Crisis and reputation glossary

The archive is the character witness

AI engines now judge an organisation in trouble by setting the incident against everything it has published over the past decade, so its own archive testifies for or against it before anyone is called. The related phrase, deposing the witness, means questioning the engines about the organisation while things are calm and correcting the record at source.

From The Sutton Memo: The archive is the character witness

The argument on the table and the argument in the room

Every serious reputational fight runs two arguments at once: a technical one about the facts, which a company can win, and one about its character and whose side it is on, which decides the outcome. A company that answers the second with evidence built for the first can be right on every number and still lose.

From The Sutton Memo: Being right - and still being beaten

The date you knew

A company that quietly changes a product or practice while the fuse is lit hands its opponents evidence of when it knew there was a problem. Changing loudly, with dates and numbers attached, costs more at the time but builds a record that later serves as a defence.

From The Sutton Memo: The fuse in the lunchbox

The department of words

A board's view of corporate affairs as a function that produces words rather than value, which arises because reputation carries no number and boards are built to govern numbers. The phrase is used to argue that the missing figure is a measurement problem, not a reason to discount the function's warnings.

From The Sutton Memo: Reputation is priced twice

A hostage to the record

A public commitment with a date and numbers attached, which the record later holds the company to by setting it against the company's own published results.

From The Sutton Memo: Where the water went

A second match (also: the other match)

The contest a regulator fights with government over its budget, its powers or its survival, alongside its role as a neutral referee of the case in front of it. A company's file is read partly as a move in that contest, so how the regulator's own year is going bears on how a board's response will be received.

From The Sutton Memo: Your regulator is having a worse year than you

There is always a defector

In an industry facing a slow-burning crisis, one player eventually breaks ranks and tells the truth first, and it tends to get better terms than those who hold out. The defector need not be a company: it can be a whistleblower, or a body whose own records cannot be spun.

From The Sutton Memo: The fuse in the lunchbox

When the gap closes

An account of what a crisis is: not a sudden event but the moment public belief finally catches up with facts that have sat in the record, sometimes for decades. While the gap is open a board still has real choices, and once it closes the board is managing the damage.

From The Sutton Memo: The fuse in the lunchbox

Business continuity plan

A documented plan setting out how an organisation will keep its critical operations running, or resume them within a set time, if normal working is disrupted by an event such as a fire, IT failure, extreme weather or the loss of an important site or supplier. It differs from a crisis plan, which deals with how the organisation is led and communicates during an event, because a business continuity plan deals with the operational mechanics of staying open.

Board note: For a board, a business continuity plan is often already required as part of the organisation's regulatory or contractual obligations, and it typically sits alongside, rather than instead of, the crisis plan.

See also: crisis plan or playbook, crisis team

Crisis plan or playbook

A pre-agreed document setting out how an organisation will organise itself, make decisions and communicate if a serious incident or reputational threat occurs, typically covering who is on the crisis team, how they are convened, the initial actions to be taken, and templates such as a holding statement. It is prepared in calm conditions precisely so that it does not need to be invented under pressure.

See also: crisis team, gold, silver and bronze command, holding statement, scenario planning

Crisis simulation or war game

A rehearsal, using a fictional scenario, in which the crisis team and sometimes the wider board practise the decisions, communications and escalation steps set out in the crisis plan, usually facilitated by someone playing journalists, regulators or other outside parties. It tests the plan and the team in advance, rather than the organisation's response to a real event.

Board note: It is one of the few ways a board can observe, before a real crisis, how its own management team behaves under pressure and time constraint.

See also: crisis plan or playbook, scenario planning

Crisis team

The named group of people, typically spanning the chief executive or another senior leader, communications, legal, HR and relevant operational functions, given authority under the crisis plan to make decisions and coordinate the organisation's response once a crisis is declared.

See also: crisis plan or playbook, gold, silver and bronze command, single source of truth

Dark site

A version of an organisation's website, prepared in advance and kept unpublished, that can be activated quickly to replace or supplement the normal site with crisis-specific information, such as a holding statement, contact details or safety guidance, once an incident occurs.

See also: holding statement, single source of truth

Gold, silver and bronze command

A three-tier structure for managing an incident, originating in the UK emergency services and now used more widely, in which gold command sets strategy and overall direction, silver command translates that strategy into tactical decisions, and bronze command carries out operational tasks on the ground. Some organisations map their own crisis team onto this structure to keep clear who decides what, and at which level.

