Why banks find it so hard to manage reputational risk