X-raying matters: How to improve matter risk management

Key takeaway points:

1. Focused matter-level risk management can reduce your PI premiums

2. Identify your firm’s 20 per cent of high risk and concentrate on managing it

3. Ensure your partners know that their highest-risk matters will be scrutinised

 

In 2006, I conceived and installed a simple, but devastatingly effective, matter-level ?risk management system which is now ?used by every fee earner at our firm, on every new matter.

It takes two to three minutes for the fee earner to use and has gained the highest level of immediate fee-earner compliance. It is now undertaken 100 per cent of the time – without grumbles from the fee earners and partners.

The impact of the system was immediate, long-lasting and dramatic in reducing the number of reported professional liability incidents and, more importantly, professional indemnity (PI) claims. That, more quickly than we had hoped, led to a dramatic reduction in our PI premium annual costs. We have saved Bates Wells & Braithwaite £3m since 2006 and around £700,000 in 2012.

Figure 1 shows what we would have paid had we kept our 2006 premium rating and compares that with our actual payments. Figure 2 shows our PI insurance payouts total after the risk management system was introduced in 2006 and Figure 3 shows the impact it had on PI claims needing cash reserves/payouts.

I hope the demonstrated benefits of the matter-level risk management system make it worth you reading the rest of this article, because it has universal application and has developed into a bottom-up management information system of unique power.

 

The eureka moment

The risk management system was conceived in a ‘eureka’ moment in 2006. Our PI premiums were very high and getting higher, with a spate of recent large claims.

The first PI renewal after my arrival as CEO was difficult and expensive. That spurred me to read the solicitors’ reports prepared for the PI underwriters on every claim the firm had suffered for 15 years. The reports are detailed – about ten pages each – and are factual and unbiased. I suspect I was the only chief officer who had ever read these reports in such detail.

As I read each one, a pattern began to clearly emerge of common risk factors. After reading all 15 years’ of reports, I realised that the risk factors established in my mind after reading the first 50 per cent had not changed after I had finished reading them all.

As CEO, I was able to realise my ideas by working with our talented head of IT to produce a risk management system based on that stable and universal group of risk factors.

How it works

The core risk management system works ?as follows.

Every new matter has a risk assessment undertaken by the matter fee earner. This is a simple one-page screen with multiple-choice answers that takes two to three minutes to complete. An instant risk classification then comes on screen and is printed. If the score is ‘danger’ or ‘very high’ risk, the paper result has to go to the supervising partner for review and approval.

The frequency of danger-level risk assessments is relatively rare in most departments. Because of this, partners are prepared to give the risk assessment results proper attention.

The risk score sheet covers three points:

1. The risk assessment bands ‘low’ to ‘danger’ together with a score sheet showing the weightings that have led to the risk assessment – what is the unique combination of risk factors that are driving a high risk score? Those scores point the partner to ways of managing those risk factors.?

2. Users are given information on the money-laundering risk band and ?score – again rated between ‘low’ ?and ‘danger’, with the scores ?pointing to the anti-money-laundering (AML) management strategy for danger-level matters. ?

3. The risk score is compared with the estimate that has been placed on the matter. Where we have a danger matter and a low estimate, a message is given to the partner that the estimate should be renegotiated (almost, but not quite “you must be joking with that estimate and this risk!”). If it is not possible to renegotiate the fee then, as a minimum, the signed terms and conditions must limit liability to £3m.

Partners have to sign that they have understood the risks involved and are confident that the risks can be managed. Lawyers do not like signing an assurance that they know to be incorrect. It is the educative process of partners regularly and routinely examining the risk factors and deciding on the appropriate action to be taken that has revolutionised the risk environment at our firm.

Partner risk management actions

On a broader front, having the wrong team working on a matter will probably mean it will:

• take longer;

• exceed the estimate;

• be less profitable; and

• result in arguments over the bill, grumbles, formal complaints and, ?in the extreme, a negligence claim.

The following simple risk management actions are used by partners to manage matter risks.

1. If the matter is more complex and of higher value than the partner had realised when he had casually passed it to a junior fee earner, this can be dealt with simply by passing it to a more senior fee earner, who repeats the risk assessment.?

2. If the matter may be more specialised than the partner had envisaged and the partner did not realise that the allocated fee-earner had no expertise in the specialist field, simply reallocating the matter to a fee earner with the required expertise will reduce the risk.?

3. If the answer to the risk question ‘is there a single point of catastrophic failure?’ is yes, the partner is encouraged to determine what those points of failure are and to manage them accordingly. Often, the single point of catastrophic failure relates to the central purpose of the transaction. On the same set of legal circumstances, the single point of catastrophic failure can be different or non-existent, depending upon the intentions of the client.?

4. There will come a point when the partner has examined the risk factors and come to the conclusion that this is a large and complex matter, capable of catastrophic failure, no one in the firm has relevant expertise and there are no credible ways of managing that potential failure. The only and obvious conclusion is that the firm should refuse to undertake what could be an incredibly dangerous transaction (but with a temptingly large fee!).

 

Second-tier management

At the same time as the risk assessment results come off the printer for review by the partner, ‘danger’ and ‘high risk’ matters are sent (with identical information) by email to the risk manager, the AML officer and the reputational risk group. As explained below, each second-tier manager only receives notification of high-risk matters as scored and weighted on their own risk criteria. ?

