What is a good reputation management strategy?

Optus found out the hard way. In March 2026, Roy Morgan named Optus Australia’s most distrusted brand, overtaking Woolworths.

The turning point was the September 18, 2025 Triple Zero outage, which lasted about 13 to 14 hours and was linked to at least four deaths.

But the reputational damage was already built up by earlier crises, including the 2022 data breach and the 2023 outage.

The lesson is not new, but it keeps proving itself. A crisis does not create distrust on its own. It exposes whatever level of trust was already sitting there. Optus carried years of built-up damage under the surface. There was a 2022 data breach, a 2023 nationwide outage, and a communications style that read as defensive rather than accountable. The triple zero failure was the trigger. The reputation deficit was already built.

That is the starting point for any serious answer to what makes a good reputation management strategy. It is not a communications plan pulled off the shelf once coverage turns negative. It is a discipline, built and maintained all the time, so that when pressure arrives, the company has somewhere to stand.

Most companies treat reputation the way Optus did for years. They manage it only once it is already under threat. By then, the options have narrowed. Journalists have their angle, regulators have their questions, and customers have made up their minds.

A properly built reputation management strategy works in the opposite direction. It assumes pressure is coming, because in every sector it eventually does. It puts the groundwork in place while there is still room to shape the outcome.

In May 2026, Optus tried to buy back trust with full-page newspaper advertisements. CEO Stephen Rue apologised for the triple zero failure and outlined a three-part plan to prevent it happening again. The message was sincere. The timing was the problem. Eight months after the event, with distrust already entrenched, an apology campaign reads less like leadership. It reads more like damage control.

Reputation, done properly, is not damage control. It is infrastructure.

A good strategy does three distinct jobs. Most companies only ever do one of them well.

Optus, to its credit, is now attempting all three. The trouble is sequencing. Building and protecting are meant to happen first. Recovery is the fallback when the first two failed, and it is always the slowest, most expensive option of the three.

I have used this formula for years, and the AI era has only sharpened it. Trust equals truth, transparency, and traceability. Public statements are now searchable within seconds. Executive promises carry a timestamp. Regulatory submissions can be compared directly against what actually happened.

That changes the calculus for any CEO reputation management Australia strategy needs to account for. A leader who overstates progress, or understates a problem, is not just taking a communications risk. They are creating a permanent, retrievable record of the gap between what they said and what occurred.

Traceability, therefore, is not a threat to manage. It is a discipline to build around. Organisations that document their commitments and track progress against them will outperform, over time, those that manage each moment in isolation and hope nobody checks the archive.

It is worth scoring Optus against its own stated plan. The exercise reveals where most reputation strategies actually fail.

On truth, Optus scores reasonably well. The company has not disputed the facts of the outage. Stephen Rue’s public acknowledgment was direct rather than evasive.

On transparency, the record is mixed. The May advertising campaign explained intent. It offered little checkable detail on what had actually changed inside the network and escalation steps.

On consistency, the score drops further. Three major incidents in four years, each followed by a similar cycle of apology and promised reform, does not rebuild trust. It trains the public to expect the next failure.

The 3Cs still apply here: clear, concise, consistent. Optus has managed clear, and mostly concise. Consistency, over a multi-year horizon, is where the strategy has come apart.

It helps to look at the other end of the ledger. Bunnings has held the top spot in Roy Morgan’s trust rankings for ten straight quarters. Aldi and Kmart have consistently sat close behind. None of the three is famous for a clever apology campaign. All three are famous for being unremarkable, reliably and repeatedly, over years.

That is what consistency actually buys a company. It is not excitement. It is the built-up absence of broken promises, measured quarter after quarter, until the public simply stops expecting a shock.

The Commonwealth Bank offers a related lesson. After its own well-documented governance failures, it has spent years rebuilding a position inside Roy Morgan’s top five most trusted brands. It did this not through a single campaign, but through sustained, boring, checkable consistency. Truth, delivered without drama, is a strategy in itself. Most companies underuse it, because it produces no headline of its own. Eventually, though, it produces exactly the right one: continued trust.

