Reputation is not a conscience

By Tim Sutton, senior reputational adviser · October 2026

Twenty years to build a reputation, five minutes to ruin it. You have seen the sentence on a slide with Warren Buffett’s name underneath. I may have put it on slides myself.

He did not coin it. In June the Quote Investigator website traced the saying to a Texas newspaper, the San Antonio Daily Express, of 9 June 1891: “it takes years to build up a good reputation which may be destroyed in five minutes.” Nor could the site find a speech, an interview or an essay by Buffett that contains it. The best evidence that he ever said it is his son Howard, who told USA Today in 1991 about a car journey he had taken with his father at the age of eleven. “We were driving down the street, and he said, ‘It takes 20 years to build a reputation and five minutes to ruin it.’”

So the version at the top of a thousand risk registers began as something a father said to his son in a car, in the mid-1960s, about a person’s good name.

Boards have taken it as a law of corporate life. Aon’s survey of risk managers ranked damage to reputation as the number one risk to business in 2007, in 2015 and again in 2017 (it has since slipped to eighth). When Deloitte asked more than 300 executives in 2014, 87 per cent rated reputation risk as more important than the other strategic risks they faced.

Twenty years and five minutes was advice to a boy of eleven. It was good advice for a boy.

What I left out in August

In August I wrote here that reputation is priced twice: once when somebody buys it, and once when the world writes it down. On the second of those days, I said, the market, the regulator and the media reprice in hours what a board has declined to examine for years.

I did not ask who does the repricing, or whether they turn up for every kind of wrong. I assumed they did, which is Buffett’s sentence in other clothes. The answer was in that essay all along. I had listed “the patience of customers who could leave” among the things a company stands to lose, and never noticed that the people who do the repricing are the ones who can leave.

Economists have been measuring exactly this since the 1980s. What they found has changed how I sort a crisis, and it is not what someone who sells advice on reputation is expected to tell you.

Who gets punished

The method is simple. When news of a company’s wrongdoing breaks, measure how far the share price falls. Then add up what the wrong will cost in law: the fines, the settlements, the clean-up. If the fall is bigger than the legal bill, the difference is read as the market’s estimate of the business the firm will now lose because customers, suppliers and lenders trust it less. That is the reputational penalty: the five minutes, measured in money.

Start with lying to investors. Jonathan Karpoff of the University of Washington and two colleagues studied 585 firms pursued by the Securities and Exchange Commission for misstating their accounts between 1978 and 2002. On average the firms lost 38 per cent of their market value when the news came out. Fines and settlements explained a sliver of it. The reputational penalty was more than seven and a half times all the legal penalties put together.

Cheating customers looks much the same. John Armour, Colin Mayer and Andrea Polo examined firms sanctioned by the Financial Services Authority and the London Stock Exchange between 2001 and 2011. The reputational loss was nearly nine times the fine, and it arose where the wrong had been done to the firm’s own customers or investors.

And who does not

Now the surprise. In the same study, where the wrong was done to third parties (the state, the investors of other companies, the victims of money laundering), the share price did not fall. It rose a fraction, by too little to mean anything.

Those were fourteen cases, and the bystanders were financial. Pollution has been tested directly, and at scale. Karpoff, with John Lott and Eric Wehrly, looked at 478 breaches of environmental law by listed companies between 1980 and 2000. The firms lost market value. But the loss was about the size of the fines and the clean-up, and no larger. The market added nothing of its own. In 2019 the study was repeated, then run again on newer cases, with the same result.

Bribery makes the point almost too neatly, though one half of it rests on thirteen companies. Firms caught paying bribes abroad, and nothing more, lost 2.6 per cent of their value. Firms caught paying bribes and also charged with fraud lost 33 per cent. The bribe went to somebody else’s official. The fraud was practised on the firm’s own shareholders.

Karpoff has spent a career on this, and his summary fits in a sentence: “Reputational losses do not accrue when the harmed parties do not have ongoing business relationships with the firm.” His illustration is an electroplating company that tips its chemicals into a storm drain. The fishermen downstream are harmed. But the fishermen buy no electroplating.