See also: crisis team, incident escalation

Issues management

The ongoing identification and handling of matters that could develop into a reputational problem if left unaddressed, typically before they have attracted significant outside attention, as distinct from crisis management, which responds to a matter that already has.

Board note: Issues management is where a board has the most room to change the outcome, because the organisation still has time and is not yet operating under public or regulatory pressure.

See also: reputational risk, risk register (reputational entries), stakeholder mapping

Licence to operate

The informal and continuing acceptance by regulators, communities, customers and other stakeholders that allows an organisation to keep operating without formal permission being withdrawn or informal resistance making the business impossible to run, as distinct from any specific legal licence or permit the organisation holds.

Board note: Because it is not a legal document, it can be lost gradually and without formal notice, which is one reason reputational risk is tracked separately from legal and regulatory compliance.

See also: reputational risk, stakeholder mapping

Media monitoring

The systematic tracking of what is published or broadcast about an organisation across news outlets, trade press and broadcast media, typically through a clippings or alerts service, so that coverage can be reviewed, shared internally and, where needed, corrected or responded to.

See also: social listening, sentiment analysis, share of voice

Media training

Practical preparation, usually including recorded practice interviews, given to spokespeople and senior leaders before they are required to speak to journalists, covering how to answer questions, stay within agreed lines to take, and handle a hostile or difficult interview.

See also: spokesperson, lines to take

Reputational risk

The risk that an organisation's standing with the public, customers, staff, investors or regulators is damaged by an event, decision or piece of conduct, affecting in turn its revenue, its ability to recruit, its cost of capital, or its licence to operate. It is usually treated as a distinct risk category, alongside financial, operational and legal risk, precisely because its cause can lie in any of those other categories.

See also: risk register (reputational entries), licence to operate, board oversight of reputation

Risk register (reputational entries)

The section of an organisation's overall risk register, the standard governance document listing identified risks, their likelihood, impact and mitigation, that records specifically reputational risks rather than financial, operational or legal ones, though the underlying cause of a reputational risk is often one of those other categories.

See also: reputational risk, board oversight of reputation

Scenario planning

Working through, in advance, how a range of plausible future events might unfold and what an organisation's options would be in each case, used in a crisis context to identify likely triggers, the stakeholders and decisions each would involve, and to inform the crisis plan.

See also: crisis plan or playbook, crisis simulation or war game

Sentiment analysis

The classification of media or social media coverage and comment about an organisation as broadly positive, negative or neutral, usually generated automatically from social listening or media monitoring tools rather than read individually, and used to track how opinion is moving over time or during an incident.

See also: social listening, media monitoring, share of voice

Share of voice

The proportion of total coverage or conversation on a topic that belongs to a given organisation, compared with competitors or with other parties involved in the same story, used to gauge how much of the narrative an organisation is shaping rather than simply how much coverage it is receiving.

See also: sentiment analysis, social listening

Social listening

The continuous tracking of what is said about an organisation, its sector, its competitors or a relevant issue across social media platforms, forums and other public online sources, used to spot an emerging issue before it reaches traditional media, or to track how a live incident is being discussed.

See also: media monitoring, sentiment analysis, misinformation

Spokesperson

The person authorised by an organisation to speak on its behalf, whether generally or for a specific incident, chosen for a combination of seniority, credibility with the audience concerned, and media training, rather than necessarily being the most senior person available.

See also: media training, on the record, doorstep

Stakeholder mapping

The process of identifying the individuals, groups and organisations with an interest in a company, issue or incident, such as regulators, investors, employees, customers, campaign groups and elected representatives, and assessing their level of influence and likely position, used to decide who needs to be briefed, and in what order, before and during a crisis.

See also: stakeholder briefing, stakeholder engagement, campaign group or NGO campaign

Doorstep

An unannounced approach by a journalist or camera crew to an individual at their home, workplace or another location, seeking an on-the-spot comment or reaction, generally used when other routes to a comment have failed or where a confrontational image serves the story.

Board note: Because a doorstep is unplanned by definition, how it is handled depends on individuals already knowing what they are and are not authorised to say, which is one purpose of media training and agreed lines to take.