Contrast that with Optus, or with Facebook and Temu, both of which deteriorated further in the March 2026 rankings. The brands losing ground share a pattern. Each new incident lands on top of the last one, because nothing was resolved in between. The brands holding ground share the opposite pattern. Each quarter looks like the one before it, and that sameness is the entire point.

Most crises are not sudden. They are issues that were visible, sometimes for months or years, before they escalated into something requiring an urgent public response. That is why issues management sits ahead of crisis response in any properly sequenced reputation strategy, not behind it.

Continuous monitoring across media, social, regulatory, and stakeholder channels identifies emerging trouble spots early. AI-powered tools now do the heavy lifting on volume, scanning far more signal than any manual team could manage.

However, the tools cannot do the interpretation. Distinguishing a genuine emerging risk from background noise still requires senior judgment. That judgment is built on pattern recognition and a deep understanding of how issues develop inside Australia’s media and regulatory cycles.

For a telecommunications company, network reliability was never a hidden risk. It was a known, trackable exposure, discussed in trade press and regulator letters for years before it became a fatal national story. A functioning issues management strategy would have flagged the escalating pattern of outages early. It would have forced the reliability question onto the board agenda while there was still time to act, rather than time only to explain.

When recovery does become necessary, it takes longer than most boards expect. It cannot be compressed simply by spending more on advertising.

Genuine recovery requires three things, in this order. First, honest acknowledgment of what actually went wrong, not a softened version designed to protect legal exposure. Second, visible, checkable change: new systems, new governance, new accountability, not just new messaging. Third, consistent communication sustained over a period measured in years, not news cycles.

Peter Wilkinson has guided companies through recovery following royal commissions, regulatory findings, and sustained activist campaigns. The pattern holds every time. Organisations that rush the third step, declaring victory after one advertising campaign, tend to relapse the moment the next incident occurs. The public remembers the shortcut.

A reputation management strategy built inside a marketing function will always be tempted to treat reputation as a campaign with a start and end date. That is the wrong frame.

Corporate affairs, positioned correctly, sits closer to governance than advertising. It has visibility into legal exposure, regulatory relationships, employee sentiment, and investor concerns. All of those shape reputation more than any external campaign ever will. That is why corporate affairs, not marketing, will lead companies by 2030. The discipline that actually understands risk is better placed to protect the brand than the discipline built only to promote it.

This is also why senior counsel matters more than campaign execution. A crisis communications consultant brought in only once a story breaks is working with less information and less credibility than one already embedded in the business. Continuity of judgment, from the same senior adviser across building, protecting, and recovering, is what separates a genuine strategy from a sequence of reactive statements.

Every board should be able to answer a small set of questions before a crisis forces the issue. What is our known reputational exposure, and who is tracking it all the time? What is our trust score doing over time, not just this quarter? Who has the authority to speak publicly within the first hour of an incident, and have they rehearsed it?

If the honest answer to any of those is “we will work that out when it happens,” the company is managing reputation the way Optus managed it for years. That means reactively, after the fact, at maximum cost. A retained relationship with senior counsel, of the kind offered through Wilkinson Confidante, exists precisely to close that gap. It gives boards and CEOs access to the same adviser before, during, and after a reputational event.

I have spent 24 years advising boards through exactly this cycle. First, as a journalist watching companies fail to see a story coming. Since 2002, as the adviser sitting on the other side of the table. The pattern has not changed. Organisations that treat reputation as infrastructure, built and maintained before it is tested, are the ones still standing when the next crisis arrives. Organisations that treat it as a campaign are the ones taking out full-page apologies eight months too late.

If in doubt about whether to invest in reputation before a crisis, don’t hesitate. By the time you need it, it is already too late to build.

None of this requires a large team or an elaborate department. It requires a strategy with clear ownership and senior judgment applied consistently. It requires the discipline to keep building trust in the quiet periods, not just the loud ones. That is the difference between a company with a reputation management strategy and a company that simply hopes it never needs one.