This is easy to hear wrongly, so let me be exact. Harm to bystanders is punished. The law punishes it, sometimes heavily. The finding is that the market adds no punishment of its own.

Twenty contracts in a day

None of this would have surprised Adam Smith. In the 1760s he told his students in Glasgow (the lectures survive in a student’s notes) that the Dutch, being the most commercial nation in Europe, were also the most faithful to their word. “A dealer is afraid of losing his character, and is scrupulous in observing every engagement. When a person makes perhaps twenty contracts in a day, he cannot gain so much by endeavouring to impose on his neighbours, as the very appearance of a cheat would make him lose.”

That passage is quoted often, by people who want to say that commerce civilises. The sentence after it is quoted less. “When people seldom deal with one another, we find that they are somewhat disposed to cheat, because they can gain more by a smart trick than they can lose by the injury which it does their character.”

There is the whole theory, two centuries before the data. A reputation is the memory of the people who trade with you. They keep it, it records what you did to them, and it bites because they can stop trading. It protects the people at the table for the plain reason that they can leave the table. The fishermen were never at it. A boy of eleven deals with the same people every day. For him the whole world is at the table, which is why the advice was good.

The cases, sorted

Run the famous cases through this and they sort themselves into piles.

The first pile is firms that had nothing to sell but their word, and were caught breaking it. Arthur Andersen employed 28,000 people in the United States before Enron. It was convicted of obstructing justice in June 2002, and by the time the Supreme Court overturned the conviction, in May 2005, it had about 200. The conviction was gone and the firm stayed dead, because its clients had not waited for the appeal. Bell Pottinger was expelled by its trade body in the first week of September 2017 and was in administration by the 12th. The wrong was done to people in South Africa who had never hired it; what finished it was that the clients who had hired it could no longer be seen in its company.

That second case matters. It looks like harm to bystanders proving fatal. But to be Bell Pottinger’s client had become an injury in itself, so the injured party was now at the table, and the table emptied.

The second pile has one man in it. Gerald Ratner broke no law. In April 1991 he stood up at the Institute of Directors’ convention in the Albert Hall and told the audience what he thought of the things his shops sold. An estimated £500 million was wiped off the value of the company, he was out within eighteen months, and the Ratner name was later taken off it. He had insulted his customers to their faces.

The awkward pile

The third pile is the awkward one: firms that harmed bystanders and kept their customers. Volkswagen’s shares lost almost a fifth of their value on Monday 21 September 2015, three days after American regulators accused it of cheating on diesel emissions tests. By March 2020 the cost, by its own account, had reached €31.3 billion. Its own customers had been misled as well, and they came back, because the lie was about the air and not about the car. In 2016 it sold 10.3 million vehicles and overtook Toyota as the largest carmaker in the world, which is an unusual way to be ruined. BP put the cost of Deepwater Horizon at about $65 billion and is still BP. And Facebook. When the Cambridge Analytica story broke in March 2018 its shares fell sharply, as the market priced the chance that users would leave and advertisers follow. Within eight weeks they had recovered the whole loss. They fell again that July, by almost a fifth in a day, when the company reported slowing growth, some of it put down to Europe’s new privacy law. A year later the Federal Trade Commission’s $5 billion penalty was reported. Investors had been told to expect it, and the shares rose. The people whose privacy had been abused were users. The customers are advertisers.

Look again at that pile and notice who did the punishing. The thirty-one billion euros and the sixty-five billion dollars went on fines, settlements, compensation and clean-up: bills presented by prosecutors, regulators, courts and claimants. The market’s part was to work out how big the bills would be.

A fourth pile needs only a sentence. A household in England cannot change its water company, so reputation has no way to act there at all, which is why the regulator carries the whole load.

Where the rule bends

Some of you know the exceptions, and one of them is mine.

In 1995 I was on the wrong end of Brent Spar, when German motorists punished Shell at the pump for what they took to be a harm to the sea: it worked because petrol is the easiest product in the world to buy from somebody else, and it lasted a matter of weeks. Bud Light in 2023 looks like another exception. Sales were about 28 per cent lower for three months and 32 per cent lower in the last quarter of the year. But those drinkers believed the affront was to them, which is the rule at work.