See also: media training, lines to take, right of reply

Embargo

An agreement between an organisation and a journalist or outlet that information supplied in advance will not be published or broadcast before a specified time, allowing the outlet to prepare coverage while giving the organisation certainty about when a story will break.

See also: on the record, holding statement

Employee communication

Information given to an organisation's own staff about an incident, separate from and usually ahead of what is said publicly, so that staff do not learn what has happened to their own employer from outside media first.

Board note: Employees are themselves a public, and what they are told, and how quickly, shapes both morale and what they in turn say to family, friends and their own social media contacts.

See also: single source of truth, stakeholder briefing

Holding statement

A short, pre-approved statement issued at the start of an incident, before the full facts are known, acknowledging that something has happened and that it is being looked into, without committing the organisation to detail that later turns out to be wrong.

See also: dark site, single source of truth, lines to take

Incident escalation

The process by which knowledge of a developing problem is passed upward within an organisation, and additional people and authority are brought in, according to pre-agreed triggers such as severity, media interest or regulatory involvement, rather than being left to the judgement of whoever first becomes aware of it.

See also: gold, silver and bronze command, crisis team, single source of truth

Lines to take

A short, agreed set of statements prepared for anyone who may be asked about an incident, whether by a journalist, a client or a member of the public, setting out what can and cannot be said, kept updated as facts develop.

See also: question and answer document (Q and A), holding statement, spokesperson

No comment

A refusal to answer a question, whether from a journalist or another party, often read by an audience as an implicit admission that something is wrong, even where the true reason for silence is a legal constraint or simply that the facts are not yet known.

See also: off the record, right of reply

Off the record

Information given to a journalist on the understanding that it will not be published or attributed in any form, and will be used only to help the journalist understand the background to a story, as distinct from information given on background, which may be used but not attributed.

Board note: Whether something is off the record is a matter of mutual understanding between the individual and the journalist rather than a legal rule, so it depends entirely on establishing that understanding clearly before speaking, not after.

See also: on background, on the record, no comment

On background

Information given to a journalist that may be reported, but only in the journalist's own words and without attributing it to the individual or organisation that supplied it, as distinct from off the record, where the information cannot be used at all.

See also: off the record, on the record

On the record

A statement made on the basis that it may be published or broadcast and attributed by name to the person or organisation that made it, as distinct from off the record or on background.

See also: off the record, on background, spokesperson

Question and answer document (Q and A)

An internal document, prepared and updated as an incident develops, anticipating the questions likely to be asked by journalists, regulators, staff or other stakeholders, together with the agreed answer to each, used to keep everyone speaking on an organisation's behalf consistent.

See also: lines to take, single source of truth, stakeholder briefing

Rapid response

The capability to assess a developing situation and issue an initial public statement or take other action within a short, defined period, usually measured in minutes or hours rather than days, recognising that in a fast-moving story the absence of any response is itself read as a message.

See also: holding statement, incident escalation

Right of reply

The practice, expected under most press and broadcast codes, of a journalist putting a serious allegation to the person or organisation it concerns, and giving them a fair opportunity to respond, before that allegation is published or broadcast.

Board note: Because the right of reply is often the first point at which an organisation learns that a story is coming, how it is handled tends to shape the tone of the coverage that follows.

See also: doorstep, no comment, IPSO, Ofcom (broadcast complaints)

Single source of truth

One agreed, continuously updated internal record of the facts known about an incident, and of what has been said publicly and to whom, used to stop different parts of an organisation giving inconsistent or contradictory accounts as a fast-moving situation develops.

See also: incident escalation, question and answer document (Q and A), employee communication

Stakeholder briefing

A direct, planned communication to a specific stakeholder group, such as major investors, a lead regulator or an important client, ahead of or alongside a public statement, so that the group concerned does not learn significant news from general media coverage first.

See also: stakeholder mapping, employee communication, investor relations

Apology and admission of liability (Compensation Act 2006, section 2)

Under section 2 of the Compensation Act 2006, an apology, an offer of treatment, or another offer of redress does not by itself amount to an admission of negligence or of breach of a statutory duty. The provision applies in England and Wales and removes one specific legal objection to apologising, though it does not prevent other evidence being used to establish liability.

Board note: It means an organisation is not forced to choose between showing basic human concern and protecting its legal position, though the wording of what else is said alongside an apology still matters.

