The changing face of risk for law firms

Professional indemnity insurance (PII) is a cyclical class of insurance. History shows that when the economy is suffering, more negligence claims are made, and as an economy grows out of recession, although notified claims are being paid, the incidence of new claims starts to reduce. This has certainly been the case in the years following the global financial crisis, and the good news is that we have seen a stark reduction in the number of PII claims/circumstances being made to insurers by the legal profession during the last 18 months.

Although the market cycle does influence insurance costs, a firm's claims experience has a considerable effect on the terms negotiated and is one of the main considerations for underwriters. The risks faced by the legal profession from the property boom years are now reducing; however, there are new risks emerging and the continued compliance and regulatory burdens seem to be increasing all the time.

Most law firms are now experiencing better times in terms of fee growth, and although not yet comparable to the boom years (which may be a good thing), it is felt that firms are far busier than they have been for some time. It is important to ensure that we do not take our eye off the ball from a risk point of view. As firms become busier, it is important that the resources are there to meet the increased demand and ensure we do not start the next phase of the insurance cycle earlier than necessary.

Protecting your client's money and assets

As highlighted in the Willis Law Firm Risk Barometer report 2015, it comes as no surprise that the risk of complaints or claims made against the firm and the risks associated with losing clients (departing client risk) remain high on the list of priorities for practitioners. It is, however, the growing importance of cyber risk that is playing on both firms' and insurers' minds. While cybercrime is not yet seen as the most significant risk that law firms face, the sudden nature of an attack and the detrimental effect it can have means it is increasingly being written into risk management efforts as a rising priority. Law firms will no doubt remain a target of choice for cyber criminals due to the frequent and sizeable transfers of monies which they can attack. Equally, there is high-value, commercially sensitive and individual net-worth sensitive data that is attractive to criminals, all needing to be protected.

Cyber attacks are becoming more and more sophisticated by abandoning the well-known methods of malware, ransomware, and hacking attacks, and becoming more granular in their approach. We're seeing examples of internal phishing where a hacked internal email is sent from the 'managing partner' to the financial controller asking for payment to be made. In this scenario it is easy to ask the financial controller for their confidentiality on the subject as the payment may not be appropriate for firm-wide awareness.

The Solicitors Regulation Authority (SRA) and the Law Society are both concerned about this risk because no one really understands what the limits to cybercrime are. Underwriters are also beginning to ask a lot of questions around the procedures firms have in place in regards to their tracking of money and release of funds. Worryingly, there is no real defence if a transfer is hacked and diverted into the wrong account; the money will be gone and insurers have to pay.

Cyber attacks can hit a firm hard and fast and solutions will need to be found incredibly quickly. For conveyancing, for example, underwriters are going to struggle with the pressure to replace the monies in the chain to avoid loss of deposits. Although PII covers such eventualities, this is an increasing concern for underwriters as losses can be considerable and are growing as a percentage of their overall losses. If the trend continues, it cannot be long before this aspect of cover comes under pressure and insurers start discussing its potential removal from the SRA's minimum terms and conditions. Replacing this with separate insurance will have serious cost implications for firms.

No industry is as prepared for cybercrime as insurers would like and law firms are no exception, despite their susceptibility. Aside from the insurance costs, the outcomes of a cyber attack can involve reputational damage, regulatory investigation fines, and business interruption, which could be injurious to the financial position of the firm. Although it is encouraging that law firms now acknowledge the seriousness of cyber risk, this acknowledgement needs to be converted into the implementation of preventative measures.

Willis's Risk Barometer survey highlighted that small to medium-sized firms are struggling with this issue more than those with greater resources. Smaller firms can be more susceptible to cyber attacks due to smaller IT budgets and the side effects of an attack, like business interruption, could be far more crippling.

In short, cyber exposure is not just a significant risk in its own right; it can be the first domino in a chain of events. It is an enabler, amplifier, or accelerator of the existing risks that firms face. Investigating how to improve cyber risk management procedures and staff awareness is now just another box that needs to be checked.

What do underwriters really look at?

While many law firms rely on just the proposal form when renewing their PII, providing additional information can greatly assist negotiations and may achieve a better outcome. Underwriters need to fully understand what the firm does and what procedures they have in place to mitigate risk: if an underwriter is unaware of the good work you do to prevent claims occurring, you could be paying a considerably higher premium than necessary. Additional information should be provided on the following key areas:

• What the firm does/aspirations for growth, etc.;

• Conveyancing analysis;

• Clear claims information and summaries;

• Discipline and compliance;

• Risk management, including an awareness of cyber risk. To fail to display a clear awareness of cyber risk is to ignore one of the underwriters' biggest concerns at the moment; and

• Financial stability (something that is still a concern for insurers).

Broker service and selection

What exactly should a broker be doing for their client? It will come as no surprise that the Willis Risk Barometer indicated that a poor relationship with the incumbent broker is the biggest reason for changing to a different one, and is a bigger issue for firms than cost. Some firms may not be aware of how extensive (or otherwise) their broker's services can be and could be missing out on an array of services and advice which would benefit their practice.

The best route to the PII market is with a broker that understands and meets the firm's specific needs. As with personal insurance, quick-fix low-rate online PII can easily be found and many would treat their PII as they would their car insurance. Many want the cheapest price available and they do not fully understand what is on offer. There are still many firms with unrated insurers, even though alternative A-rated insurers may be available.

A firm's relationship with its broker will depend on the specific needs of the firm itself. Some will require international capabilities, but many do not. It is recognised, however, that large firms and small firms alike will have a better experience the more they engage with their brokers from day one. Good brokers can provide risk advice, take firms through their day-to-day claims process, engage throughout the renewal process, provide input on strategy, review draft documents, and attend conferences with counsel to ensure their client's interests and reputation are protected at all times. If you have a claim that approaches your total limit of indemnity, you'll certainly be pleased to know you have a quality advocate on your side.

In conclusion, the solicitor's working environment is constantly changing and many are looking at mergers and acquisitions of firms, teams, or lateral hires. It is important, therefore, that firms have a broker that can respond to this dynamic environment and provide cost-effective risk structures in the short and long term. Equally, they need to have experience and excellent access to a wide range of insurers, which will allow them to respond quickly when a firm wishes to seize an opportunity to further its strategic plans.

Richard Brown and Colin Taylor are executive directors at Willis and Martin Ellis is an executive director and head of legal services practice group

---