Make it stick: Ten ways to improve firmwide risk management

Cobbetts’ risk partner, Mark Whittell, shares his top ten tips for embedding a risk management culture

Risk management is essential to the everyday running of a legal practice. Quite apart from the need to introduce supporting systems, there is also an obligation to embed a risk management culture within the firm.

In the UK, law firms are required to demonstrate sound risk management principles, not only to satisfy insurer demands but also to ensure adherence to the Solicitors Regulation Authority’s (SRA’s) new code of conduct. 

Risk management is often seen by both partners and fee earners as yet another time-consuming administrative task that keeps them from doing their day jobs – which to them is fee-earning work for clients, recording time and delivering bills. They will pay lip service to it, and even appear enthusiastic, but as soon as there is fee-earning work to be carried out, risk management is put to one side.

This is similar to business development activity in the 1990s, when solicitors would draft extensive and detailed business development plans, only to put them in their drawer after they had been completed and to slightly modify them the following year. Partners were almost hurt if you asked them to comment on whether or not they were performing in line with their plans.

Changing attitudes

Embedding a risk management culture within a firm is by no means an easy task and those responsible for it will take many knocks, but you just have to keep going. Below are ten tips that I hope may be of some assistance and, if you have any others, please let me know.

1. Make the process simple

Risk management is nothing more than:  

• sitting down with your colleagues for between an hour and two hours;

• thinking of every risk the firm/practice area/team faces in stopping it from achieving its goals;

• listing those risks in order of severity; and

• adopting plans for the worst five risks.

Once you have gone to all that trouble and identified five serious risks, it would be criminal not to follow through with your plans.

2. Design a system for your firm

Your firm will have a style, a work profile and, perhaps more importantly, its own characters. I am sure all firms have partners who are described as ‘barking mad’ and who try to avoid being associated with anything involving administration. Clearly, one size does not fit all.

3. Get buy-in from senior management

If the more junior fee earners see that the senior members of the firm are interested in risk management, they are far more likely to take it seriously. And, if the junior fee earners can see the sense behind it and the benefits it offers, the culture will not only spread from the top down but from the bottom up. Often, junior fee earners appreciate the training and understand the benefits.

4. Embrace risk management in its totality

Some firms look at risk management purely on the basis of complying with internal and regulatory requirements. While both of those aims are important, I believe there are greater benefits to be had by looking at the risks firmwide.

At my firm, we have looked at risk management in areas from money laundering procedures to the effect of a double-dip recession, and from catastrophic IT failures to the scoping in our letters of engagement. In doing so, people do not consider it to be just a minor administrative nuisance.

5. Sell risk management as common business sense

Listed companies have to undertake risk management and it applies to a law firm just as much as anyone else. It is common sense to look at the five worst risks your team/practice area/firm faces and to put in place and implement plans to reduce those risks.

6. Warn of third-party pressures

Remind both partners and fee earners of the pressures from third parties, namely the threat of failing to comply with the SRA’s outcomes-focused regulations and, perhaps most effectively, the threat of problems with insurers if they cannot see that the firm has a risk management culture.

Insurers will want to see that your firm is addressing risk issues and, in my experience, they are keen to help. They are also very quick in seeing through attempts to paper over the cracks.

In the current hardening of the insurance market, it is no idle threat to tell your partners that embracing risk management can mean the difference between paying a reasonable and very hefty insurance premium, even to the extent that the firm might become uninsurable.

7. Provide training to plug all holes

Continuing professional development (CPD) points are often a major incentive in plugging discovered holes in the firm’s risk management. It is perhaps a little cunning, but offering CPD points around September and October does heighten the level of fee-earner interest.

8. Offer an external perspective

A good tactic is to invite people from outside of the firm to talk to fee earners and partners about risk management.

For example, our insurers have a risk management DVD. It is humorous but to the point. It involves a young solicitor making a mess of a conveyancing transaction and a partner-from-hell as a supervisor.

I have run it with CPD points for the whole firm – I think I actually obtained ten per cent of the firm’s CPD points in one hit. Now everyone is talking about risk and I was able to get through a few points that I wanted everybody to hear.

9. Make the system dynamic

I have found that people accept that they have to do a risk plan, but then do not comply with the plans. It is almost as if they expect the risk team to take the risk away from them – not appreciating that the risk team’s job is to facilitate the identification of risk and put in place appropriate plans to reduce it to an acceptable level, but not to take the risk away from them.

Introduce a system whereby plans will be monitored that will suit your firm and the characters within it. We have a traffic light system so that, if the plans are one month behind, they show up in amber rather than in green and, when they are three months behind, they turn to red. The idea behind this is to use both a carrot and a stick to enable us to monitor plans at a glance and intervene if we feel it necessary.

10. Keep plans simple

If you allow a fee earner to go into detail in creating a plan, it will be verbose, take ages to produce and he will hide in the drafting of it and never implement it.

Instead, create five bullet points of what is needed, designate someone responsible for that action and timetable it. Achieving 70 per cent of something simple is better than achieving zero per cent of something perfect.

No quick fix

There is no quick fix to embedding risk management. It cannot be done in a year but, rather than seeking perfection of the plan, year on year it will improve. You will have some knocks along the way, but try to keep up your positive attitude.