Developing a risk and compliance culture by Sponsor Aon

Developing a risk and compliance culture

 

When the Solicitors Regulation Authority (SRA) launched its current Handbook in 2011, it imposed compliance officers on all types of firm, even though the Legal Services Act 2007 only provided for them in Alternative Business Structures. 

 

The mere fact of having a Compliance Officer for Legal Practice (COLP) and Compliance Officer for Finance and Administration (COFA) in role, though, does not guarantee that the firm will have the right culture when it comes to risk and compliance.

 

The desire for firms to have a well-developed risk culture has long been held by the SRA.  As it says on the SRA’s landing page for compliance officers, the COLP and COFA are instrumental in creating a culture of compliance throughout a firm, becoming its focal point for the identification of risk and the key point of contact for the SRA.  Whilst a firm-wide compliance culture is expected, there are few regulatory requirements. 

 

If you look further afield, you will see that the Law Society’s Legal Excellence standard, Lexcel, is completely silent on culture.  It talks about operational efficiencies and managing risks but nothing specifically about culture, although some of the steps that are required for Lexcel will feed through into your culture.

 

As culture is so intangible, firms may find it helpful to think of the ABC of culture.  Attitudes and Behaviour build your Culture.  The Attitudes of those within a firm will influence how they Behave.  Everyone’s behaviour produces the firm’s Culture.

 

The attitudes of individuals within a firm reflect their approach towards risk and compliance.  This will be influenced by their perception of risk which will affect their behaviour.  Attitudes tend to be internal, whereas behaviour is the externally observable activity resulting from these attitudes.

 

If a policy or procedure is introduced to manage a risk that is seen as unclear or unfounded, an individual might be tempted to ignore or circumvent it.  To follow the policy might be viewed as a waste of valuable time.  On the other hand, if the risk is clearly identified and present, the value of the policy is likely to be accepted, leading to greater compliance.  Of course, the procedure should be as practical as possible and not overly cumbersome.

 

This pattern of behaviour will build to form the culture of the team, the department or the office.  Different offices within a firm will often have different cultures, particularly if they have resulted from mergers. 

 

The culture of a firm can tend to be cyclical with the cycles tending to be self-reinforcing, in either virtuous or vicious cycles, which then repeat themselves.  People tend to gravitate naturally to like-minded people.  So, if there is a negative culture in a department, those with similar attitudes will be attracted to each other, thereby re-enforcing the cycle.

 

Some firms have black holes or no-go areas where people, often at a senior level, are allowed to do their own thing.  They are allowed to ignore procedures with impunity.  That poses a major threat to the firm’s compliance culture.  If others in the team see that there is no sanction for ignoring procedures, they will copy that behaviour.  Those in managerial roles must lead by example.

 

File opening can be a bit of a headache.  So much to do before you can get your teeth into the legal work.  What if you could run matters on a miscellaneous file?  All those tedious matter opening and matter acceptance procedures could be by-passed at a stroke.  And those anti-money laundering checks!  And, because miscellaneous files usually avoid supervision, there’s little chance of the file being reviewed.  Whilst attractive to the individual, this poses significant risks for the firm.

 

Compliance should be a habit, not an area where time is devoted to finding ways to circumvent procedures.  The current SRA Handbook is getting on for seven years’ old but I suspect that the number of solicitors who are familiar with its contents remains relatively small.  Whilst your COLP and COFA are the guardians for risk and compliance, everyone should be thinking about risk and compliance. 

 

For there to be an open, positive culture, you need to encourage a free cascade of information across the firm.  Often there will be those, perhaps at a junior level, who have identified risks that have not been appreciated higher up the firm.  If your culture is right, these risks will be communicated, captured and managed.  For example, engaging with your reception staff may enable you to identify actual or potential breaches of confidentiality when clients arrive.  It may be very convenient for the practice to have routine matters handled on reception (such as letter folding) but it carries risk. 

 

Your culture is reflected in the way you apportion blame when the inevitable mistakes happen.  Having a ‘no blame’ culture can be really positive.  The message should be: “come and tell us if something has gone wrong, as soon as you spot the mistake, and we’ll support you”.  Try to hide it and you get what’s coming to you. 

 

A healthy culture sees firms learning from mistakes and near misses.  In risk management terms, a near-miss is an event where you come a hair’s breadth away from disaster, perhaps avoiding a serious claim, a major complaint or a PR failure.  Think of it as a mid-air collision avoided.  You can learn as much from this as from the real thing, but without the pail or the cost.  Being willing to learn from these can be really helpful as part of your risk management ethos.

 

You will undoubtedly have some sort of risk assessment process when you take on new matters.  Many firms find that almost every matter is accorded the same risk score.  More often than not, everything is seen as low risk.  Fee earners are often afraid that work will dry up so are reluctant to do anything that could reduce their workloads.  This means that the initial risk assessment may well under-record the risks faced by the firm. 

 

From the partners’ perspective, it is important for individuals to come up with scores that actually reflect the risk to the firm.  Accordingly, it may make sense to include a file’s risk score as part of the file review process. 

 

Blindness by the board to their risk and compliance obligations can lead to a culture of non-compliance, as others will follow their lead.  This can pose a real threat to the business, not least with reputational damage from the naming and shaming of firms by the Legal Ombudsman on its website. 

 

There may need to be elements of both stick and carrot in relation to compliance but generally the stick is a short-term remedy; you can’t maintain compliance through fear.  In the long term, the carrot approach should predominate.  Encourage all to recognise the benefits of compliance, which they can see is being measured and valued by the partners, with certain behaviour rewarded. 

 

The responsibility for risk and compliance sits firmly on the shoulders of your firm’s compliance officers but their job will be much easier if a risk culture pervades the whole firm.  Think of it as the collective body language of the firm.  Is yours a firm that likes to do the right thing?

 

For more information on this article, please contact:

Grahame Davidson, Director, Aon UK Limited

On 0117 9485117

 

Whilst care has been taken in the production of this article and the information contained within it has been obtained from sources that Aon UK Limited believes to be reliable, Aon UK Limited does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the article or any part of it and can accept no liability for any loss incurred in any way whatsoever by any person who may rely on it.  In any case any recipient shall be entirely responsible for the use to which it puts this article.
 
This article has been compiled using information available to us up to 19 April 2018.

Like   Back to Top   Seen 487 times   Liked 0 times
Subscribe to Updates And Join Over 1.2K Subscribers Today!

Subscribe to:
x

Subscribe to Updates

If you enjoyed this, why not subscribe to free email updates and join over 1274 subscribers today!

Subscribe to updates



Subscribe to:

Alternatively, you can subscribe via RSS RSS

‹ Return to

All email subscriptions must be confirmed to comply with GDPR.

I've already subscribed / don't show me this again