“It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you’ll do things differently.” – Warren Buffett

For Volkswagen, the second largest auto manufacturer in the world, it took 78 years to build its reputation and one day to lose it. Volkswagen Group has about 340 subsidiary companies. It has operations in 150 countries, including 100 production facilities. The company sells passenger cars under the Audi, Bentley, Lamborghini and Porsche brands, and motorcycles under the Ducati brand.

VW admitted installing software in diesel cars to dupe emissions control tests by making them test cleaner than they actually were—even using this information in their marketing campaign to promote these cars. Unfortunately for them, in 2014 a team of researchers at West Virginia University ran separate tests both in the lab and on the road and to their surprise the road tests showed 40 times more emissions. After 14 months of denials VW admitted they had installed “defeat” software that detected when the car’s emission system was being monitored in the lab and altered the results.

As a result of the fallout, the company’s CEO resigned, criminal charges were filed, and losses are estimated to be in the billions.

No one will know for sure how much this lapse in judgment will cost Volkswagen in the long run. It makes you wonder who made the decision to cheat. Was it just one engineer, or a team of engineers? How far up the chain of command did it go? Did the CEO know? It doesn’t matter because he was forced to resign and the damage had been done.

This is yet another example of the need to add reputational risk to our list of risk issues. Damage to a firm’s reputation can result in lost revenue, increased operating cost, regulatory costs and destruction of shareholder value (VW stock was down 37% two days after they admitted cheating). It can also be triggered by an adverse or potentially criminal event, even if the company is not found guilty. Adverse events that are typically associated with reputation risk include ethics, safety, security, sustainability, quality and innovation. Reputational risk can also be a matter of corporate trust.

This damage is not always limited to one company and often embroils others. Just ask former employees of Arthur Anderson. The company, founded in 1913, was formally one of the big five accounting firms until it was found guilty of criminal charges in its handling of the auditing of Enron, an energy, commodities, and services company based in Texas. Arthur Anderson managed the firm he founded until his died in 1947. He had a reputation of being a committed supporter of high standards in the accounting industry; and was known for his honesty and his argument that an accountant’s responsibility was to investors, not their clients’ management. According to employees, during the early years an executive from a local utility approached Andersen to sign off on accounts containing flawed accounting, or else face the loss of a major client. Andersen refused without thinking twice, replying that there was “not enough money in the city of Chicago” to make him do it. For many years, Andersen’s motto was “Think straight, talk straight.” If the Arthur Anderson auditors had followed the advice of its founder, however, they might still be around today.

As for Enron, before its bankruptcy in 2001 the company employed about 20,000 staff and claimed revenues of nearly $111 billion during 2000. Fortune magazine named it “America’s Most Innovative Company” for six consecutive years. But eventually top executives Jeff Skilling and Ken Lay were convicted of securities fraud and other charges.

Lay died before serving any prison time, while Skilling received a 24-year sentence and could be released as early as 2017.

The fallout hit their employees hard and cost many of them their 401(k) retirement. This prompted congress to change the laws to limiting ownership of company stock in 401(k)’s, and perhaps was the catalyst for Sarbanes-Oxley legislation.

An effective approach to managing reputational risk is to address it before, during and after a crisis. Crisis management will be critically important in handling major reputation problems. It begins with identifying risks and putting controls in place to limit the damage.

All this needs to be done before a crisis hits, rather than developing a crisis management strategy when your back is against the wall—a good offense is the best defense. So make sure your “blind side” is well-protected. While protecting your company’s reputation and brand can be challenging, being prepared is critical.