United Airlines: A Lesson for Internal Auditors on the Risks of Social Media

The past several weeks will rank among the worst periods ever in which global companies inflicted damage on their brands with clumsy operational, marketing, public relations, and social media actions. Uber, Pepsi, Delta Airlines, and United Airlines have all felt the wrath of consumers, media, and investors as a result of perceived foolish mistakes from the operational front lines to the C-suite. If there are lessons to be drawn by internal auditors, perhaps the best case study is United Airlines.

The world has watched in fascination at the rapid deterioration of the airline’s brand after video of one of its passengers being forcefully removed from an overbooked flight went viral. Just days after the video was posted on multiple social media platforms, United’s reputation plummeted to a 10-year low, according to one consumer perception research firm.

For a global airline with a sophisticated multimillion-dollar advertising and branding strategy to be so damaged by a single incident seems unfathomable, but such is the power of social media in the 21^st century.

In less than a week, scores of articles have been written on the things United did wrong and the lessons learned for marketing, legal, and public relations professionals. At one point during the week, the share value of United’s stock had plummeted more than $1 billion. But the airline is not the first — nor will it be the last — global brand to suffer extraordinary reputational damage in the wake of an operational or compliance blunder. Certainly BP, Volkswagen, and Wells Fargo suffered similar fates.

Is United’s public relations nightmare an example of an organization unprepared to deal with a social media crisis? Was the airline’s initial defensive, tone-deaf posture driven by legal concerns instead of sound public relation tactics? Was this a case of cascading control failures where one misstep led to another and another?

The likely answer is all of the above, and it should serve notice about the complexity of social media’s impact on organizations. By now, most organizations have at least a rudimentary understanding of the value and dange​r associated with social media, but I believe few are truly operating at the speed of risk on this issue.

The IIA’s Internal Audit Foundation published a book titled, Auditing Social Media: A Governance and Risk Guide. Its authors, Peter Scott and Mike Jacka, provide sound direction that helps organizations ensure they have adequate measures in place to capitalize on social media while protecting themselves from excessive risks. One of the book’s key messages is that the game has changed. Organizations and traditional broadcast media no longer control the message, consumers do. They tell the story via text, images, audio, and video content — instantly and globally.

Jacka also authored a timely piece in this month’s Internal Auditor magazine that relates directly to internal audit’s role in crisis management. Titled Resilience Through Crisis, it offers valuable information on how and why internal audit must remain proactively involved while crisis management plans are developed and implemented,​ as well as participate in post-crisis analysis.

Yet, research continues to reveal that many companies do not address social media as part of their crisis communications plans. Clearly, social media risk must be incorporated into all aspects of an organization’s risk portfolio, and management and the board must take seriously the potential for its negative impact on brand and reputation. When providing assurance on the effectiveness of social media, internal audit must assess not just the adequacy of social media policies and practices, but also how social media is incorporated into brand, reputation, and crisis communications.

It appears that United did not appreciate the depths of the crisis they were in until it was too late. It is also becoming increasingly evident that a company’s poor response to an event via social media can actually create (or exacerbate) a crisis. Given the risks that such events and response strategies can create for a company’s reputation or share value, how can this not be on internal auditors’ radars?

There is another aspect of brand and reputation risk that must be considered. When weighing the risk/reward potential of business strategies, organizations must consider how those strategies could play out on social media.

For example, the airline industry takes a calculated risk in overbooking. Airlines have developed sophisticated yield-management techniques that rely on forecasting travel demands, allocating capacity (seating), pricing, and overbooking. Based on the widespread use of overbooking, it is safe to assume the industry has weighed the potential for bad publicity against the revenue (yield) the practice generates and concluded the benefits outweigh the risks. But United’s social media disaster could feed a consumer backlash that might change that risk/benefit analysis.

If internal auditors are to truly follow the risks, there is no way to overlook the potential impact of ineffective crisis communications. Management and boards desperately need assurance that these plans are appropriately designed and ready for deployment. In this day and age, they must address the use of social media.

As always, I look forward to your comments.