Effective risk management in law firms has never been more important. Lawyers must contend with the long-standing risks associated with the practice of law, such as anti-money laundering and issues of client confidentiality, as well as new risk areas such as data protection and cybersecurity, and increased regulatory burdens. Poor handling of these risks can lead to reputational damage, diminished client relationships, and even regulatory action, and so it is critical for law firms to remain vigilant and put in place robust risk management policies, processes and systems.
Risk Management in Law Firms brings together lawyers, consultants and other risk and compliance professionals to provide expert and practical guidance on essential risk management topics. Chapters cover risks relating to clients, internal operations and law and regulation, and address recent developments including issues arising from the shift to hybrid working, the increased focus on ESG and climate change, and the extended influence of clients through outside counsel guidelines. There is also consideration of the future of risk management with coverage of the proposed changes to the SRA Codes of Conduct to address issues relating to wellbeing and unfair treatment at work, and the commercial opportunities for law firms and individual lawyers presented by the increasingly flexible principles-based regulation.

This title aims to help law firm leaders and individual lawyers understand and prepare for the risks they face - as well effectively handle them when issues do arise - whether they occur in the firm's internal operations or its dealings with clients. In-house counsel and others will also find it useful to understand their law firm colleagues better, enhancing professional relationships. With the comprehensive coverage of key risk areas in this title, lawyers and firms can not only ensure compliance, but also maintain healthy client relationships, educated staff, a positive reputation, and continued success and growth.

Executive summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

About the authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

Chapter 1: Managing risks in the hybrid "office"
By William Glynn, legal director, and Niya Phiri, partner, Clyde & Co LLP
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
People risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Operational risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Data/IT risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Legal/regulatory risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Chapter 2: Climate change and ESG risks for lawyers
By Alexia Howard, senior associate, and Simon Konsta, partner, Clyde & Co LLP
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
What is ESG? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Reputational risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Transition and transactional risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Corporate disclosure and liability risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Greenwashing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Diversity and inclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Chapter 3: Data protection
By Nigel Miller, founding partner, Fox Williams LLP
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Data protection principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Lawful ground for processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Accountability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Data processors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Individual rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Personal data breach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
International data transfers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Marketing and cookies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Chapter 4: Cybersecurity: an existential risk for law firms
By Simon Chester, counsel, conflicts and regulatory matters, and Sandy Gill, assistant general counsel, Gowling WLG (Canada) LLP
Regulatory requirements............................................... 45
Client pressures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Cloud computing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Remote working . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Policies and procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Insider risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Assessing precautions.................................................. 52
Insurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Planning for breach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Next steps.............................................................. 58

Chapter 5: Criminal finances and investigations
By Anousheh Bromfield, senior associate, and Charles Kuhn, partner, Clyde & Co LLP
Introduction and types of financial crime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Privilege . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Jurisdiction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Specific considerations for certain offences in law firms - (section 330 POCA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Chapter 6: Anti-money laundering - are you doing enough to protect your firm?
By Brian Rogers, regulatory director, The Access Group
The money laundering landscape . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Law firm sanctions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
SRA AML thematic reviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
AML guidance.......................................................... 75
AML governance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Firm (practice)-wide risk assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Client/matter level risk assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
AML policies, controls, and procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

Chapter 7: Professional indemnity insurance
By Rebecca Atkinson, director of risk and compliance, Howard Kennedy
The requirement to have professional indemnity insurance . . . . . . . . . . . 81
How much insurance cover to buy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
What a circumstance is, when and how to notify possible claims to insurers, and who will handle the claim . . . . . . . . . . . . . . . . . . . . . . 83
Should you rectify mistakes? Beware own interest conflict . . . . . . . . . . . . 85
PI insurance renewal - what happens each year and top tips for renewal: how to present your firm well . . . . . . . . . . . . . . . . . . . . . . . . . 86
Possible PI insurance exclusions for sanctioned entities and certain types of work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
A short note about cybercrime insurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Limiting liability clauses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