See also: duty of candour, defamation (including the serious harm test)

Dawn raid

An unannounced, on-site inspection carried out by a regulator using statutory powers, most associated with competition law, where the Competition and Markets Authority can apply to the High Court or the Competition Appeal Tribunal for a warrant to enter and search business premises under section 28 of the Competition Act 1998, and for a warrant to search residential premises under section 28A in narrower circumstances. Other UK regulators, including the Financial Conduct Authority, have comparable but separately sourced powers of unannounced inspection.

Board note: Because it happens without warning, how it is handled depends entirely on staff already knowing, before any raid, who to call and what their obligations and rights are.

See also: regulatory investigation, skilled person review (FCA section 166)

Defamation (including the serious harm test)

A false statement communicated to a third party that damages the reputation of the person or organisation it concerns. Under section 1 of the Defamation Act 2013, a statement is not defamatory unless its publication has caused, or is likely to cause, serious harm to the claimant's reputation, and for a body that trades for profit, serious harm is further limited to serious financial loss that the statement has caused or is likely to cause.

Board note: The serious financial loss test means a company cannot generally sue over reputational damage alone, however unpleasant a false statement is, without being able to point to an effect on its finances.

See also: injunction, without prejudice, corrective statement

Directors' and officers' (D&O) liability insurance

Insurance that responds to claims made against an organisation's directors and officers personally for alleged wrongful acts in that role, and that often extends to cover some of the organisation's own costs of defending or settling such claims, including in some policies a specified allowance for crisis or reputation management costs incurred in response to a covered event.

Board note: Whether, and to what extent, crisis-related costs and specialist advisers are covered is a policy-specific question, and one more easily answered before an incident than during one.

See also: group litigation order, regulatory investigation

Duty of candour

A statutory duty on providers registered with the Care Quality Commission, under regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, to act in an open and transparent way with a patient or service user when a notifiable safety incident occurs, including telling them what happened, apologising, and providing reasonable support. Public bodies also owe a duty of candour to the court in judicial review proceedings. A wider statutory duty of candour for public authorities and officials is proposed in the Public Office (Accountability) Bill, which was at committee stage in the House of Lords in September 2026 and was not yet law. The term is also used loosely, of any organisation, to describe an expectation of openness with regulators, courts and the public.

See also: apology and admission of liability (Compensation Act 2006, section 2), public inquiry (Inquiries Act 2005)

Enforcement notice

A formal notice issued by a regulator requiring an organisation to take, or stop taking, specified action, or recording a finding that the organisation has breached a legal or regulatory requirement. Its exact form and consequences depend on the regulator and the statute concerned.

See also: regulatory investigation, skilled person review (FCA section 166)

Freedom of Information (FOI) request

A request made under the Freedom of Information Act 2000 for recorded information held by a public authority, which the authority is generally required to provide within twenty working days unless a specific exemption applies. It applies to central and local government bodies and many other public bodies, but not, in general, to private companies unless they are carrying out a public function or are contracted to a public authority in a way that brings specific information within scope.

Board note: For a public body, or a private company working closely with one, an FOI request can surface internal material about a past decision well before, or instead of, any media or legal process.

See also: select committee evidence, regulatory investigation

Greenwashing (including the CMA Green Claims Code and the consumer enforcement powers in force)

Making an environmental claim about a product, service or organisation that is false, exaggerated, or not properly substantiated, so that it misleads a consumer or investor about the organisation's actual environmental impact. The Competition and Markets Authority published its Green Claims Code on 20 September 2021, setting out how existing consumer protection law applies to environmental claims, and since 6 April 2025, when Parts 3 and 4 of the Digital Markets, Competition and Consumers Act 2024 came into force, the CMA has had the power to decide for itself, without going to court first, that a business has breached consumer protection law, including on misleading green claims, and to impose a fine directly.

Board note: The move to direct enforcement means a finding against an organisation's environmental claims can now happen faster, and without the additional scrutiny a court process would previously have applied.

See also: corrective statement, regulatory investigation

Group litigation order

A case management order made by a court under Part 19 of the Civil Procedure Rules, in England and Wales, that manages a number of separate claims sharing common or related issues of fact or law together, under a single group register and a single managing court, rather than allowing each claim to proceed entirely independently. A decision on a shared issue generally binds every claim on the register, unless the court orders otherwise.

