misplaced, and frankly counterproductive. For golfers out there, it’s akin to making your backswing while looking down the fairway to see where you want that little ball to end up. That’s not how hitting a golf ball works. Rather, you need to tend to the basics of your swing, with your eye on the ball, to have the best likelihood that you’ll ultimately find your ball far down the middle.

In business, the reality is that an organization’s reputation is the result—the outcome—of the integrity, ethics, and myriad actions of the corporate entity and the executives who run it. Attempting to manage reputation directly misplaces effort and harms outcome. Yes, keeping abreast of how outsiders perceive the company’s brands, products, and activities, and being prepared to deal with a crisis, are necessary. But it’s critical that attention is given to where the underlying risks actually exist.

Focus Attention Where Really Needed

When Firestone’s tires were found to be defective, the company’s reputation was critically damaged. But if the board had been focusing on the status of the company’s reputation (which was quite positive before the defects became known), it would likely have seen no problem. The board should have been focusing on ensuring that risks related to product quality were identified and effectively managed. It should have ensured management was identifying and managing risks in product design, supply chain, and manufacturing processes, to be comfortable that quality continued to be built into the company’s tires.

Yes, the board should monitor the company’s reputation as well, and be prepared to act quickly and appropriately when necessary. But keep in mind what really drives reputation; it doesn’t form by itself in a vacuum. It’s the product of everything a company and its people do. And that’s where the board needs to focus its attention.

When Arthur Andersen imploded, its reputation took a direct and lethal hit. Before the Enron fiasco, Andersen had one of the best reputations in the accounting and auditing profession. If its board of partners was monitoring reputation, it should have been delighted. But the board should have been looking at risks related to allowing an engagement partner to ignore the direction of its national office and unilaterally make final decisions. It should have been looking at risks related to trying to rebuild its consulting business at the expense of good accounting. And it should have been looking at risks associated with allowing a staff lawyer in its general counsel’s office to advise on destroying documents related to the subject audit.

Similarly, if the BP board monitored the company’s reputation, it may well have been pleased in the 2000s. But that was before the Deepwater Horizon offshore platform blew up in 2010. The board should have been focusing on risks surrounding the configuration of its blowout preventers and related limitations, including the cutting ability of the blind shear rams. It should have focused on the quality of cementing and capping devices, the ability to monitor pressure, and clear division of responsibility between BP and Transocean.

We could go on, but the point is clear. Having a positive reputation is extremely important. But how to get there and how to oversee it calls for looking closely at what drives that reputation.

Do the Basic Blocking and Tackling

Companies that enjoy a positive reputation demonstrate integrity and high ethical values in dealing with employees, customers, suppliers, joint venture partners, shareholders, regulators, and others. They focus like a laser on product and service quality, innovation and new product development, and opening new markets. They respect legal requirements and the importance of related compliance. And when a problem surfaces, they are active and effective in dealing with any damaged parties.

Behind this is what should be an effective enterprise risk management process. The company should have in place the right culture and related internal environment, and an effective objectives-setting process and identification of risks to meeting those objectives—as well as identification of related opportunities. The process should ensure the risks are properly assessed and the appropriate actions and controls put in place to manage the risks within risk appetite and tolerances; and ensure that opportunities are seized. Relevant information should flow up, down, and across the organization such that managers act on the basis of accurate and relevant knowledge, and the process needs to be monitored by management closely.

The board’s responsibility is to ensure that this process is in place, working effectively, and driving the desired results. If the board questions, probes, challenges, and satisfies itself that the organization and its business processes are risk-based with the quality needed to achieve corporate goals, then it’s likely its reputation will follow accordingly.

Yes, the board should monitor the company’s reputation as well, and be prepared to act quickly and appropriately when necessary. But keep in mind what really drives reputation; it doesn’t form by itself in a vacuum. It’s the product of everything a company and its people do. And that’s where the board needs to focus its attention.