Reappraising compliance

Compliance needs an audience and audience participation, now more than ever. It’s time to consider change and we need to have evidence of method rather than madness. 

My previous column was written in the first few days of lockdown. I concluded with the thoughts that we were living in strange times and this meant there were immediate challenges to which compliance professionals '¨had to respond. 

Like you, I was getting to grips with the new language of the pandemic – self isolation, social-distancing, furloughing, remote working – and all that this meant for law firm compliance. It was clear that strong decisions and direct, guiding messages had to be prepared and communicated quickly.

Move forward to today, and we need to add the phrase ‘the new normal’ to the dictionary and consider the as yet indeterminate amount of time before we return to the office. Regardless of the state of lockdown and when it will eventually be relaxed, going back to the 9 to 5, five-day a week office life and the working lifestyle culture still seems a long way off for most of us.

I’d lay a wager that many of us are realising that working from home, if not all the time but for a significant amount of time, is a realistic proposition. Many of us will not return to the office in quite the same way again. What does this mean for all of us? It means, more compliance planning.

So where to start? The enduring component to be added to a way of working that would have seemed nonsensical a few months ago, is the need to ensure that our legal, regulatory and ethical duties are not compromised. This requires an understanding of Solicitors Regulation Authority (SRA) expectations. 

Wherever we lay our working hats, we’re either in a direct regulatory relationship (because we are solicitors or similar) or we are working in SRA-authorised entities which need to maintain their authorisation to continue to open virtual doors and deliver legal services. 

The clues as to what the SRA expects are clearly found in the SRA’s Code of Conduct for Firms. The introduction to this code includes narrative with references to standards and business controls which have been drafted with the “aim to create and maintain the right culture and environment for the delivery of competent and ethical legal services to clients”. These standards must be met regardless of circumstances.

Chapter 2 of the code is the essential reference material for this conversation. To paraphrase the pertinent points, firms must have effective governance structures, arrangements, systems and controls in place to ensure (among other things) that all employees comply with SRA regulatory arrangements; firms must keep compliance records; financial stability and business viability must be actively monitored; and material risks must be identified, monitored and managed. 

This is a big ask at the best of times when everything is based on the premise of an office location, and the challenge is to ensure this all continues to happen irrespective of changed circumstances. If the SRA came visiting, either in person or digitally, they would want to be satisfied that regardless of your circumstances, the firm and everyone in it are managing risk and delivering good quality, ethically based legal services.

Some firms will have assembled a covid-19 task force or similar risk management team to respond to the lockdown. The next steps must be to expand this thinking and map out a strategy for the firm’s future and, essentially, regulatory survival in the new normal. 

I strongly advise that when this happens, '¨your compliance team is sitting round the planning table with the following bullet points to hand:
How do we ensure we maintain the firm’s compliance culture in a dispersed environment? The chapter 2 objectives cannot be attained in isolation by the firm’s task force.

Firmwide awareness and use of policies, controls and procedures is needed. A sense of team to bond the firm, rather than individual offshoots breaking the tie, must be maintained. Constant communication of common goals delivered by the right people (ie those in senior positions and positions of influence) to all the people is advisable. Many firms have developed an internal communications strategy in recent weeks and this should continue. The important message is that legal services can only be provided in a firm that remains authorised – don’t jeopardise this.

What are our messages about personal accountability and ethics? Every individual, lawyer or non-lawyer, who owns or is employed in the firm is an ambassador for the firm brand and an ambassador for the profession. Displaying personal ethics will maintain individual and firmwide reputation. Both can be quickly lost with regulatory, commercial and potentially even legal repercussions as a consequence.

We know ethics is centre stage in the SRA Standards and Regulations (STARs), so the firm must have confidence that the correct behaviours are displayed and delivered. We also know that reporting of individual and firm matters is a regulatory requirement. So again, what are the messages and who is going to give them? Should we be delivering training on the STARs, ethics and the firm’s internal answers and are we actively monitoring to weed out examples of misunderstanding and non-compliance?

Can we ensure scattered but nevertheless effective supervision? Don’t ever underestimate how important supervision is to the SRA; appropriate supervision can positively impact an individual’s disciplinary record. The regulator expects every firm’s supervision procedures to be effective and solicitor-supervisors remain personally accountable for the work of the individuals they supervise.

The problem for compliance is that there is little guidance behind these sentiments and what makes supervision effective depends on the environment. In other words, supervision must adapt to different ways of working and must continue to accumulate the risk data which is so necessary to the firm.

We are talking about the collection of intelligence designed to safeguard individuals against unethical behaviour, the reporting of issues of firmwide importance such as complaints on files and similar, and the gathering of information about training and other competency needs. Conversations about the means of supervision and how it will cover all individuals are essential.

Do your plans ensure appropriate supervision both of colleagues who might be inclined to ‘go rogue’ and those who need more guidance? What will be the substitute methodology for junior colleagues who learn practical ethics and firm culture by watching and observing in the office space and working closely with supervisory mentors?

What decisions around risk need to be remade? Lockdown has triggered a need to re-evaluate so many things we had taken for granted. This process must extend to risk management which previously assumed that the starting point was the office space.

Risks previously identified and managed such as fraud, client money protection and information security, must now be reconsidered and decisions remade to reflect changes. New risks also need to be added – covid-19 has overwhelmed some workstreams and some individuals, and left others twiddling their thumbs and even furloughed. We know some colleagues aren’t comfortably isolated and need support; we have lost colleagues to illness; business plans have had to be rewritten. These all need to be considered.

There are other conversations that also need to be started now. I would also add the following items for your agenda: IT needs, training programmes, indemnity questions (both in respect of the renewal of the firm’s policy and possible claims on the horizon) and realistic reappraisals of business plans. 
Getting back to the new normal is going to take considerable planning.

Tracey Calvert is a consultant at Oakalls Consultancy Limited oakallsconsultancy.co.uk