CRE-430 · Lesson 2 of 12 · 27 min
Sources of reputational risk
Reputational crises rarely come out of nowhere. Most grow from a small number of recurring sources: old content that no longer meets current standards, partnerships with brands or people who later become controversial, products that fail, false or misleading information, the creator's own conduct, the conduct of team members, and increasingly, impersonation and synthetic media. This lesson maps those sources, explains how each tends to unfold, and introduces the risk register, a simple tool for ranking risks so you can spend prevention effort where it matters most.
Old content
A creator who has been publishing for five or ten years has an archive of thousands of videos, streams, posts and comments. Some of that material was made when the creator was younger, when community norms were different, or in a joking context that does not survive being clipped. Old content becomes a risk when someone finds it, extracts a short piece and shares it with a new audience that sees only the clip.
Old content risks are predictable because the material already exists. That makes them some of the most preventable risks a creator faces. Lesson 3 covers how to audit an archive systematically, decide what to keep, edit, contextualize or remove, and document those decisions.
Partnerships and associations
Every sponsorship, collaboration and appearance links a creator's reputation to someone else. If a sponsor turns out to sell a dangerous product, a collaborator is accused of misconduct, or an event a creator promoted goes badly wrong, audiences may ask what the creator knew and why they endorsed it.
- Sponsors: product safety problems, misleading claims, unethical labour practices or scams.
- Collaborators: other creators whose past or future conduct becomes controversial.
- Platforms and networks: agencies, multi-channel networks or marketplaces that treat creators or fans badly.
- Events and causes: fundraisers, meetups or causes that turn out to be mismanaged or fraudulent.
Partnership risk cannot be eliminated, because nobody can predict every future event. It can be reduced through due diligence before agreeing to work with someone, contracts that allow ending a relationship if a partner's conduct becomes harmful, and clear public communication when a partnership ends for reputational reasons.
Product and service failures
Creators increasingly sell their own products: merchandise, courses, physical goods, apps and subscription services. When a product is late, poor quality, unsafe or not as described, the creator's reputation takes the hit directly. Product failures are especially damaging because they involve money and broken promises. Pre-orders that ship months late, courses that do not match their marketing, and limited editions that are quietly restocked all feel like breaches of trust to buyers.
Product failures also bring legal exposure, including consumer protection rules about refunds, delivery dates and product safety. CRE-302 and CRE-330 cover the business side of products; this course focuses on the reputational response when something goes wrong.
Misinformation and errors
Creators who explain news, science, health, finance or history can spread false information, sometimes by accident and sometimes through careless sourcing. A widely shared error can damage a creator's credibility with experts and audiences, and in sensitive areas such as health or finance it can harm viewers. Creators can also become targets of misinformation: false claims about what they said or did, misattributed quotes or edited clips that change the meaning of what happened.
Personal conduct
The creator's own behaviour, on and off camera, is the largest source of serious crises. Examples include cruel or discriminatory remarks, treating fans or staff badly, dangerous stunts, legal problems, dishonest behaviour such as faking content, and conduct in private life that later becomes public. Livestreams carry extra risk because there is no editing: a moment of anger, a careless joke or an offensive comment can be captured and shared instantly.
Personal conduct risks are the hardest to manage with processes, because they depend on judgment and character. The most effective protections are a clear set of personal values, trusted people who can give honest feedback, and avoiding situations where judgment is impaired, such as streaming while exhausted or intoxicated.
Team member conduct
As creators grow, editors, managers, moderators, assistants and on-camera collaborators act on their behalf. A moderator who abuses fans in a Discord server, an editor who inserts offensive content, or a manager who mistreats brand contacts can all damage the creator's reputation. Audiences generally hold the creator responsible for the people they hire and the culture they build, especially if problems were reported and ignored.
Impersonation, deepfakes and hacked accounts
Synthetic media and account takeovers create risks that do not depend on anything the creator actually did. Scammers use deepfake videos or cloned voices of popular creators to promote fake giveaways, cryptocurrency schemes or products. Hackers take over channels to run scam livestreams. Fake accounts impersonate creators to solicit money from fans. These incidents can damage trust if audiences lose money and blame the creator, even though the creator was also a victim. CRE-410 covers synthetic media in depth; lesson 9 of this course covers account recovery.
