Invest in risk management to win high-value legal work

Many law firms are putting their partners and clients in danger by failing to take risk management seriously enough.

In early June, the Solicitors Regulation Authority issued a warning that UK law firms are being increasingly targeted by cyber criminals, highlighting the need for better data protection practices. Law firms are ripe targets for cybercrime because of the sizeable cash reserves they hold in client accounts.

The Court of Appeal's ruling in Google v Vidal-Hall in late March 2015 means that breaches of the UK's Data Protection Act 1998 could result in significant claims for damages. Firms that fail to invest in data security will struggle to demonstrate that they have taken reasonable care to protect client data.

Under the European Union's forthcoming General Data Protection Regulation, non-compliant firms could be subject to fines of up to €100m or five per cent of global annual turnover, whichever is higher. This regulation would cover all firms that advise clients in the region.

But, only 26 per cent of law firms plan to invest in new data security systems over the coming year and just over half have systems in place to monitor and manage such risks, our research has found.

The majority of data security breaches by UK law firms last year were caused by human error, according to the Information Commissioner’s Office. However, just 17 per cent of firms currently incentivise lawyers to protect client data.

Instead, the top risk which lawyers are being asked to focus on is billing, as apparently some managing partners believe clients demanding higher-value work at lower cost is the greatest risk to their business. Meanwhile, pipeline management is considered the least important risk for lawyers to address, even though it would ensure longer-term revenues.

Part of the problem is the mentality which is prevalent in a large number of partnerships today - that membership is not for life anymore. Many practices are consequently focusing on short-term revenues at the cost of long-term business sustainability. They are not prioritising investments in new processes, systems and risk management protocols, even though these would improve client services in the longer term.

Lawyers are great at holding onto traditional values and being risk averse. It's time to leverage those characteristics to ensure your business is
really acting in the best interests of your clients. Investing in managing your firm's risks demonstrates that you intend to be around for clients in the long term. Cutting corners on things like data security suggests that your talk about putting clients first
is just that: all talk.

If you were the general counsel at an MNC,
what would make you feel confident enough in a law firm to give it your high-value work? Which safeguards would you want to see in place to protect your business interests? Would you trust a law firm that prioritises short-term revenues over all else?

It's time to invest the time and resources in managing your firm's risks - if not for your own sake, then for your clients' sake.

Until next time,