Moving feast: how compliance officers' roles are taking shape

How are individuals balancing their roles between them, in acting in the role as a named compliance officer and developing a culture of compliance within the firm?

More than a year has elapsed since the introduction of outcomes-focused regulation (OFR) and the new world of COLPs and COFAs. While most firms have now implemented necessary systems to address the new requirement, little has happened to dispel some of the original enigmas faced by compliance officers and many still face uncertainty on a daily basis.

However, the new regime has succeeded in moving risk management up the agenda significantly and when implemented correctly, the resulting compliance infrastructures can be of benefit.

Limited guidance

My own firm's nominated COLP and COFA only received formal approval by the SRA in June 2013 and in the meantime, as compliance officers in waiting, they recorded non-compliances dutifully and performed their unofficial roles to the best of their ability.

I suspect that we were not alone to wait and wonder, in the absence of any concrete guidance, whether or not our interim measures were sufficient. Firms are yet to submit their first annual compliance report to the SRA and that exercise will no doubt shed light on the extent to which our daily compliance practices match our regulator's expectations of us.

In the past 18 months, we have witnessed a swathe of training courses on offer for compliance officers, yet there is still huge uncertainty within law firms about what actually constitutes a material breach.

The apparent lack of guidance in this respect, coupled with the fact that there is no evidence of disciplinary action to date (beyond that taken against firms who did not comply with the initial nomination process) provides little comfort.

Until a precedent emerges, many compliance officers will continue to make some hard judgement calls without the benefit of any absolute guidance.

Mickaela Fox, partner in the solicitors' professional risk practice at Weightmans, told me that their smaller clients have struggled to find the time to fully understand what the roles mean and how to embed the reporting framework.

Bare basics

These firms, she says, were "busy fire-fighting on a daily basis and trying to keep their business afloat. They have got the bare basics in place, but are not really using the framework and monitoring it."

According to Fox, the lack of clarity and moving to OFR has not helped smaller practices who felt more comfortable under a rules-based system, and her impression is that COLPs and COFAs in smaller practices have very little time to spend on carrying out their roles.

Individual COLP/COFA "experience" varies greatly, predominantly due to the size and/or resources available within each practice.

Time is a big factor, with many COLPs juggling fee earning as well as this important management role, particularly in smaller firms where a limited number of individuals wear multiple hats.

For a COLP to undertake the role effectively the amount of time taken to handle compliance properly cannot be underestimated and a realistic allowance must be factored in, with fee earning targets adjusted accordingly.

For some firms, the Lexcel framework meant that they were already geared up to identify, handle and mitigate risk to their practices, and can build on the foundations already in place with relative ease to ensure that the new requirements are met.

For those outside Lexcel, the implementation of adequate resources and of a new infrastructure with robust reporting mechanisms has presented more of a challenge and one year on this issue does not appear to have subsided.

Compliance workflows

In my own firm, a medium sized practice, our first step was to insure our compliance officers against any personal liability by taking out appropriate regulatory response cover.

Our COLP is supported by the operations team in-house who ensure that breaches are entered onto the compliance workflow within our fully integrated case management system and that appropriate action is then taken.

Our software allows us to produce reports and monitor trends in real time. We have found that a robust IT database is a 'must have' to ensure that we deal with OFR effectively and full integration with our own case management system has been helpful.

We also have an outsourcing arrangement with specialists in professional risk to ensure that our approach is proactive and compliant. This solution works for us but it is important that each firm identifies its own requirements and what will work for it in terms of cost, resource and infrastructure.

Several legal software companies have developed bespoke workflow solutions for COLPs and COFAs to meet the demand of their law firm clients, many integrating theirs or other case and practice management systems. Darren Gower, marketing director at Eclipse, says the popularity of their compliance solutions reflects law firms' interest in integrating compliance into every step of case management, avoiding duplication and building compliance into how they manage processes.

Meanwhile, Brian Rogers, director of regulation and compliance at Riliance, which provides bespoke risk management software, says that determining what constitutes a material breach, and trying to decide whether their firms are financially stable have led to many sleepless nights for some COLP/COFAs.

"Most firms are on the right compliance road but some have only just started their journeys and it will take them some time to catch up," he says. "For some, the delay may come back to haunt them as they will not be able to show an appropriate risk and compliance audit trail to the SRA or indemnity insurers when required.

"Compliance does not have to be stressful if compliance officers and their colleagues work together and seek assistance from those who can help them," he says.

Patterns of behaviour

Regardless of size or shape of organisation, it is clear that the introduction of OFR and the shift of onus to named individuals within a firm to report breaches have resulted in heightened awareness of risk management.

In a positive manner, my own firm has been able to identify patterns of behaviour which in turn has led to training and systems changes to avoid bigger problems further down the line and reduce risk.

Without the infrastructure implemented to fulfil the new compliance regime, it is unlikely that we would have identified these trends.

Fox says most compliances officers, when asked whether they feel comfortable about reporting material breaches which might put them in conflict with their partners, reply that it was just part of the role and they would report.

"Their main concern was that they would not know what is a material breach and many are still struggling with the mindset of staff, how to discover breaches over and above relying on people to tell them or waiting for the nightmare scenario to happen," she says.

Only time will tell. Market sources contacted for the purposes of this article all seem to share the same trepidation in awaiting the first raft of SRA disciplinary cases. It will be interesting to see the landscape in another year's time.

 

---

 

Joanna Kingston-Davies is chief executive of Lees Solicitors

www.lees.co.uk

 

 

 

---