Managing the Ever-Changing Risk of Social Media

April 17, 2013

Gayle Mitcham
Marsh Canada

Social media has emerged as a prominent stage for interaction. More and more,
organizations are transforming their online presence to engage stakeholders. Many
educational institutions also leverage social media platforms to connect with the public
and students. Potential students can engage with an institution and its current students
through interactive websites, virtual tours, and online communities, such as Facebook,
Twitter, and YouTube. The downside is that institutions may underestimate the potential
negative consequences associated with these initiatives; giving rise to poor
management of the related risks. As social media continues to evolve, these threats are
becoming more common and far reaching.

Identifying risks and inherent issues of social media are the critical first steps.
There are very few barriers to restrict publication via the internet and social media.
Negative publicity can quickly “go viral” and impact an institution’s reputation in real time.
The result is an entirely new set of risk exposures, which should be identified and
actively managed. Some common threats include:

• Privacy Concerns— Inappropriate use of social media can result in widespread distribution of confidential information.  An institution may also be in breach of privacylaws if social media is employed for background checks of staff or students.
• Defamation — Improper postings can lead to lawsuits related to libel, slander, reputational damage, or emotional distress.
• Errors and Omissions — Social media platforms may quickly spread contextual errors and omissions, which can be extremely costly to correct.
• Intellectual Property Infringement — The use of third-party copyrighted material and trademarks can result in significant damages.
• Unauthorized Employees and Third Parties — Third parties and unauthorized employees may create social media posts that appear to be sanctioned by an institution and can cause damage to an institution’s credibility. Also, third parties may simply share content harmful to an institution’s reputation. For example, the most popular videos on YouTube related to the Montréal Protests are all in support of student protestors.Each new platform is comprised of different functions and features. Institutions should consider the unique hazards and challenges of each trending network. Some popular networks and their considerations include:
• LinkedIn is a business-oriented social networking site with members ranging from students to Fortune 500 company executives. Institutions must consider the risks associated with submitting or referring to online recommendations for past, present, and future staff and students.
• Facebook is a social network that a tremendous number of students access daily. Users determine their own privacy settings, which can spark privacy concerns. The  site may also facilitate the misuse of intellectual property, college affiliations, and logos.
• Twitter is a microblogging service, which promotes free speech. It enables anyone to instantly share breaking news. There is an inherent risk that information will be shared before an institution has time to react, respond, or verify the content. Character limits also restrict information and disclaimers. As a consequence, posts (also known as “tweets”) may be taken out of context or misunderstood.

Be proactive with the management of identified social media risks.

