Risky Business

Rebecca H. Davis

Lisa Thurber

Wal-Mart Stores, Inc.

DON’T BELIEVE THE HYPE

CHALLENGE OR OPPORTUNITY?

Source of Risk

Risk Mgmt Tool

RISK MANAGEMENT

THREAT X VULNERABILITY = RISK

LEGAL/REGULATORY REPUTATIONAL OPERATIONS

Privacy and security

laws and regulations

Employment law

Labor law

FTC Endorsement and

Advertising Guidelines

Copyright and

trademark violations

Securities laws

FCRA

Defamation

Stakeholders

– Customers

– Employees

– Suppliers

– Critics and endorsers

– General public

Fraud & brand identity

IT security

Loss of IP (trade

secrets, etc)

Worker productivity

Hostile workplace

Hostile customer

environment

RISK MITIGATION

5 10 15 20 25

4 8 12 16 20

3 6 9 12 15

2 4 6 8 10

1 2 3 4 5

4

Likely

5

Almost Certain

2

Unlikely

3

Possible

IMP

AC

T

LIKELIHOOD

5

Sig

nif

ica

nt

4

Ma

jor

3

Mo

de

rate

2

Min

or

1

Slig

ht

1

Remote

Terms of use and community guidelines

Governance

Policies and procedures

Employee training

Incident response

Vendor diligence

Audit and compliance

Feedback and reporting

CASE STUDY:

WALMARTONE

Associates are our best reputation ambassadors

DOES ANYONE ACTUALLY USE WALMARTONE?

• over 1 million registered users…and growing daily

• U.S. associates from Walmart and Sam’s Club

• 15 million page views in December 2012

• 85% of users return to the site 3x or more each week

• site activity is from at-home users – “off the clock” access only

REAL CONVERSATIONS FROM REAL PEOPLE

What do you think

should be done about

the debt issue?

What’s the

weirdest question

you’ve ever gotten

from a customer?

Anyone going back to

college? How do you

balance work, school

and family?

LGBT at Walmart?

Are you out at work?

To family and friends?

REAL CONVERSATIONS? WAIT A MINUTE.

You let them talk about whatever they want? (pretty much)

Don’t you have to approve comments first? (nope)

What if they say something negative? (comes with the territory)

How do you keep them from talking about sensitive issues?

(we don’t!)

Q: How’s that working out for you?

A: Great. Content Moderation and Community Guidelines are active on the

site 24/7

CONTENT MODERATION

Process documentation for the Legal team: English translation for the rest of us:

Active Moderation for new topics

Passive Moderation for comments

Language filter for everything

Associates can report comments

they feel are inappropriate

Legal and Ethics follow up, when

needed

MORE LEGALESE!

Community Guidelines crafted by legal and

approved for posting on a website owned by

the world’s largest retailer.

Guess how lengthy and complicated that document is.

ONE SHORT, EASY TO UNDERSTAND PAGE OF RULES

Community Guidelines on mywalmart.com

Mywalmart.com was made for you. Almost every page has a place to share your thoughts and stories for other associates to see. Here are a few

simple guidelines to keep in mind when contributing to the site.

What to do…

•Share your thoughts – We want to know what you think. Join the conversations on the site.

•Stay on topic – If you join a conversation, keep your comments related to the current topic. This helps everyone follow the conversation. If the

current topic doesn’t interest you, hit the “Request a New Topic” button, and submit a new topic for review.

•Show respect – We’re all aware of the Three Basic Beliefs and the importance of showing respect for the individual. Everyone deserves that same

level of respect on the site, too.

•It’s ok to disagree – We don’t all see eye to eye on everything. Wouldn’t that be boring? If you disagree about something posted, say so. Just

remember to do it in a respectful way.

•Have fun – Enjoy and make this your site. Get involved. Share your thoughts and experiences. Learn what others think and join the conversation.

What not to do…

•Don’t break the law – Don’t post anything that involves or promotes illegal activity.

•Don’t be mean – Don’t post anything obscene, lewd, discriminatory, or anything intended to harass someone. And don’t gossip about other

associates.

•Don’t take your work to the site – This site is not for chatting about setting that new modular or discussing the wonderful P&L report you’re

creating. There’re plenty of other topics to learn about and discuss on the site. Leave your work at work.

Still have questions or concerns…

If you’re unclear about what’s appropriate for the site, refer to the site’s Terms of Use and our Social Media Policy.

If you run across any inappropriate content on the site, you can use the “Report as Inappropriate” button to let us know.

Content reported as inappropriate twice by the community is automatically pulled from the site for review.

…and yes, these really are the actual “rules” for the site.

ONE EXAMPLE OF HOW SOCIAL MEDIA BENEFITS THE BUSINESS

Social interactions between associates and Benefits SMEs during Benefits

Annual Enrollment helped create a 14% reduction in call center traffic.

SOURCES & ADDITIONAL READING

Weber, Alan, Guarding the Social Gates, the Imperative for Social

Media Risk Management, Altimeter Group (August 9, 2012)

Merrill, Toby et al., Social Media: The Business Benefits May be Enormous, But Can the Risks – Reputational, Legal, Operational – be Mitigated? Information Law Group and Ace (April 2011)*

Tomhave, Benjamin, Scaling Risk Management, ISSA Journal (November 2011)

Penenberg, Adam, Social Media Affects Brains Like Falling in Love, Fast Company (July 21,2010)*

Social Media: Consumer Compliance Risk Management Guidance FFIEC notice; request for guidance, Federal Register Vol. 78, No. 15 (January 23, 2013)*

NLRB Memorandum OM 12-59, May 30, 2012*

*URLs provided on notes slide

BACK AT THE OFFICE…

Risk Management Tool Source of Risk

First Things First!

1. Conduct general risk assessment

2. Analyze social media’s strengths against organizational needs

a) Visibility into offline issues b) Reputation ambassadors c) Collaboration tools d) Crisis/event prediction

3. Develop leverage plan

1. Take stock of current controls

2. Develop organization-specific catalog of threats and vulnerabilities

3. Conduct risk assessment

4. Develop work risk treatment plan

1. Who? Identify stakeholders (RACI) and social media users.

2. What? Survey social media in use or planned.

3. How? Assess attitudes toward social media, risk appetite, and resources.

4. Why? Define strategy and purpose for company social media.