Four reputation failures to rehearse, from invented explanations to hostile inputs

Reputation management risk scenarios help an England business rehearse decisions before a problem occurs. The four scenarios are an invented explanation, imported text changing a workflow, a source that no longer reconciles, and an unsupported removal request. They are hypothetical planning exercises, not reports of incidents, forecasts of frequency or claims about named suppliers.

Their evidence cut-off is 6 September 2026.

Choose an owner and a controlled setting before using them. Record the trigger, available evidence, decision authority and recovery condition. Do not assign a likelihood or financial loss unless the business has a documented basis for that estimate.

What to take away

A reply contains an invented explanation

Scenario: a proposed drafting system adds a reason for a service failure that the approved record does not contain. The response has not yet been published. The trigger is the mismatch between the source material and the generated explanation.

The UK Government's AI Playbook, published in February 2025, describes plausible but inaccurate generated content and the need for human control. It supplies a risk mechanism, not evidence that this event occurred in a particular business.

In the exercise, the authorised reviewer should stop publication, remove the unsupported statement and decide whether the source record needs clarification. Preserve the proposed text and correction within the agreed test record. Resume only when the response is supported and the responsible person has approved it.

Imported text tries to change the workflow

Scenario: a review on a platform such as Google Business Profile or Trustpilot includes instructions telling an automated assistant to ignore its normal task or reveal unrelated information. Treat the review as material to examine, not authority to change the system's purpose.

The same government playbook identifies prompt injection and data leakage among AI security concerns. This scenario applies those mechanisms to a possible review workflow; it does not estimate attack prevalence in England or provide an account of a successful attack.

The exercise should check whether publication and access boundaries remain intact and whether an operator can stop processing. Have the technical owner inspect the behaviour in a controlled environment. Do not test the scenario against live customer records or broaden access merely to see what might happen.

A review source no longer reconciles

Scenario: a scheduled collection produces fewer visible records than expected, while the dashboard still shows the previous successful refresh. The trigger is a discrepancy between extraction status and the report's displayed date.

This is a publisher-designed operational scenario, not an observed platform outage. Ask the report owner to distinguish missing data from a real reduction in review activity. Retain the last verified extract and label the current period incomplete while the collection issue is investigated.

Recovery requires a reconciled record and a corrected report. If previously circulated figures change, identify the affected conclusions. A successful reconnection alone does not prove that all missing events were recovered.

A removal request has no stated policy basis

Scenario: an operator proposes flagging criticism solely because it is negative. The business needs to distinguish a disputed opinion from a review that breaches an applicable rule.

The CMA's review-publisher guidance, published on 4 April 2025, explains the UK framework for banned reviews and misleading review information. Use it as a legal-review reference; it does not decide the status of an individual comment.

In the exercise, require the operator to record the relevant policy reason and supporting facts before escalating. Keep the review's tone separate from its eligibility under the applicable process. Refer unresolved legal questions to the qualified reviewer instead of inventing a removal justification.

If the question remains unresolved, the England route is the Citizens Advice consumer service on 0808 223 1133, which can pass consumer law matters to Trading Standards in England. The CMA does not decide individual review disputes. Record the date and set a follow-up within five working days as a typical internal target.

Close the rehearsal with evidence

For every scenario, record what the team decided and which control could not be demonstrated. Do not describe a discussion as a successful technical test. Assign remedial actions, identify who can authorise resumption and schedule the next check after a material workflow change.

The table below is a completed rehearsal record for the reconciliation scenario. It shows the fields the team must complete.

Retain the assumptions so the exercise can be revised when the underlying system changes. A scenario is useful because it exposes a decision and its evidence requirements.

Before you act

Common questions

The scenario sections above answer these questions.