So where does a company’s reputation fit in its risk framework which comprises risk strategy and risk appetite, risk management policies and procedures, and that the culture and behaviours that support it? David Butler argues that organisations’ reputation risk doesn’t appear on board agendas often enough, nor does it get proactive attention from boards. As a result, it is usually too late into a crisis situation that the board gets involved. He discusses the issues and suggests what needs to be done.