See also: representative action, directors' and officers' (D&O) liability insurance

Injunction

A court order requiring a person or organisation to do, or to stop doing, a specified act, which in a reputational context is most often sought to prevent the publication of information, such as confidential material or an allegation said to be defamatory, before a full trial has taken place.

See also: super-injunction, defamation (including the serious harm test), without prejudice

Inside information and disclosure under UK MAR (Article 17)

Under Article 17 of the UK version of the Market Abuse Regulation, an issuer whose securities are admitted to trading on a UK regulated market is required to publicly disclose inside information, meaning specific information that is not public and would be likely to have a significant effect on the price of its securities, as soon as possible. Disclosure may be delayed only where immediate disclosure would be likely to prejudice the issuer's legitimate interests, the delay would not be likely to mislead the public, and the issuer can keep the information confidential in the meantime; the issuer is then required to tell the Financial Conduct Authority as soon as the information is eventually made public.

Board note: A crisis that amounts to inside information cannot be managed on communications timing alone, because the disclosure clock under Article 17 runs independently of, and often faster than, an organisation's own preferred pace for explaining itself.

See also: RNS announcement, trading halt or suspension, profit warning

IPSO

The Independent Press Standards Organisation, an independent regulator, funded by the industry rather than by the state, to which most UK national, regional and local newspapers and magazines are signed up. IPSO handles complaints that a member publication has breached the Editors' Code of Practice, can require publication of its rulings, and in serious and systemic cases can investigate and sanction a publisher, including by way of a fine, though it is not a statutory regulator and has no power over publications that are not its members.

See also: right of reply, Ofcom (broadcast complaints), corrective statement

Legal advice privilege

The rule protecting confidential communications between a lawyer and their client from being disclosed to anyone else, including a court, where the communication was for the purpose of giving or receiving legal advice. It applies whether or not litigation is in progress or contemplated, which is what distinguishes it from litigation privilege.

See also: litigation privilege, without prejudice

Litigation hold (document preservation)

An internal instruction, given once litigation or a regulatory investigation is reasonably anticipated, requiring relevant staff to stop deleting or altering documents and other records, including emails and messages, that might be relevant, overriding any routine document retention or deletion policy that would otherwise apply.

Board note: Destroying or losing a relevant document once a litigation hold is in place can itself become a serious issue in the underlying case, independent of the facts the document originally concerned.

See also: legal advice privilege, litigation privilege, group litigation order

Litigation privilege

The rule protecting confidential communications, including with third parties such as an expert or a public relations adviser, from disclosure where they were made for the dominant purpose of existing or reasonably contemplated litigation.

Board note: Because litigation privilege depends on litigation genuinely being in contemplation and being the dominant purpose of the communication, it does not automatically extend to every communication with a public relations adviser retained on an ongoing basis.

See also: legal advice privilege, without prejudice, litigation hold (document preservation)

Materiality

A judgement as to whether a piece of information is significant enough that a reasonable person, or a specific audience such as an investor or a regulator, would need it to make an informed decision, used across financial reporting, market disclosure and legal contexts to decide what is disclosed, corrected or escalated.

Board note: Because materiality is a judgement rather than a fixed threshold, the same fact can be treated as material in one context, such as market disclosure, and immaterial in another, such as a legal claim, depending on the audience and the question being asked.

See also: inside information and disclosure under UK MAR (Article 17), profit warning

Ofcom (broadcast complaints)

The Office of Communications, the UK's statutory regulator for television and radio broadcasting, with a duty under the Communications Act 2003 to set and enforce content standards through the Ofcom Broadcasting Code. Ofcom investigates complaints that a broadcaster has breached the Code and, where a breach is deliberate, serious, repeated or reckless, can impose a statutory sanction, ranging from a published finding to a financial penalty or, in the most serious cases, revocation of a licence.

See also: IPSO, right of reply

Parliamentary privilege

The protection, rooted in Article 9 of the Bill of Rights 1689, that freedom of speech and debate in Parliament cannot be questioned or challenged in any court or other place outside Parliament. It covers what is said by members and witnesses in the formal proceedings of either House, including select committee hearings, but not everything a member says or does outside those proceedings.

