Risk management fit to face global threats (part one)

by Chris Marston, chief executive of LawNet

Originally published in Solicitors Journal, April 2020

The global impact of the coronavirus pandemic has changed the colour of our days, at work and home, more than we could have conceived, even just a month ago.  Writing now, in mid-March, I expect the situation will be dramatically different again by the time this issue of Solicitors Journal is printed. 

In times of crisis, it is vital that risk management remains at the forefront of all our thinking. Firms will need to continue serving their clients, so it will be business as usual, albeit in very exceptional circumstances.

And while law firm leaders may be worrying about how to supervise staff working remotely or how they ensure they continue to fulfil requirements in areas such as client identity verification, these are concerns that should have been planned for well before we were all forced to become fluent in the finer detail of coronavirus transmission.    

Our member firms must have a business continuity plan in place, as part of our ISO9001 LawNet Quality Standard, and this is a good place to start.  But this cannot be a one-size that fits all, because identifying the unique set of vulnerabilities facing your firm in any given circumstances is essential.  Our quality standard requires firms to test their plan annually - to be sure it is up to date and relevant - and must include an evaluation of the potential risks for their firm and ways to avoid or reduce them.  

Of course it is hugely unlikely that any of our firms could possibly have anticipated a scenario that plays out exactly as the coronavirus has over recent weeks, but nonetheless their planning will have sharpened their thinking and made them well-placed to tackle what happens next.  Importantly, having been required to identify the key people responsible for implementing the plan they will have been straight out of the gate, rather than spending time working out who will do what. 

This helps in delivering swift, clear communication from leadership teams about expectations and processes, which is essential. Firms can also demonstrate that they are prioritising the health and wellbeing of staff and clients, vital in today’s culture, where organisational purpose and values are as important as the quality of your service offering. 

Being ready to ask what support is needed by those involved with your firm, whether staff, client or supplier, and ensuring that the issues are addressed early on can mitigate concerns and better manage resources.  

In the current crisis, it is critical that firms are alive to the risks arising from people working in different conditions, and probably remotely.  Certainly, there will be an increased risk of fraud, with heightened tensions around the virus, meaning staff are likely to be distracted and more susceptible to fraudsters.  RSM has reported that phishing emails purporting to be from, among others, the World Health Organisation are on the increase with criminals trying to collect valuable personal data. 

Specific areas of work may be more vulnerable.  For example, one of our earliest actions was to send out guidance to members on the risks relating to conveyancing transactions.  This tackled issues such as the higher risk of non-completion or withdrawal as a result of the impact of the virus.  Allied to this, those who are vulnerable or unwell may not be able to move house at the point of completion, or third parties, such as removal companies, may be unable or unwilling to undertake their work.  Although most scenarios are well catered for by contract provisions, firms should be reinforcing risks and rights with clients and highlighting how and where exposure may be mitigated, such as through insurances. 

It’s not just about conveyancing, although that is always a top priority because of the large sums involved.  Whatever the circumstances, firms need to carry out risk assessments in all areas of work and ensure any guidance to staff or advice to clients takes identified risks into account.  

But as we all know, risk management is not just for tackling major crises, such as a pandemic. The consequences of poor risk management reach into every aspect of legal practice, affecting professional indemnity insurance, professional reputation, staff morale and beyond.

Yet too often risk management is viewed as a burden, ‘ticking the box’ for compliance or quality management purposes, rather than an opportunity where gains can be made to deliver a return on investment.

Putting a robust risk management strategy at the top of the agenda, making sure people are truly engaged and embracing the concept as part of the everyday through the right blend of culture, process and customer service, can make a firm more agile and able to deal with new threats as they arise.

While holistic risk management is likely to involve additional resources, you should see a corresponding return on investment, so it’s important that firms have systems in place to measure the value of their risk management. In our most recent research, we found only 20% of firms attempting to do that or analysing the cost of risk-related training separately, despite one-third saying they have higher numbers of staff dedicated to risk management than two years previously.

As well as reducing claims, and keeping  your PII premiums manageable, a sound risk management culture in your business should deliver far-reaching and tangible benefits that pay out all year round, by helping you to choose clients who will keep cash flowing, filtering out inefficient suppliers, and attracting and retaining excellent employees.

And it should help tackle fraud, most particularly in the form of cybercrime, which remains a key focus for firms. According to the SRA, law firms reported a loss of £731,250 of client money to cybercrime in the first six months of 2019.

So, there should be a direct impact on your bottom line, and strong processes will help to keep your insurers and bankers happy.

We have seen many significant changes over the past few years and these continue.  In recent months Standards and Regulations have replaced the SRA Handbook and the recommendations from the 2016 Competition and Markets Authority (CMA) review rumble on.  Most recently, the CMA announced they would look again at certain aspects of the profession later this year.

But any risk management strategy must be built on an expectation of shifting sands, if a business is going to be equipped to respond. 

Change is an inevitable part of life – even dramatic, unprecedented change such as the coronavirus pandemic.  It is how we prepare, respond and adapt that will ultimately determine our success.