Reputation rebuilding starts with an honest account of what went wrong, a sincere acknowledgment of the harm, and visible changes that people can verify for themselves. It then continues for years. Messaging can calm a news cycle, but only changed behavior, repeated consistently, brings trust back. If you lead an organization that has just been through a crisis, or one that is still inside it, this article walks through the sequence we use and why it works.
TL;DR
- Start with a fact-finding review and a reputational audit, and respond early. PRSA guidance points to a response window of 24 to 48 hours.
- Acknowledge harm plainly, take responsibility, and explain what will change. Delay and silence cost you credibility.
- Trust returns through visible action: operational changes, new policies, and regular progress updates, not statements alone.
- Plan for a long road. Full recovery is often described as taking three to four years.
- Track progress against the audience that matters most to you, and keep building a reserve of trust for the next test.
Table of Contents
- Why Rebuilding Is Different From Responding
- Step One: Find the Facts, Not the Fault
- Step Two: Acknowledge the Harm
- Step Three: Change Something People Can See
- Passing the Baton Inside Your Own Walls
- A Quick Illustration
- How to Tell Whether Rebuilding Is Working
- Build a Reserve of Trust Before You Need It
- Perspective
- Work With Us on Rebuilding
- FAQ
- Sources
Why Rebuilding Is Different From Responding
A crisis response is about the next 72 hours. Rebuilding is about the next several years. Leaders who confuse the two often declare victory when the headlines fade, only to find that customers, referral sources, regulators or donors are still holding back.
The evidence supports patience. BCG's 2024 research found that only 2% of companies in its sample saw a trust-creating event in the quarter after a breach, which underscores that repair takes far longer than many leaders expect. PRSA's long-term recovery guidance describes a three to four year path to full recovery, with early progress often visible after two to three years.
That is not a reason for discouragement. The same guidance reports that 73% of consumers are willing to forgive a brand after a crisis if it is handled effectively. Forgiveness is available. It is earned through how you act after the mistake.
Step One: Find the Facts, Not the Fault
Before you can rebuild anything, you need to know what actually happened. The temptation is to move straight to messaging. Resist it.
The U.S. Agency for Healthcare Research and Quality, writing about investigating adverse events, says a preliminary review should take place in a fair and accountable culture that looks for facts, not fault, and avoids hindsight bias. The guide was written for health care, but the principle travels to any organization. People who fear blame hide information, and hidden information is what turns a manageable problem into a scandal.
In practice, this means asking three questions early:
What happened, in sequence, and what do we know versus assume? Which systems, decisions or incentives allowed it? And who was affected, directly or indirectly?
A formal after-action review is one disciplined way to answer these questions in a form that changes behavior instead of filling a binder.
Run a Reputational Audit
Alongside the internal review, assess the external damage. PRSA's recovery guidance recommends a reputational audit to understand the damage and its root causes. A useful audit looks at who is talking about you, which audiences have changed their behavior, which claims are accurate, and which are not. It also separates the people who are angry from the people who are merely watching.
This matters because rebuilding is not one project. Employees, customers, regulators, investors, patients, donors and neighbors each need something different from you.
Step Two: Acknowledge the Harm
An apology is not a legal admission to be avoided at all cost, and it is not a public relations flourish. Done well, it is the first act of repair.
AHRQ's guidance on resolution after harm says organizations should offer a sincere, empathetic and regretful apology that takes responsibility for the event having occurred under their care. It also calls for open communication: a true account of what happened, an explanation of how the harm will be addressed, and involvement of the people affected in the improvement process.
Timing matters as much as tone. PRSA's ethics advisory on disclosure makes the point that disclosure is perishable: disclosure that follows delay, denial or unexplained silence has diminishing value, especially to people who feel harmed, ignored or betrayed.
When litigation is in play, the apology and the legal strategy have to be designed together. Our guide to litigation communications explains how leaders and counsel can stay aligned so that neither silence nor carelessness makes things worse.
What a Good Acknowledgment Contains
A credible acknowledgment is specific. It names what happened in plain words, says who was affected, takes responsibility without hedging, and tells people what you will do next and when they will hear from you again. It does not blame the media, a rogue employee or the weather, and it does not say "mistakes were made" when someone made them.
Transparency is also a practical advantage. In the PRSA guidance, 70% of consumers say they trust companies more when they are transparent during a crisis.
Step Three: Change Something People Can See
Words open the door. Actions are what people walk through. Across the sources we rely on, the same list of concrete moves keeps appearing: a reputational audit, visible operational changes, new policies and, where appropriate, compensation. PRSA adds that effective rebuilding requires consistent, long-term accountability, transparency and progress updates.
Academic work on corporate data breaches shows how companies think about this. Researchers found that firms repair their reputations by increasing charitable giving, political contributions, employee wages and IT investment, with the actions aimed at stakeholders who matter most to them. The lesson for a leader is not to copy that list. It is to ask which stakeholders you most need to win back and what they would count as proof.
Pair Resilience With Competence
BCG's 2024 research adds a useful lens. Trust repair requires demonstrating both resilience and competence, and companies that show both at once can achieve up to ten times the trust recovery of the average. Put simply, people want to see that you can absorb a blow and that you can do the job well. An organization that apologizes beautifully but keeps making the same error shows neither.
This is why a changed policy needs an owner, a deadline and a way to check it. Our article on what to put in a crisis communications policy shows how to turn a lesson into something written down that people are accountable for.
Passing the Baton Inside Your Own Walls
Think of rebuilding as a relay race. The crisis team runs the first leg, and then the baton has to be passed to the people who will carry it for years: operations, human resources, legal, customer service, the board. Most failed recoveries drop the baton at that handoff.