Chapter 8: Protecting partner assets
By Frank Maher, partner, Legal Risk LLP
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Professional indemnity insurance and the exclusions . . . . . . . . . . . . . . . . . . 92
Retirement and professional indemnity insurance . . . . . . . . . . . . . . . . . . . . . 95
Defensive practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Insurance options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

Chapter 9: SRA compliance
By Rebecca Atkinson, director of risk and compliance, Howard Kennedy
What is the SRA and when do you need to be authorized by it? . . . . . . . 101
How to get authorized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
The annual reauthorization process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
The SRA Standards and Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
SRA Enforcement Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
The COLP and COFA role and reporting requirements . . . . . . . . . . . . . . . . . 113
Ethics and how to approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
SRA warning notices and guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Chapter 10: Mitigating risk through your client journeys and practices
By Peter Noyce, head of legal sector, Menzies LLP
Take on process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Throughout the transaction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Completion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Financial disciplines and controls should also be part of the toolkit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Chapter 11: Outside counsel guidelines
By Noah Fiedler, shareholder and co-leader of the Attorney Risk Management Practice Group, Barron & Newburger, P.C.
Comprehensive outside counsel guidelines become standard . . . . . . . . . 125
Indemnity provisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Defining conflicts of interest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Managing the risk of OCGs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
OCGs are here to stay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Chapter 12: Conflicts of interest and confidentiality duties - effective risk management
By Tracey Calvert, founder and director, Oakalls Consultancy Limited
Own interest conflict . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Conflicts of interests when acting for clients . . . . . . . . . . . . . . . . . . . . . . . . . . 134
Confidentiality and disclosure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Risk management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Risk compliance objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Risk management pinch points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Compliance solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
The bigger picture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

Chapter 13: Complaints
By Rebecca Atkinson, director of risk and compliance, Howard Kennedy
The requirements regarding complaints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
What should the complaints handling process be and who should undertake complaint handling in the firm? . . . . . . . . . . . . . . . 144
How to effectively handle complaints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Complaints made by non-clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
How to handle online reviews - good or bad . . . . . . . . . . . . . . . . . . . . . . . . . . 149
The Legal Ombudsman Scheme Rules, publication, and case fee . . . . . 150
Further guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

Chapter 14: Effective supervision in remote and hybrid teams
By Jamie Butler, executive coach and facilitator and founder, Jamie Butler Coaching Limited
Why is good supervision important? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Risks, challenges, and opportunities of remote supervision . . . . . . . . . . . . 156
Core skills and characteristics of an effective remote supervisor . . . . . . 156
Setting "ground rules" to establish responsibility and build trust . . . . . . 157
Communicating for effectiveness and productivity . . . . . . . . . . . . . . . . . . . 158
Maximizing engagement, inclusion, and wellbeing . . . . . . . . . . . . . . . . . . . . 158
Hybrid working - developing approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Hybrid working and supervision - opportunities and challenges . . . . . . 161
"Supervisor as coach" skills - managing from a distance . . . . . . . . . . . . . . 162

Chapter 15: Lateral hiring in law firms - risks and reward
By Ruth Bonino, professional support lawyer, and Chris Holme, partner, Clyde & Co LLP
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Basic legal, ethical, and regulatory obligations of partners in UK law firms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Setting the scene . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
The due diligence process - how to avoid overstepping the mark . . . . . 168
Pre-employment vetting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Conflict checks - how to avoid breaching confidentiality obligations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Integration issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Key rules of the road . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

Chapter 16: Culture matters - a new era for law firm risk management
By Jessica Clay, partner, Iain Miller, partner, and Lucinda Soon, professional support lawyer, Kingsley Napley
Ethical culture under the spotlight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Assessments of unfair treatment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Concurrent employment claims . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Challenging behavior that does not meet the standard . . . . . . . . . . . . . . . 179
Personal and professional boundaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

Chapter 17: Innovation and the opportunities in flexible regulation
By Jonathon Bray, director, Jonathon Bray Limited
Regulation-led innovation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
CMA report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Deregulation-led innovation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Other external factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Ten years of ABSs - evolution rather than revolution? . . . . . . . . . . . . . . . . . 190
Innovation is easier said than done.................................... 192

About Globe Law and Business . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195