Boycotts in general do their damage through the press more than through the till. Brayden King of Northwestern found that a boycotted company’s share price fell by nearly one per cent for each day the boycott was in the national papers. After the Exxon Valdez people cut up their Exxon cards. Karpoff’s reading of the data, cards included, is that the reputational loss from harming the environment is on average negligible.

Then there is what all these studies measure. A share price records what investors expect customers, courts and regulators to do. It does not record what the public thinks. A company can be despised and unpunished; esteem and consequence are separate measurements, as I argued about sentiment scores last month. The sentence on the slide is a claim about consequence. Five minutes to ruin it, not five minutes to be thought less of.

The newer evidence complicates the rule a little. Studies of what is now called ESG news find that bad news moves a share price by about a tenth of one per cent, and that investors react only to what they expect to reach the accounts. One study finds that markets under-react, and that companies with a record of such incidents do worse later. So the cost of harming bystanders may arrive slowly rather than never. And China looks like a real exception: fines for pollution there are small, and two recent studies find that share prices fall anyway, though one calls the fall “surprisingly strong” and the other finds “a small magnitude”.

The rule is also narrower than it sounds. A data breach harms customers directly, and on average the share price barely moves. A wronged customer is not enough: the penalty needs customers who notice, who mind, and who have somewhere else to go. For this purpose a customer who cannot leave, or does not notice, or does not mind, is a bystander.

What a board should do with this

Sort the risk register by who is harmed. Most are sorted by how bad the headline would be.

The five-minute crisis is real. It is the one that tells your customers, your investors or your own people that they are next. If what you sell is judgement or trust (an audit, a legal opinion, advice like mine), it is the only kind of crisis you have, and the sentence on the slide is true of you without qualification.

Harm to people who cannot punish you belongs elsewhere on the register, and not with the press office. It is a legal and political risk on a long fuse. Public anger is real, and it matters, because it is what regulators, juries and select committees are made of. But it reaches a company as law, and late. The bill comes years later, from a court, a regulator or a planning inquiry, and the market’s shrug on the day says nothing about its size: BP’s came to about $65 billion.

I have written here about tobacco, ultra-processed food and the water that data centres use without quite seeing what they shared. In each, the people harmed were bystanders in the sense that matters: hooked, so they could not leave; unaware, so they did not notice; or never customers at all. So the punishing fell to someone with the power to compel, and it came late.

That is why any comfort in this evidence is false comfort. A board that reads it as a licence has misread who sends the invoice, and when. The bill arrives, as a rule, on a later board’s watch, which is the only reason the licence ever looked like one.

In the first hour of a crisis I would now ask three questions before any other. Who was harmed? Can they leave? And will the people who can leave conclude that they are next, or that they can no longer be seen with you?

What reputation was never built to do

There is a passage in Smith’s Theory of Moral Sentiments that draws the line I have been circling. “Man naturally desires, not only to be loved, but to be lovely; or to be that thing which is the natural and proper object of love.” And a little further on: “He desires, not only praise, but praiseworthiness; or to be that thing which, though it should be praised by nobody, is, however, the natural and proper object of praise.”

Reputation is praise: other people’s memory of you, kept by the people you deal with. Conscience is the wish to deserve it, whether or not anybody is keeping score. A person can have that. A company has it only when the people inside supply it. Where they do not, the law has to keep the score for them.

We have asked reputation to do a conscience’s work and then been surprised when the share price recovered.

Reputation keeps the promises you made to people who can leave.

Everyone else needs a law.

First published in The Sutton Memo on Substack on 3 October 2026. New essays go out by email weeks before they appear here: subscribe free.

If you are weighing how hard to fight a regulator, that is the subject of settle or fight: the decision that sets a regulator-driven crisis.

Speak with Tim in confidence

or email tim@timsuttonpr.com

Tim Sutton is a senior reputational adviser to boards in their hardest moments and counsel to PR-agency principals on one side of any given transaction. timsuttonpr.com · LinkedIn · Privacy · Legal