The risk register
A risk register is a table that lists risks, rates each one for likelihood and impact, and records the controls you will use. It turns a vague sense of worry into a ranked list. For a solo creator, a simple version with a dozen rows is enough; a creator company might maintain a more detailed register reviewed quarterly.
The most common scoring method multiplies likelihood by impact, each rated on a scale of 1 to 5. A risk that is very likely but trivial and a risk that is rare but catastrophic can both score in the middle, so it is worth looking at the individual ratings as well as the product.
| Rating | Likelihood | Impact |
|---|---|---|
| 1 | Rare: unlikely in the next few years | Minor: a few critical comments |
| 2 | Unlikely: could happen, but not expected | Limited: short dip in engagement |
| 3 | Possible: might happen this year | Moderate: a sponsor pauses, media notice |
| 4 | Likely: probably happens this year | Major: sponsors leave, large income loss |
| 5 | Almost certain: expected soon | Severe: lasting damage, legal action, platform removal |
Worked problem
Scoring a risk register
A gaming creator lists four risks. Old stream clips with offensive jokes: likelihood 4, impact 4. A sponsor's product recall: likelihood 2, impact 3. A moderator abusing fans in Discord: likelihood 3, impact 3. A deepfake scam using the creator's face: likelihood 3, impact 2. Rank the risks by score.
Show solution
- Old clips: 4 × 4 = 16.
- Moderator conduct: 3 × 3 = 9.
- Sponsor recall: 2 × 3 = 6.
- Deepfake scam: 3 × 2 = 6.
- Order: old clips (16), moderator conduct (9), then the recall and deepfake risks tied at 6.
Answer: The old stream clips are the top priority, so an archive audit should come first. Moderator training and clear moderation policies come next. The tied risks need lighter controls: sponsor due diligence, and a pinned post telling fans that the creator never runs crypto giveaways.
Controls and owners
For each risk, the register records the controls that reduce likelihood or impact, and who owns them. Controls fall into four broad types.
- Avoid: stop the activity entirely, such as declining sponsorships in high-risk categories.
- Reduce: lower likelihood or impact, such as auditing old content or training moderators.
- Transfer: shift some impact to others, such as insurance or contract clauses.
- Accept: knowingly live with a small risk and prepare a response if it happens.
Ownership matters even in small teams. If everyone assumes someone else is checking a sponsor's background, nobody checks. Assign each control to a named person with a review date.
| Risk | Score | Control | Owner | Review |
|---|---|---|---|---|
| Offensive old clips | 16 | Archive audit and documented decisions | Creator | Within 2 months |
| Moderator conduct | 9 | Written moderation policy, training, escalation path | Community manager | Quarterly |
| Sponsor recall | 6 | Due diligence checklist, termination clause | Manager | Each new deal |
| Deepfake scam | 6 | Pinned anti-scam post, reporting templates | Creator | Every 6 months |
Emerging and changing risks
Risk registers go stale. New platforms, new types of content, new sponsors and changing social norms all create new risks. Review the register at least twice a year and whenever the business changes significantly, for example when launching a product, hiring staff, moving into a new niche or entering a new country. Also review it after any incident, including near misses that did not become public, because they reveal weaknesses in controls.
Risk appetite
Not every creator should manage risk the same way. Risk appetite is the amount and type of risk a creator is willing to accept in pursuit of their goals. A satirical comedy channel accepts more risk of offending people than a children's education channel, because edgy humour is central to its value. An investigative channel that exposes scams accepts more legal risk than a craft channel. Neither approach is wrong; what matters is that the creator chooses deliberately and builds controls that fit.
A simple way to express risk appetite is to write a few sentences about what you will and will not do. For example: we will criticize companies and public figures when we can document our claims, but we will not make claims about private individuals; we will take sponsorships from tools and hardware brands, but not from financial products or supplements; we will livestream, but not while overtired or after drinking. These statements guide decisions long before a crisis.