?1. Risk manager

The ‘danger’ email to the risk manager ?will often lead to a simple call to the partner to ask about that matter and ?what action is being taken to manage ?the risks. The discussions between the risk managers and the partners reinforce ?in the partners’ minds the need to take risks seriously. It is sometimes the risk manager who will force the decision?that we should not take on a danger-level matter that cannot be risk-managed safely.?

2. Anti-money laundering officer

Having a matter-level risk-based instant alert to the AML officer provides great comfort in terms of compliance. The AML officer can concentrate personally on the real money-laundering ‘danger’ matters and clients.

We have a maximum period for the review of the AML check on each client, depending upon the risk profile of the legal entity. The number of danger or high-risk level matters that are recorded against a particular client automatically brings forward the date for its AML review.

If there are a number of danger-level matters within a short period, this will bring forward an immediate AML review of the client, not just the transaction.

?3. Reputational risk

A year ago, we added a simple reputational risk question for partners. ?We have a high reputation to protect ?as a ‘City firm with a conscience’. If a fee earner flags any reputational risk in a matter, it is filtered for a review and then forwarded to the ethics group if his concerns are valid.

Risk maps

All of the results of the risk assessments can be viewed within a database environment, with colour coding of ‘high risk’ (orange) and ‘danger’ matters (red).

These produce a risk map which identifies clusters of high risk and danger-level matters around particular fee earners, partners or departments. The database can also show risk clusters around particular clients or introducers.

It was almost shocking when we first viewed our risk map and saw that the risk clusters were exactly mapping the areas of our previous PI claims.

The strength of the risk map is that resources can be concentrated on those areas that are regularly managing high risk (but probably very well paid) matters. It also means that the regulatory activity can be lightened on departments that consistently deal with low-risk matters.

The same mapping technique is used to identify clusters of money laundering risk reputational risk.

Risk-based file reviews

In the past, we had asked for randomly-selected files to be reviewed at regular intervals. Partners then selected the thinnest files they could find.

We now centrally select the highest risk matters for each fee earner. For fee earners or partners with danger-level matters, all of these matters are subject to file review.

The fact that partners know that their highest risk matters will be subject to file review means that they maintain vigilance in managing those matters.

The second eureka moment

I later had a second eureka moment – to create a unique barcode for each matter our partners and fee earners handled.

The simple risk screen – just 12 multiple-choice questions – isolates the 20 per cent of those matters that need real management focus. Just as importantly, it identifies the 80 per cent of matters that are routine and low risk which can be dealt with by a light regulatory and management regime – the Pareto principle in action.

However, the system is more intelligent than this implies. Each question has a simple multiple-choice answer – yes or no, core area or outer fringe, level one to level five. Those answers are translated into numeric scores.

Individual scores are permanently attached to a matter and become the equivalent of a product barcode. Once there, it can be read and differently weighted for an infinite number of management, risk and reporting purposes.

By way of example, we have a matter whose answers to the 12 risk questions (contained in the barcode 105320134230) results in a ‘danger’ rating for PI risk, medium-level money laundering risk and nil reputational risk. This automatically triggers the following ten actions:

1. The partner must consider the risk, take action to manage that risk and then sign to say he considered the risk factors and that he can manage the risk.?

2. The partner is asked to review the estimate if it is too low for the risk score.

3. If the estimate is not done ?yet, it will automatically be given ?a 15 per cent increase for the danger risk factor.?

4. The matter will be closed down if we do not have signed terms and conditions within a stipulated number of days.?

5. The risk manager will be alerted by email and will call the partner.?

6. The matter (along with the fee earner/partner and so on) will appear red on the risk map. ?

7. If the fee earner answers ‘manic’ ?to the question on his level of busyness, he will be named within ?the busyness barometer, which will rise by that answer.?

8. The matter will be subject to file review every four months.?

9. The medium money-laundering risk ?will increase the PI risk score by a minor amount. The AML officer will ?not be alerted, but it will bring ?forward the client’s AML review ?date by a few weeks.?

10. As the matter is assessed as having no reputational risk, this will simply be reported on the partner’s score sheet.

All of those actions (and many more when I think of them over time) are all based on the barcode. That barcode is linked to the matter and client codes, the fee earner, partner, client partner, introducer, department and country codes and any other code on your systems which link to any of these.

Each PI risk, money laundering risk and reputational risk weighs (or ignores) each number of the bar code in a different way, to create its own risk result.

If your firm has a presence in England and/or Wales, your list of ‘danger’ matters should be the main content of your firm’s risk register, which is required by the Solicitors Regulation Authority.

Impact on the firm

PI notifications and claims fell to virtually nil as soon as we introduced this system in 2006. As each year of no claims went by and the cost of PI premiums fell and then plummeted, the evidence that it was due to this risk management system became stronger then overwhelming.

Since implementing our risk management system, we have been able to concentrate all of our efforts on identifying and managing the 20 per cent of genuinely high risk matters – high risk for claims, for money laundering and for reputational risk. Taken together, the system forces risk management into the day-to-day culture of partners, risk managers and the board.

The system has self re-enforcing waves, starting with the pause for thought before a partner signs that he can manage a high-risk matter, re-enforced by notification and action by the risk manager, AML officer and/or reputation manager, followed by the risk maps which provide a board-level strategic understanding of risk clusters and the independent risk-based file reviews. Each of these puts pressure on everyone to conduct and manage dangerous matters to the highest standards – and picks up on those partners who do not manage risks well.

Peter Bennett is the chief executive at ?UK law firm Bates Wells & Braithwaite ?(www.bwbllp.com)