Board note: A statement covered by parliamentary privilege cannot generally found a defamation claim, however damaging it is to an organisation named, which is one reason a claim about a company can surface first in Parliament rather than in a court.

See also: select committee evidence, defamation (including the serious harm test)

Personal data breach notification to the ICO (UK GDPR)

A duty under the UK General Data Protection Regulation for an organisation to notify the Information Commissioner's Office of a personal data breach where it is likely to result in a risk to the rights and freedoms of the people affected, doing so without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where the risk to those affected is high, the organisation is also required to tell them directly, and where full details are not yet known within 72 hours, it is still expected to notify what it can and provide further information afterwards without undue delay.

See also: cyber incident, data breach, ransomware

Profit warning

A public statement by a listed company that its financial results for a current or forthcoming period will be materially below what the market has been expecting, made because the company's continuing disclosure obligations require material information affecting its share price to be released promptly rather than held until the next scheduled results.

See also: inside information and disclosure under UK MAR (Article 17), RNS announcement, trading halt or suspension

Public inquiry (Inquiries Act 2005)

A formal inquiry into a matter of public concern, established under the Inquiries Act 2005 by a government minister, with a chair who has the power under the Act to require a person to give evidence or produce documents, enforceable, if necessary, through the High Court or the Court of Session. The Act specifically provides that an inquiry's function is to establish the facts and, usually, to make recommendations, not to rule on anyone's civil or criminal liability.

Board note: Because a statutory inquiry can compel evidence and documents that ordinary litigation might not yet reach, and its findings are made public, an organisation's conduct can be examined and judged in public well before, or entirely separately from, any court case.

See also: select committee evidence, duty of candour

Regulatory investigation

A formal examination by a regulator into whether an organisation or individual has breached a legal or regulatory requirement, which can result in no action, a warning, an enforcement notice, a fine, or referral for prosecution, depending on the regulator's powers and findings.

See also: dawn raid, enforcement notice, skilled person review (FCA section 166)

Representative action

A claim brought, or continued, under rule 19.8 of the Civil Procedure Rules by or against one or more people as representatives of others who share the same interest in the claim, without every affected person needing to be joined individually. Any judgment binds everyone represented, though enforcing it against someone who was not a party themselves needs the court's permission.

See also: group litigation order

RNS announcement

A public announcement made by a listed company through a Regulatory Information Service, of which the London Stock Exchange's Regulatory News Service (RNS) is the best known, used to comply with the continuing disclosure obligations in the Financial Conduct Authority's Disclosure Guidance and Transparency Rules, including the duty to disclose inside information under UK MAR.

See also: inside information and disclosure under UK MAR (Article 17), profit warning, trading halt or suspension

Select committee evidence

Oral or written evidence given to a House of Commons or House of Lords select committee, whether by invitation or, less often, under a formal summons, which forms part of the proceedings of Parliament and so falls within parliamentary privilege.

See also: parliamentary privilege, public inquiry (Inquiries Act 2005), Freedom of Information (FOI) request

Skilled person review (FCA section 166)

A report commissioned under section 166 of the Financial Services and Markets Act 2000, under which the Financial Conduct Authority or the Prudential Regulation Authority can require a regulated firm to provide a report from an independent skilled person on a specified aspect of its business, or can appoint the skilled person itself, with the firm meeting the cost.

Board note: A skilled person review is commissioned by the regulator rather than chosen by the firm, and its findings can themselves trigger further regulatory or enforcement action, which sets it apart from a piece of consultancy the firm commissions on its own initiative.

See also: regulatory investigation, enforcement notice

Super-injunction

An injunction that not only prevents publication of specified information but also prevents publication of the fact that the injunction exists or that proceedings have been brought, so that the restriction itself remains confidential.

See also: injunction, defamation (including the serious harm test)

Trading halt or suspension

A temporary stop to dealing in a listed company's securities, which can be imposed by the operator of the market, such as the London Stock Exchange, or required by the Financial Conduct Authority, generally where there is a need to protect investors or maintain an orderly market, for example while material inside information is pending disclosure.