Partner and audience changes
Risk also changes when the audience changes. A creator whose audience shifts younger takes on new responsibilities around content suitability and advertising to children. A creator who goes viral in another country may find that jokes, references or partnerships carry different meanings there. A creator who moves into a new niche, such as from gaming into personal finance, enters a regulated area with new legal risks. Each of these shifts should prompt a fresh look at the risk register.
Worked problem
Updating a register after a niche change
A lifestyle creator begins posting investment content. They add two risks: misleading financial claims (likelihood 3, impact 5) and promoting an unregistered investment product (likelihood 2, impact 5). Their previous top risk was an old video with insensitive jokes, scored 12. How do the new risks rank?
Show solution
- Misleading financial claims: 3 × 5 = 15.
- Unregistered product promotion: 2 × 5 = 10.
- Old video: 12.
- New order: misleading claims (15), old video (12), unregistered product (10).
Answer: The niche change creates a new top risk. The creator should add controls such as source checking, clear disclaimers, and a rule against promoting products that are not properly registered, and should read the finance lessons in CRE-420.
Near misses deserve a place in the register too. If a sponsor nearly slipped a misleading claim into a script, or a moderator came close to banning a long-time member unfairly, record what happened and what control caught it. Near misses show which controls are working and which are relying on luck.
Common mistakes
MistakeTreating crises as unpredictable bad luck.
InsteadMap the recurring sources of risk and address the predictable ones first.
MistakeScoring risks once and never revisiting them.
InsteadReview the register at least twice a year and after any incident or major change.
MistakeRanking only by the multiplied score.
InsteadAlso look at individual ratings, because rare but catastrophic risks need specific plans.
MistakeLeaving controls without owners.
InsteadAssign every control to a named person with a review date.
MistakeIgnoring risks created by team members and partners.
InsteadInclude collaborators, staff, moderators and sponsors in the register.
Summary and key terms
- Most reputational crises come from a few recurring sources: old content, partnerships, products, misinformation, personal and team conduct, and impersonation.
- Old content is highly preventable because it already exists and can be audited.
- Partnerships link a creator's reputation to others, so due diligence and exit clauses matter.
- Personal conduct, especially on livestreams, is the largest source of serious crises.
- Audiences hold creators responsible for their team members and the culture they build.
- A risk register ranks risks by likelihood × impact and records controls and owners.
- Controls can avoid, reduce, transfer or accept a risk, and registers need regular review.
- Risk register
- A table listing risks, their likelihood and impact ratings, controls and owners.
- Likelihood
- How probable it is that a risk will occur in a given period.
- Impact
- How severe the consequences would be if a risk occurred.
- Risk score
- Likelihood multiplied by impact, used to rank risks.
- Heat map
- A grid that plots risks by likelihood and impact, shaded by severity.
- Control
- An action that reduces a risk's likelihood or impact.
- Risk owner
- The person responsible for managing a specific risk or control.
- Due diligence
- Research done before entering a relationship to identify problems.
- Impersonation
- Pretending to be a creator, often to scam their audience.
- Near miss
- An incident that could have caused harm but did not, useful for improving controls.
Practice problems
Work each problem on paper first, then reveal the answer to check.
List the seven common sources of reputational risk.
Show answer
Old content, partnerships, products, misinformation, personal conduct, team conduct, impersonation.
Why is old content one of the most preventable risks?
Show answer
It already exists and can be audited before anyone else finds it.
Score a risk with likelihood 3 and impact 5.
Show answer
15.
Name the four types of control.
Show answer
Avoid, reduce, transfer and accept.
Give an example of transferring a risk.
Show answer
Insurance, or a contract clause that shifts some impact to a partner.
Why do livestreams carry extra conduct risk?
Show answer
There is no editing, so mistakes are captured and shared instantly.
When should a risk register be reviewed?
Show answer
At least twice a year and after incidents or major business changes.
Why look at individual ratings, not just the score?
Show answer
Rare but catastrophic risks can score in the middle yet need specific plans.
How can a creator reduce deepfake scam harm?
Show answer
Pin a post saying they never run such giveaways and report impersonators quickly.
Why assign a named owner to each control?
Show answer
So responsibility is clear and the control is actually carried out.
Lesson quiz · 5 questions
Score 60% or more to complete this lesson.
Create a free account to save your progress, take quizzes and earn a certificate.