(Originally published at Toomre.com)

Nick Barcia has written about the 3 Ms of Risk Management – Monitor, Measure and Manage. In financial services companies, measuring some types of risk is fairly straight forward. How many S&P equivalents are you long or short? Where is your risk on the interest rate curve, or in foreign currencies?

Other types of risk are harder to quantify. How do you quantify operational risk, or perhaps even more difficult, reputational risk?

Reputational risk can be viewed as the risk that a company’s reputation, its corporate goodwill, and so on can be diminished, or perhaps even enhanced. It falls into the area of public relations and marketing which often seems a little too murky and fuzzy for good quantitative risk managers. Yet it is an important area that is becoming even more important as laws and technology changes.

Good market research can help quantify some of the effects of public relations and marketing. Companies have often hired market research firms to test concepts, to provide some sort of quantifiable measure of how successful a marketing program is likely to be. In a recent discussion with Jim Taylor, Vice Chairman of the Harrison Group, a high-end strategic market research firm, he noted that one of the results of Sarbanes Oxley is that marketing programs now require more due diligence and more accountability.

On top of this, the increased connectivity that the Internet provides can greatly amplify marketing successes or failures. The example of Sony’s DRM fiasco, which was widely discussed in the Blogosphere provides an example of how things can spiral out of control.

On the other hand, Robert Scoble’s blogging for Microsoft is widely perceived as having helped that companies image as has Bob Lutz’s blog at GM.

David Weinberg, at the Berkman Center for Internet & Society at Harvard Law School opines, “CEOs don't blog as much because, generally, they are more convinced that being in total control is a good thing… Companies still too often see blogs primarily in terms of risk”.

I suspect that David is right about why CEOs don’t blog more. However, as we try to get people to understand here, risk is not a bad thing. Too much risk, or too little risk can be bad, but risk, in and of itself is not bad. As the old example goes, you can reduce your risk of getting hit by a bus by never leaving your house. However, that probably won’t improve the quality of your life. Likewise, a company may be taking on more risk by blogging, but that risk could have a very positive effect on the reputation of the company.

It gets back to monitoring, measuring and managing risk.

How, then, does a company manage the risk that it takes by blogging or not blogging? It would seem as if concept testing of blog entries might be a particularly good idea. I can visualize David cringing as he reads this. In the same article, he is quoted as saying "Many corporations are afraid of weblogs because they're afraid of the sound of the human voice,…But that voice -- the unfiltered sound of an actual person -- is actually the most important way of connecting with customers and partners."

Would concept testing of blog entries destroy or at least hide the human voice? Perhaps. Perhaps it would reveal to the researchers that the human voice is in fact ‘the most important way of connecting with customers’. Or, it might prove otherwise.

Companies need to monitor, measure and manage their risk. By failing to step into the blogosphere companies are missing an opportunity to better understand and manage their reputational risk.