For decades, corporate risk followed a familiar playbook. If a company focused on its core business, complied with the law, treated employees fairly, managed crises competently, and protected its reputation, it earned the right to operate. Risk was something to mitigate. Reputation was something to manage. Legitimacy was largely assumed.  

It’s time to stop assuming that.  

A Quieter, More Unsettling Question 

Some of the most serious risks companies face today have nothing to do with misconduct, operational failure, or scandal. Instead, they stem from a single, uncomfortable question – one increasingly asked by policymakers, journalists, and the public alike:  

Should this company be allowed to operate this way at all?  

That question sits at the center of what has been called the Legitimacy Gap: the chasm between what companies are legally permitted to do and what society is still willing to tolerate. It is not a new theory and has been discussed among academics since the 1970s. Today, however, legitimacy is becoming one of the most consequential forms of corporate risk – and one of the least well understood.  

Reputation Is Not Permission 

Many companies still assume that a strong reputation guarantees legitimacy. If customers trust you, regulators engage constructively, and investors reward performance the social contract feels intact.  

Recent experience suggests otherwise.  

Take the pharmaceutical industry. Large pharma companies are widely respected. They are innovative. Scientifically credible. Their products save lives. Their R&D pipelines are admired. Leadership teams are treated as serious and competent.  

And yet they find themselves in a legitimacy crisis.  

The issue is not that these companies are breaking the law or operating unethically. The issue is simpler – and harder. A growing share of the public and the political class questions whether any private company should have unilateral authority to set prices for medicines people cannot reasonably refuse.    

Complicating matters further, the scientific authority that once helped offset these concerns no longer carries the same weight it did. Confidence in pharmaceutical innovation remains high among experts, but public trust in science itself has become more fragile and contested. As that trust erodes, appeals to data, trials, and regulatory rigor are less effective at resolving what is increasingly a legitimacy question rather than a technical one.  

That is not a reputational critique. It is a permission question.  

A similar conversation is unfolding around artificial intelligence. Many innovative AI companies are respected for their technical sophistication and for engaging regulators in good faith. But the core concern is not whether these companies are reckless. It is whether private actors should hold so much influence over information, labor, creativity, and large-scale decision-making.  

In both cases, the tension is the same. It is not about bad behavior. It is about concentrated power.  

When private companies control the systems people depend on – whether it is access to medicine or algorithmic decision-making – the debate fundamentally shifts. Questions of efficiency give way to questions of fairness and control, and concerns that the public’s wellbeing is at risk because of what companies do and how they do it, and that wellbeing may not be recovered. And once that shift happens on a large scale, even strong factual defenses begin to feel beside the point.  

How Legitimacy Slips Away  

Legitimacy risk rarely arrives with a bang. It does not begin with protests or front-page scandals. It starts quietly and in places most companies do not watch closely enough.  

First, policy experts and academics raise questions. The language is procedural. Abstract. Easy to dismiss. The experts may be considered fringe or unorthodox, and therefore ignorable.  

Then the framing flips. Critics are no longer treated as outliers; they become credible counterweights in an environment that feels unbalanced in favor of big commercial interests. Coverage shifts from “How does this work?” to “Who benefits from it?”  

Next, the issue becomes moral rather than mechanical. Subjective evaluations of fairness replace objective, carefully measured, and previously acceptable trade-offs. Motive matters more than mechanics. Silence starts to look evasive. Defense begins to sound self-interested.  

From this point, intervention feels inevitable. What is often missed is that legitimacy rarely collapses through formal intervention alone. As permission weakens, organizations lose the latitude to move quickly or adapt. Necessary decisions become slower, more contested, and harder to implement long before any rule formally changes. 

The debate is no longer whether change is needed, but how aggressive it should be. Most companies do not realize what is happening until this stage – by which point the legitimacy of the existing model has already eroded.  Urgent corporate defense compounds the negative responses that have been built over time.   

Why This Catches Companies Off Guard

Legitimacy risk doesn’t show up neatly in dashboards. It doesn’t trigger media-monitoring alerts.

Media teams tend to prioritize volume and sentiment, while legitimacy challenges often emerge among low-volume, but high-credibility voices long before anything trends.

Risk teams focus on compliance and consensus, even though legitimacy questions typically arise just outside that consensus – from skeptics credible enough to matter, but uncomfortable enough to disrupt.

Communications functions are built to respond, not to sense.

Legitimacy risk lives in the gray zone before materiality becomes obvious. That’s why escalation feels sudden. It isn’t. It simply unfolds somewhere companies aren’t looking.

A key signal companies often miss in this early phase is their own workforce. Employees frequently experience legitimacy tension firsthand, particularly during periods of technological disruption, automation, or organizational change. They see how decisions are made, who bears the cost, and where stated values collide with lived reality. When employees begin to question fairness, transparency, or purpose, they are often articulating legitimacy risk before it becomes visible externally.

In that sense, employee skepticism is less a cultural issue than an early-warning indicator of how broader audiences may eventually respond.

Legitimacy risk concentrates where systems become essential, and power becomes unavoidable. The more society depends on what you provide, and the less fair your control over it is perceived to be, the greater the exposure.

Healthcare. Finance. Infrastructure. Energy. Platforms. AI. Education. Housing. Transportation. Food. In these sectors, success doesn’t insulate companies. It magnifies scrutiny.

What Smarter Companies Do Differently 

Companies that navigate legitimacy risk well do not try to message their way out of it. They treat communications as early-warning intelligence, not just amplification. They pay close attention to who is shaping emerging narratives, not only to what is being said. They stress-test uncomfortable critiques internally before journalists, policymakers, or activists do it for them. 

Most importantly, they stop collapsing three very different questions into one. 

Is this legal? 
Is this defensible on the facts? 
Is this still socially acceptable? 

Legitimacy risk lives in the gap between those answers. And it is magnified by another question: Can an average person understand what we do and how? Because the more complex, arcane, and secretive a company’s work is seen to be, the more legitimacy risk attaches to it. 

The Gap Is Widening 

The legitimacy gap is widening. Markets move faster than norms. Technology outruns regulations. Public patience is thinner than most companies realize. In this environment, permission to operate is no longer implicit. It must be continuously earned – and it can be quietly withdrawn long before any law changes. 

Companies that focus solely on compliance and reputation will find themselves defending systems that no longer have public consent. Those that recognize legitimacy as a core strategic risk can shape the terms of debate while they still have room to maneuver. 

The real danger is not regulation. It is discovering, too late, that society has already decided the rules should change. 

Matt Rose is the Americas Lead for Crisis, Issues & Risk Management. An SVP & Senior Partner in New York, he brings more than 30 years’ experience in advising organizations on crisis and issues management, risk mitigation, and reputation recovery. He has guided companies through reputational crises, labor issues, regulatory challenges, ESG controversies, and high-profile litigation.