See also: inside information and disclosure under UK MAR (Article 17), profit warning, RNS announcement

Whistleblowing and protected disclosure

The raising of a concern about wrongdoing, risk or malpractice, generally by a worker about their own employer, which becomes a protected disclosure under the Employment Rights Act 1996, as inserted by the Public Interest Disclosure Act 1998, where it is a qualifying disclosure of specified types of wrongdoing, made in the reasonable belief that it is true and, since a 2013 amendment, in the reasonable belief that making it is in the public interest, and made through one of the routes the Act sets out. A worker who makes a protected disclosure is protected from dismissal and from being subjected to a detriment because they made it.

See also: duty of candour, regulatory investigation

Without prejudice

A rule under which statements made in a genuine attempt to settle a dispute cannot generally be put before a court as evidence of an admission, so that parties can negotiate candidly without their negotiating position being used against them if the matter is not settled and proceeds to trial.

See also: legal advice privilege, litigation privilege

Activist investor

A shareholder, often a specialist fund, that buys a stake in a company specifically to press for a change, such as a change of strategy, leadership, capital allocation, or environmental, social or governance practice, using the rights that come with share ownership, public campaigning, or both, rather than holding purely for investment return.

See also: requisition of a general meeting, investor relations

Boycott

An organised refusal by consumers, employees or other groups to buy from, work with, or otherwise support an organisation, usually intended to pressure it into changing a specific policy or practice.

See also: campaign group or NGO campaign, disinformation

Campaign group or NGO campaign

A sustained effort by a campaigning organisation or non-governmental organisation to change an organisation's behaviour or policy, or to draw public, investor or regulatory attention to conduct it considers wrong, typically combining research, public communication and pressure on stakeholders such as investors, customers or regulators.

See also: boycott, stakeholder mapping

Cyber incident

An event affecting an organisation's IT systems, networks or data, whether caused deliberately, such as an attack, or accidentally, such as a system failure, that disrupts normal operation, compromises the confidentiality, integrity or availability of information, or both.

See also: ransomware, data breach, personal data breach notification to the ICO (UK GDPR)

Data breach

An incident in which information is lost, stolen, altered, or accessed by someone not authorised to see it, which becomes a personal data breach specifically where the information affected is personal data. It is one, but not the only, cause of a wider cyber incident.

See also: cyber incident, personal data breach notification to the ICO (UK GDPR), ransomware

Deepfake

Audio, video or an image generated or altered using artificial intelligence to make a real person appear to say or do something they did not, realistic enough that it can be mistaken for genuine footage without technical analysis.

Board note: A convincing deepfake of a chief executive or other spokesperson can circulate faster than an organisation can establish and communicate that it is false.

See also: misinformation, disinformation, pre-bunking

Disinformation

False or misleading information created or spread deliberately, with intent to deceive or to cause harm, as distinct from misinformation, which is false information spread without that intent.

See also: misinformation, deepfake, pre-bunking

Leak

The unauthorised disclosure of confidential information, typically to a journalist, by someone inside an organisation or with access to it, made either deliberately, by someone who believes the information should be public, or as a result of a security failure.

See also: whistleblowing and protected disclosure, litigation hold (document preservation)

Misinformation

False or misleading information spread without an intent to deceive, often by people who believe it to be true, as distinct from disinformation, which is spread deliberately.

See also: disinformation, deepfake, social listening

Pre-bunking

Communicating information in advance of an anticipated piece of misinformation or disinformation, explaining the likely false claim and the techniques used to spread it, so that an audience is prepared to recognise and discount it if and when it appears. It differs from debunking, which corrects a claim after it has already spread.

See also: misinformation, disinformation, deepfake

Product recall

The withdrawal from the market, and from consumers who already have it, of a product found to be unsafe or non-compliant, generally coordinated with the relevant enforcement authority, such as local trading standards or the Office for Product Safety and Standards, and, for specific sectors, a dedicated regulator.

See also: regulatory investigation, corrective statement

Ransomware

Malicious software that encrypts an organisation's data or systems until a ransom is paid, typically demanded in cryptocurrency, and often accompanied by a threat to publish stolen data even if the ransom is paid.

Board note: Whether to pay a ransom is a decision with legal, insurance and reputational dimensions well beyond the immediate operational disruption.

See also: cyber incident, data breach

Requisition of a general meeting

A formal request by shareholders, made under section 303 of the Companies Act 2006, requiring the directors of a company to call a general meeting, available to members holding at least 5% of the paid-up voting share capital, or, in a company without a share capital, to members representing at least 5% of the total voting rights.