All of the identified potential risk exposures can damage a university or college’s
credibility and are costly to correct after the fact. Proactive solutions limit exposures and
the costs associated with any post-incident response. A few essential strategies include:
1. Monitor social media for warnings. The real time nature of social media can
provide institutions with warning signs of looming risks, crises, unrest, and potential
reputational damage. An example is the use of social media by students involved in
Montréal protests.
2. Consider all departments, business areas, and stakeholders. It is not only the
communications department that needs to address social media. IT, human
resources, recruitment, admissions, teachers, and the student body may all be
affected by social media as these networks continue to evolve and grow.
3. Establish strong passwords and network security. A safe network not only
prevents hackers from taking over an institution’s online identity, but also protects the
computer network and sensitive information.
4. Register key trademarks, usernames, and vanity URLs on existing and
emerging social media platforms. Being proactive with registration limits the risk of
imposters and false representation.
5. Ensure policies are current and address emerging applications. Institutions
should address the opportunities and threats of emerging features. Currently, staff
and students can “check in” to locations on Facebook, instantly share photographs
from school functions on Flickr, and write recommendations for students and peers
on LinkedIn. Institutions must decide if it is appropriate to leverage new and existing
features or limit and discourage their use.
6. Look out for the next big trend and be ready to adapt. New social media
applications and enhancements are created daily. As the environment changes, so
too do the opportunities and exposures; as such, strategies and risk mitigation
techniques must also change. For instance, institutions in the UK had to adapt to
online communities like Student Room and YouGo which popped up to target
students.
7. Stay up to date with regulations. Be aware of how current and emerging privacy,
human rights, and labour relations legislation relate to social media and revise
policies and operating procedures accordingly. For example, online background
checks may violate federal discrimination or privacy laws.
8. Make sure company policies are aligned. An institution may have multiple policies
that relate to the internet and social media. Policies should take a consistent and
integrated approach to managing social media risks. It is advisable to review
employee and student handbooks for consistency including ethics, media, human
resources, legal, asset use, computer use, and harassment policies.
9. Train staff members who have social media responsibilities. Individuals
responsible for monitoring and posting external communications are subject to the
same laws regarding defamation and intellectual property rights as any other
broadcaster of content. Be sure these individuals have a solid understanding of their
responsibilities.
10. Decide how to monitor and control your online presence. If there is usergenerated
content on your website, consider whether to apply pre- or postmoderation
to content. If content is screened before it is uploaded, this can be
perceived as assuming editorial responsibility, which can potentially be more
onerous in the event of a claim. Also, establish a clear takedown policy to respond to
complaints that ideally includes immediate removal of contentious content.
11. Leverage filtering systems as appropriate. Consider including copyright
disclaimers for independent users uploading content. If you have chosen to conduct
post-moderation, be sure to create appropriate filters to flag keywords.
12. Think about the institution’s geographical footprint. Keep in mind that even
though targeted students may reside in one territory, the internet does not adhere to
international boundaries. Content is global, so be mindful of international exposures.
13. Conduct a risk assessment. Assess the risk of negative postings and their potential
impact on the institution. Identifying your specific risks allows for proactive risk
management solutions and appropriate crisis management plans to be implemented.
14. Manage your reputational risk. An essential first step in managing reputation is
building an accurate picture of an organization’s strengths and weaknesses and then
establishing a process to detect and manage the issues. Forming guidelines to
manage, protect, and improve the institution’s reputation can mitigate damage in the
event of a social media crisis.
15. Revise current crisis management plans to account for the impact of social
media. Crisis management plans must be updated to address new social media
challenges. Social media reveals information more quickly and improves the visibility
of stakeholders, which decreases the time available for an institution to respond.
Plans should acknowledge the role these platforms can play and factor them into
crisis communication approaches.
16. Ensure crisis management plans can respond to a social media crisis. Crisis
management is the strategic framework that guides institutions and senior leaders to
prepare for, manage, and recover from adverse events that threaten an
organization’s operations, people, strategy, valuation, reputation, and future. Even
though media storms are man made, they can still be treated as disasters. As these
events are not preventable, crisis management can mitigate immediate losses and
reduce long-term damage. It is advisable to review existing plans to ensure they are
capable of producing a swift and effective response to a social media crisis.
17. Consider implementing a Social Media Policy. A Social Media Policy is an
opportunity to outline the proper and respectful use of social media by staff and
students. It is the chance to define your institution’s attitude towards social media. A
strong policy should perform the following functions:

• Identify employees permitted to use these tools during business hours.
• Document colleagues who are allowed to speak for the institution, such as “The University believes…”. These individuals ought to be appropriately trained.
• Define which posts and statements require approval.
• Require disclosed information to be verified and accurate.
• Classify information that is not to be disclosed publically.
• Outline the correct and incorrect uses of the institution’s trademarks, logos, and any copyright protected material.
• Describe online activities that your institution will elect to monitor.
• Display how employees and students can reference the college or university in their personal use of social media platforms.
• Specify that no one is authorized to use the internet to research a co-worker, applicant, former worker, etc.
• Ban activities that reflect or may reflect negatively on the institution, its affiliates, employees, students, or stakeholders.
• Provide resources to answer questions about the proper use of social media.
• Encourage employees to seek advice from the legal department or management as necessary (e.g., permission to respond online to comments about your institution).
• Indentify other company guidelines, policies, and codes that apply to online activities.

Even with a robust Social Media Policy and mitigation strategies, an incident may still
occur. In the event of a social media crisis, institutions can use established policies and
crisis management plans to respond swiftly and effectively to the issues. Consider also
employing independent crisis consultants, as they typically have extensive experience
and can provide 24/7 counsel to senior leaders.

Social media provides numerous opportunities for organizations to engage students and
communities. The risks stemming from the ever-evolving online environment need to be
proactively managed. The preparedness activities and strategies outlined above are only
key points to help form a strong risk management program. The best way to protect your
institution’s future is to implement effective risk management strategies and an overall
preparedness program before an incident ever occurs. Institutions should develop and
test these strategies and plans in advance, so that they are ready to handle potential
social media incidents.

Gayle Mitcham is Vice President and National Practice Leader with the Business Continuity Management Practice of Marsh Risk Consulting (MRC). MRC is the professional services arm of Marsh Canada Limited, providing innovative and customized solutions focused on to all types of organizations’ through more than 800 risk and consulting experts worldwide. If you have questions about this article, or would like a quote from Marsh to provide assistance with your program, Gayle can be reached at 416 868 2748 or at gayle.mitcham@marsh.com

This document is not intended to be taken as advice regarding any individual situation and should not be relied upon as such. The information contained herein is based on sources we believe  reliable, but we make no representation or warranty as to its accuracy. Marsh shall have no obligation to update this publication and shall have no liability to you or any other party arising out of this publication or any matter contained herein. Marsh is one of the Marsh & McLennan Companies, together with Guy Carpenter, Mercer, and Oliver Wyman.