Polecat vs RepRisk: two approaches to reputational risk data

Published by Polecat. Polecat is one of the two providers compared here, so we have an interest in the outcome. RepRisk details are drawn from RepRisk's own published materials and announcements as at October 2026, and we say plainly where RepRisk is the better fit.

The short answer

Polecat vs RepRisk is a choice between two jobs. RepRisk is the stronger choice for investors, lenders and compliance teams screening companies, suppliers and projects for business conduct and ESG incidents, using a daily dataset that runs back to January 2007. Polecat is built for corporate risk and corporate affairs teams that need the whole outside world scored consistently, weighted to their own strategy and projected 3 to 6 months ahead.

Polecat vs RepRisk at a glance

What does RepRisk do well?

RepRisk does four things particularly well: it maintains a long, daily-updated record of reported corporate misconduct, it keeps that record independent of company reporting, it publishes clear definitions for its metrics, and it reaches investors through the data channels they already use. For financial institutions, these strengths are often decisive.

Depth and history. RepRisk's dataset runs back to January 2007 and is updated daily. It covers a very large universe of public and private companies, the great majority of them non-listed, along with projects. That reach into private companies, suppliers and projects matters for due diligence, where company disclosures are often thin or absent.

An outside-in view by design. RepRisk intentionally excludes company self-disclosures. AI and machine learning screen and tag content, and human analysts review and approve results before publication. As part of its published method, RepRisk records reported allegations rather than verifying them, so the dataset shows what public sources and stakeholders report about a company's conduct, not what the company reports about itself.

Published, defined metrics. The RepRisk Index runs from 0 to 100 and is reported as a current value, a peak over the last two years and a trend over the past 30 days. The RepRisk Rating runs from AAA to D, benchmarked against sector and country peers, and the UNGC Violator Flag maps companies to UN Global Compact principles. Since November 2025, Due Diligence Scores let clients build sets from more than 200 thematic scores mapped to frameworks such as the SDGs, SASB, SFDR, the German Supply Chain Act and modern slavery legislation.

Institutional distribution. RepRisk data has been available through FactSet since 2012, and in July 2026 FactSet named RepRisk its preferred partner for business conduct risk data. It is also available through Bloomberg and Snowflake.

Best for: investors, lenders, insurers and compliance teams that need a long, consistent, outside-in record of business conduct incidents to screen companies, suppliers and projects.

What does Polecat do differently?

Polecat differs from RepRisk in who it serves and what it does with the evidence. RepRisk describes the conduct record of a very large universe of companies for the people who invest in, lend to or insure them. Polecat measures the outside world for one organisation at a time, for the people responsible for that organisation's risks. Our how it works page sets out the method in full.

The whole outside world, not only adverse incidents

RepRisk records incidents: reported allegations of misconduct, organised across 28 Business Conduct Issues. Polecat measures developments across the outside world, including those that are not yet incidents: a regulatory consultation, an NGO campaign gathering support, an academic study, a new line of investor questioning, enforcement against a peer. Sentiment is one of six scoring factors, so supportive and neutral developments are measured alongside hostile ones.

The same method extends to recall, reputational and supply chain risk, and to peer position. The source mix also differs by design: RepRisk excludes company self-disclosures, while Polecat measures earnings calls, AGMs and filings alongside external sources.

A consistent score with 20 years of comparable history

Every Polecat event is scored on the same six factors: severity, velocity, sentiment, authority, reach and history. Each score is benchmarked against 20 years of comparable events, and every scored event updates the client's Risk Index, out of 100.

Both companies publish a 0 to 100 index. The RepRisk Index measures a company's exposure to reported conduct incidents. Polecat's Risk Index measures one organisation's exposure across the outside world, calibrated to its own taxonomy, so a risk committee can track it quarter on quarter, against peers and against history.

Weighted to your strategy

Polecat's Customer Intelligence Model calibrates to each client's own risk taxonomy, definitions and thresholds, so scores drop straight into the risk register in categories the team already uses. It also reflects the fact that the same event can be a risk to one company and an opportunity to another. Tighter supply chain due diligence rules may raise exposure for a company with opaque sourcing and strengthen the position of a competitor that has already mapped its suppliers.

RepRisk benchmarks its ratings against sector and country peers, and its Due Diligence Scores let clients choose their themes. It does not describe weighting to a client's own strategy, which suits its purpose: an investor screening thousands of companies needs one yardstick for all of them.

A 3 to 6 month projection with scenarios

Polecat projects each risk 3 to 6 months ahead, with a base, best and worst case scenario and a probability attached to each. Its horizon scan looks 12 months back and 90 days forward and classifies each risk theme as chronic, recurring, emerging, dormant, contained or fizzled.

RepRisk's metrics describe the present and the recent past, and it does not publish a forward forecast. For screening, a reliable record of past conduct is what the job requires. For a risk committee planning the next two quarters, a stated horizon with explicit probabilities is easier to plan against.