Board note: Because the threshold is low, a requisition is a realistic tool for a relatively small activist shareholding to force a public vote and a public airing of an issue, not only for a majority shareholder.

See also: activist investor

Short seller report

A published report by an investor who has taken a short position in a company's shares, meaning they profit if the share price falls, setting out the case that the shares are overvalued, sometimes on the basis of allegations of accounting or governance problems, and released publicly to influence the share price as well as to inform other investors.

Board note: The author's financial interest in a falling share price is disclosed in the report itself, and does not by itself make the allegations true or false.

See also: activist investor, defamation (including the serious harm test)

Board oversight of reputation

The board's role in setting the organisation's risk appetite for reputational matters, satisfying itself that reputational risk is properly identified and managed, and receiving enough information, including from corporate affairs and investor relations, to do so. It is distinct from the operational task of managing reputation day to day, which sits with management.

See also: reputational risk, risk register (reputational entries), corporate affairs

Corporate affairs

The function, whether a dedicated department or a role combined with other responsibilities, responsible for managing an organisation's relationships with the stakeholders that shape its reputation and licence to operate, including government, regulators, media and the wider public, as distinct from investor relations, which is normally responsible specifically for shareholders and analysts.

See also: investor relations, board oversight of reputation, stakeholder engagement

Corrective statement

A public statement issued by an organisation, a publisher, or a regulator to correct a specific factual inaccuracy in an earlier statement or piece of coverage, as distinct from an apology, which addresses the harm caused rather than only the accuracy of the record.

See also: apology and admission of liability (Compensation Act 2006, section 2), right of reply, IPSO

Disclosure committee

A committee, typically including senior finance, legal, investor relations and company secretarial staff, established by a listed company to decide whether specific information amounts to inside information requiring disclosure under UK MAR, and if so, whether disclosure can properly be delayed.

See also: inside information and disclosure under UK MAR (Article 17), RNS announcement, materiality

Investor relations

The function responsible for an organisation's ongoing communication with its shareholders, prospective investors and analysts, including results announcements and other market disclosure, as distinct from corporate affairs, which covers the wider range of non-investor stakeholders.

See also: corporate affairs, disclosure committee, RNS announcement

Lessons learned

The specific findings, drawn from a post-crisis review, identifying the changes needed to an organisation's systems, plans or decisions as a result of how an incident was handled, as distinct from the review itself, which is the process that produces them.

See also: post-crisis review, root cause analysis

Post-crisis review

A structured examination, carried out after an incident has been resolved or has moved past its acute phase, of what happened, how the organisation responded, and what worked and did not, used to produce lessons learned rather than to apportion blame.

See also: lessons learned, root cause analysis

Reputation recovery

The process by which an organisation's standing with its stakeholders returns toward, or beyond, the level it held before a reputational event, typically measured over months or years rather than weeks, and generally understood to depend on sustained, consistent conduct rather than on communication alone.

See also: trust (as measured, for example through trust surveys), reputational resilience

Reputational resilience

An organisation's capacity to withstand a reputational shock without lasting damage to its standing with stakeholders, built through factors such as an existing reservoir of trust, a demonstrated record of behaving consistently with its stated values, and preparedness such as a tested crisis plan, rather than through communications activity carried out at the time of the event itself.

See also: reputational risk, reputation recovery, crisis plan or playbook

Root cause analysis

A structured method, used in a post-crisis review, of tracing an incident back through the chain of decisions, systems and failures that led to it, so as to identify the underlying cause rather than stopping at the most immediate or visible one.

See also: post-crisis review, lessons learned

Stakeholder engagement

Ongoing, two-way communication between an organisation and the stakeholders identified through stakeholder mapping, conducted as a continuing part of how the organisation operates rather than only when a crisis requires it.

See also: stakeholder mapping, stakeholder briefing, corporate affairs

Trust (as measured, for example through trust surveys)

The confidence stakeholders have that an organisation will behave as it says it will, increasingly tracked using structured surveys that ask panels of the public, customers or other groups to rate specific organisations, sectors or institutions, rather than relying only on media coverage or share price as a proxy for how an organisation is regarded.

Board note: Because trust surveys measure perception rather than an organisation's own view of its conduct, a gap between the two gives a board a specific, evidenced question to put to management, rather than a general impression to argue about.

See also: reputation recovery, board oversight of reputation