The handoff starts with your own people. PRSA's guidance advises communicating internally first and aligning internal practices with external messaging, because employees who feel blindsided or ignored may disengage, and hypocrisy erodes trust. If your public statement promises a culture change, your employees will test it by Monday morning.
BCG recommends going a step further: establish a cross-functional team and a continuous trust-management process that supports the executive agenda, rather than leaving everything to the risk or PR department. We agree. Reputation is the sum of what everyone in the organization does, so the people who own the work have to own the repair.
A Quick Illustration
Consider a hypothetical regional health system that discovers a billing error has overcharged patients for months. The first week goes to facts: how many patients, how long, and why the error was not caught. The second goes to a direct, plain apology from the chief executive, along with refunds and a dedicated phone line staffed by people with authority to resolve cases.
The next quarter is where trust is won or lost. The system changes its billing controls, assigns an executive owner, briefs staff before it briefs the press, and publishes a short progress update every month until the work is done. None of this is dramatic. All of it can be verified. Patients may still be annoyed, but they can see that the organization is doing what it said it would do. For sector-specific planning, see our guide to healthcare crisis communications.
How to Tell Whether Rebuilding Is Working
Because recovery takes years, leaders need signals along the way, or they will either quit too early or keep spending without direction. Pick a small set of measures tied to the audiences you identified in your audit, and review them on a schedule.
For customers or patients, watch complaint volume and themes, repeat business, and the tone of reviews and inquiries. For employees, look at turnover, internal survey responses and the questions raised in town halls. For regulators, partners and funders, notice whether the conversation has shifted from the incident to the future. For the media, look at whether reporters call you for comment on the topic as a source again, rather than only on the incident.
Also track your own commitments. Each promised change should have a date and a status. If you said you would publish an update every month and missed one, that is a trust signal too, and a negative one.
A good rule is to measure against your baseline from the audit, not against perfection. Trust rarely rises in a straight line. Expect plateaus, and expect a setback if a related issue surfaces. What matters is the direction over quarters, not the reading from any single week.
Build a Reserve of Trust Before You Need It
The best time to rebuild a reputation is before it breaks. BCG describes trust as a "stock" that can be built through consistent excellence in resilience and competence, and that acts as a cushion against future depletion. It also recommends systematic vigilance: regular self-monitoring and habitually delivering on promises to multiple stakeholders.
That reserve is built in ordinary moments: answering reviews with care, keeping commitments small and large, and making sure the first page of search results reflects who you really are. Specialist providers of reputation management and review generation can support the day-to-day side of that work, especially for firms that rely on local search and client reviews.
The operational side matters just as much. A written crisis communication plan, a tested crisis management framework and regular tabletop exercises shorten the time between a problem and a credible response. Early warning indicators help you catch the issue before it becomes a headline, and our guide to reputation risk mitigation covers how to keep that discipline going.
Perspective
Over three decades of crisis work, we have noticed that organizations rarely lose trust because something went wrong. They lose it because of what they did in the days and months afterward. A leader who says "here is what happened, here is what we are changing, and here is when you will hear from us again" gives people something to hold on to.
We built our approach around that idea. Preparation and real-time response belong together, because the plan you wrote before the crisis shapes the credibility you have during it. And rebuilding is not a separate chapter that starts when the cameras leave. It begins in the first conversation, with a clear view of who you need to win back and what they will accept as proof.
Our advice is practical, and it is meant to be used. We help leaders decide what to say, what to do, and in what order, with a network of experts to draw on when a situation calls for more than one discipline. A crisis handled with candor and follow-through can leave an organization with stronger relationships than it had before. That is the opportunity worth working toward.
Mark
Work With Us on Rebuilding
If your organization is under scrutiny, or recovering from an incident and unsure what to do next, we can help you assess the damage, plan the response and carry the rebuilding through. Our work includes crisis management and communications, reputation management and recovery, crisis readiness assessments, corporate communications, community relations and litigation support. Engagements are tailored to your situation, whether you are managing media attention or responding to a public controversy.
To talk through your situation, visit Mark Brown Strategies and tell us what you are facing.
FAQ
How long does reputation rebuilding take?
Expect years, not weeks. PRSA's guidance describes a three to four year path to full recovery, with early progress visible after two to three years. BCG's 2024 research likewise found that very few companies see a trust-building rebound in the first quarter after a breach. Speed of response matters at the start, but patience matters afterward.
How do you regain public trust after a scandal?
Begin with the facts, acknowledge the harm sincerely, and explain what you will change. Then make the changes visible and report progress regularly. Organizations that accept responsibility, apologize and implement corrective actions tend to keep stronger reputations than those that deny or downplay the problem.
Should we respond right away or wait until we know more?
Respond early with what you know, and say when you will share more. PRSA's recovery guidance points to responding within 24 to 48 hours to help shape the narrative, and its ethics advisory warns that disclosure after delay or silence loses value. A short, honest first statement that promises follow-up is better than a polished one that arrives late.
Is reputation rebuilding a job for the PR department alone?
No. BCG recommends a cross-functional team and an ongoing trust-management process that supports the executive agenda. Communications leads the message, but operations, legal, human resources and the board own the changes that make the message believable.
Sources
- Reputation Recovery After a Crisis: Long-Term Strategies (PRSA)
- The Long Road to Rebuilding Corporate Trust (BCG)
- System-Focused Event Investigation and Analysis Guide (AHRQ)
- Module 7: Resolution (AHRQ)
- Ethical Standards Advisory: Disclosure (PRSA)
- Hacking Corporate Reputations (ECGI)