Delivery built for the corporate risk desk

Polecat delivers in two layers on one engine: daily Key Posting Alerts, Daily Risk Briefings and weekly Executive News Briefs, then monthly or quarterly dashboards and board reports. An API feeds GRC and integrated risk management platforms, and MCP access serves AI assistants such as Microsoft Copilot, Claude and ChatGPT. RepRisk delivers through its platform, data feeds, APIs and investment data channels. Polecat publishes its entry price, a £25K Risk Intelligence Audit; RepRisk does not publish pricing.

When is RepRisk the better choice?

RepRisk is the better choice when the job is screening, due diligence or compliance across many companies, and the question is whether a company, supplier or project has been linked to misconduct.

• You screen portfolios, borrowers, counterparties or insured risks for business conduct and ESG incidents.
• You need coverage of private companies, suppliers and projects, many of them outside listed universes.
• You want the data inside FactSet, Bloomberg or Snowflake, beside the rest of your investment data.
• You need scores mapped to frameworks such as SFDR, the German Supply Chain Act or the UN Global Compact.

When is Polecat the better choice?

Polecat is the better choice when the question is how exposed one organisation is, relative to its peers, and where each risk is heading.

• You sit in a corporate risk or corporate affairs function responsible for your own organisation's exposure, rather than screening a universe of companies.
• Developments from regulators, NGOs, academics, think tanks and investors matter to you before they become incidents.
• You need external risk weighted to your own taxonomy and strategy, so that an event is read as a risk or an opportunity depending on your position.
• Your board wants a 3 to 6 month projection with scenarios and probabilities, and every score traceable to source evidence.
• You want a fixed-scope first engagement at a published price.

At Wendy's, 25% of documented risks are first surfaced by Polecat's horizon scanning, before they appear anywhere else on the register. As Bob Bowman, its Chief Risk Officer, puts it: "you cannot model what you cannot see."

Can you use both Polecat and RepRisk?

Yes, because they serve different desks. In a financial institution, an investment or compliance team might use RepRisk to screen counterparties, while the institution's own risk function uses Polecat to measure its exposure, benchmark it against peers and report to the board. In a corporate, procurement might use RepRisk for supplier screening and enterprise risk might use Polecat.

Our guide to Strategic External Intelligence sets out ten questions to ask any provider. For a wider field, see our list of RepRisk alternatives and our roundup of the best ESG controversy and reputational risk data providers.

Frequently asked questions

Is Polecat a RepRisk alternative?

For corporate risk and corporate affairs teams, yes. RepRisk records reported business conduct and ESG incidents across a very large universe of companies, mainly for investors, lenders and compliance teams. Polecat measures the whole outside world for one organisation, scores each event against 20 years of comparable history, weights it to that organisation's strategy and projects each risk 3 to 6 months ahead. For portfolio screening, RepRisk remains the better fit.

What is the difference between the RepRisk Index and Polecat's Risk Index?

Both run from 0 to 100, but they measure different things. The RepRisk Index measures a company's exposure to reported business conduct incidents, shown as a current value, a two-year peak and a 30-day trend. Polecat's Risk Index measures one organisation's exposure across the outside world, scored on six factors and calibrated to its own risk taxonomy, so it can be tracked over time and against peers.

Which is better for portfolio screening?

RepRisk. It is built for screening companies, suppliers and projects for business conduct and ESG risk, with a daily dataset back to January 2007, coverage that extends well into non-listed companies, framework-mapped Due Diligence Scores and delivery through FactSet, Bloomberg and Snowflake. Polecat is built for the corporate risk desk of a single organisation rather than for uniform screening across an investment universe.

Which is better for a chief risk officer?

It depends on the question. A chief risk officer at a bank or insurer screening counterparties may be well served by RepRisk. A chief risk officer responsible for a corporate's own exposure usually needs a score weighted to the company's taxonomy and strategy, benchmarked against peers, projected 3 to 6 months ahead with scenarios and traceable to source evidence. Polecat is built for that job.

How much do Polecat and RepRisk cost?

RepRisk does not publish its pricing; its site offers demo requests. Polecat publishes its entry point: a fixed-scope Risk Intelligence Audit at £25K, which covers the risks moving fastest on your register, benchmarks them against peers and stands up both delivery layers in three weeks. An instant demo is also available on the Polecat site.

About Polecat

Polecat delivers Strategic External Intelligence: 20 years of measured, comparable evidence on the outside world, so risk leaders can see around corners.

The quickest way to judge it is to try the instant demo. Teams that want to see it on their own register can book the fixed-scope Risk Intelligence Audit, priced at £25K, which stands up both layers in three weeks and benchmarks the risks moving fastest against peers.

Related reading: RepRisk alternatives: reputational risk data compared and The best ESG controversy and reputational risk data providers in 2026.