Most organisations discover the state of their reputation readiness in the same way: about thirty minutes into something going wrong.
There is usually a plan, but it answers the wrong question. It sets out what will be said. The first thirty minutes go on something else: working out who is allowed to say it, whether the facts are firm enough to repeat, and which of three people has the authority to decide. By the time that is settled, someone else is already telling the story, and the organisation is responding to it rather than shaping it.
That is why we think reputation readiness sits in the wrong department. It is usually handed to communications, but it is a governance matter.
Why this is a governance question
King IV makes this point directly. Principle 3 asks the governing body to ensure the organisation “is, and is seen to be, a responsible corporate citizen”. That is two obligations in one sentence. The second belongs to the board, alongside ethical leadership and stakeholder-inclusive decision-making, and is not a marketing function’s job.
Read that way, reputation is what an organisation shows when conditions are not of its choosing. What shows is whether decisions get made at the speed events require, by people who already knew they were theirs to make.
The environment has become harder
Two things make recovery harder than it used to be.
First, audiences arrive sceptical. The 2026 Edelman Trust Barometer describes a widespread reluctance to extend trust across difference: seven in ten respondents report hesitancy toward those whose values, backgrounds or information sources differ from their own. An organisation in a difficult moment is not speaking to a neutral public. Its audience starts from an unfavourable assumption and has other places to get its version of events.
Second, formal compliance no longer counts as evidence. Writing in the Sunday Independent in February, Nyaniso Qwesha described how clean audit opinions preceded the Steinhoff and Tongaat Hulett collapses, which together erased more than R300 billion in shareholder value inside a decade. He argued that South Africa has plenty of governance codes but too little visible enforcement of them. The public has drawn a reasonable conclusion: a framework on the shelf proves very little.
The same Edelman data holds a useful asymmetry. Business remains the one institution widely regarded as both competent and ethical, and employees trust their employers at 78 per cent, fourteen points above business generally and twenty-five above government. Trust is concentrated closest to the organisation. That is an asset, and organisations spend it quickly when their own people learn what happened from the news.
Four decisions, made in advance
Good preparation is a short list of decisions taken while nothing is happening, because each one is very hard to make well under pressure. It does not need a longer document.
One: who may acknowledge, without asking. This is not the spokesperson. It is whoever has standing authority to say the organisation is aware of something and is looking into it, without first getting sign-off. Acknowledging is not admitting, and treating the two as the same produces the silence that gets read as evasion. If that authority has never been written down, it does not exist.
Two: what will be said before the facts are settled. Every organisation goes through a period where it knows something has happened but not yet what. The standing commitment made in advance covers what it will confirm, what it will not speculate about, and when it will next say something. That is a commitment about candour, and it is not a script.
Three: what is already known internally and has never been said. Most reputational damage is not caused by the event itself. It comes from what the event exposes: the figure that never reconciled, the policy applied case by case rather than adopted, the arrangement everyone assumed had been disclosed. An organisation that keeps an honest register of its own unresolved items is not being pessimistic. It is removing the surprises that turn an incident into a story about concealment.
Four: who decides it is over, and what changes as a result. Recovery without a named owner and a recorded decision is just the point where everyone stops talking about it. Nothing is learned, and the same gap is there next time.
None of these requires a budget. Each needs a meeting, a decision and a written record, which is often why they are missing from organisations that consider themselves prepared.
What this looks like in a small organisation
We work with organisations that cannot realistically run a dedicated risk function. The four decisions still hold at that scale, and they matter more, because a smaller organisation has fewer relationships to absorb a single unclear moment.
What changes is the form. The escalation matrix becomes two names and a phone number. Monitoring becomes one person with a standing fifteen minutes and a short list of places to look. The after-action review becomes an agenda item at a meeting that already exists. It is the same discipline in lighter form, and the version that lasts is the one that fits habits the organisation already has.
The test
A readiness assessment worth doing asks very few questions, and none of them are about documents.
Who is permitted to acknowledge an issue publicly before the facts are established, and does that person know it? What would we confirm in the first hour, and who agreed that? Which unresolved items would this expose, and are they written down anywhere? When it ends, who says so, and what changes because of it?
An organisation that can answer all four is prepared, whatever its crisis binder looks like. One that cannot is not prepared, however thorough the binder.
What we are not claiming
Readiness does not prevent crises, and we would be wary of anyone who says it does. Effective implementation within a system under stress is non-linear, and some of what an organisation has prepared will turn out to be the wrong preparation. Our claim is narrower: organisations that have made these decisions in advance spend the first thirty minutes responding rather than deliberating, and that difference usually shapes how the episode is remembered.
Compliance is the minimum. What an organisation is really protecting is its legitimacy, and that is decided in moments nobody scheduled.
Liyana Impact Advisory works with organisations on reputation, stakeholder engagement and impact communications. If something went wrong in your organisation this afternoon, who is permitted to acknowledge it publicly before you have all the facts, and does that person know it?
