City Limits – Risk Management Survey Part 3

With risk management teams struggling to cope with cost and time pressures, the move to outcomes-focused regulation is stretching resources to their limits, despite the best intentions of the SRA.

In one sense the market has come a long way. In our first three risk management reports, the biggest barrier to implementing a successful risk management culture at a firm was usually one of attitude, with many firms commenting on a lack of partner and management buy in. Today, acceptance of good risk management is far more widespread now that awareness has been raised throughout the financial services sector. However, the issue of resources has become much more pronounced. With law firms suffering widespread drops in revenue and profits in recent years, support teams, including risk and compliance, have come under even greater pressure to deliver value. And, with the shifting regulatory environment changing the rules of the game more frequently, the challenges faced by risk teams have never been greater.

‘Implementing the OFR is a huge task. But I’m thinking that once all this is in place it may not be such a labour intensive area.’
John Verry, TLT

While the average size of risk management teams has swelled this year (see table, ‘What is the size of your risk team?’, page 64), an overwhelming number of respondents pinpointed ‘cost’ or ‘resources’ as one of the major barriers to implementing a risk management culture and structure at their firms. A selection of comments can be seen in the table opposite but a comment from one firm in the upper reaches of the Legal Business 100 sums up the tensions firms are facing, bemoaning ‘stretched resources given the breadth of risk issues nowadays’. Another firm talks about ‘change overload’. Time and cost seem to be the barriers now, rather than attitude.

Shifting priorities

It is interesting to note that this year, while the average headcount in the conflicts, compliance and regulatory teams at the law firms that responded has swelled, it appears that firms have cut back on social (eg diversity) and operational (eg business continuity) risk staff. The obvious conclusion from this is that firms have identified their key risks (as can be seen in Part II of this report) and concentrated resources in those areas. While disaster and business continuity risks will have a huge impact on a firm’s business, the actual likelihood of these risks occurring is minimal. In the wake of stagnant profits at the top 100 law firms in 2009/10, firms have been forced to make judgement calls about which areas of the business are strictly necessary and keep their fingers crossed that things don’t come back to haunt them. This does not mean that redundancies among social or operational staff have been widespread; it appears that existing risk specialists have spent more time on conflicts and compliance. Overall, the average size of risk teams has grown slightly. The feeling is that many smaller practices have looked to the example set by sophisticated risk teams at larger firms by having bigger, more dedicated teams looking at conflicts and compliance with regulatory standards.

Undesirable outcomes

Many risk teams have expressed their concern that the move to outcomes-focused regulation (OFR) by the Solicitors Regulation Authority will create even more demand on risk resources, particularly because the SRA’s draft Code of Conduct places much firmer emphasis on risk management. The need for a specialist risk management team will be more immediate once a clear, black-and-white route to meeting regulatory standards has been eradicated.

As we reported in our piece on solicitors’ regulation (‘In the soup’, LB210, page 42), Taylor Wessing’s risk partner Martin Baker said that it would take the best part of a year to update the firm’s risk and compliance rulebook to factor in changes due to arrive in October 2011. Firms have generally complained that new regulation and an update to the rules, which were only introduced in 2007, have eaten up time and money. As Sandra Neilson-Moore of Marsh points out, ‘there is also real concern that “writing up” such regulation will create something vague and difficult for the firm to adopt, particularly in larger and international organisations’.

John Verry, head of risk at TLT, argues that the real test will be in the coming months when it will actually dawn on a number of firms the sheer size of the task that faces them in implementing and training staff on the OFR. ‘It’s a huge task, we’re flat out,’ he says. ‘Although at the back of my mind I’m thinking that once all this is in place it may not be such a labour intensive area.’

The SRA has made it clear that the move towards OFR will allow it to focus its resources on the firms that are guilty of serious regulatory breaches and allow well-run firms to essentially govern themselves. However, many of the firms featured in our survey feel that while they already have sufficient resources in-house to successfully manage risk, the lack of specific guidance from the SRA means that it creates a bigger job for risk teams to successfully manage compliance. The problem for firms is not the move to outcomes necessarily, or the main principles laid out in the draft Code of Conduct. It is the so-called ‘indicative behaviours’ – the procedures firms go through to achieve the ‘outcomes’. The SRA has outlined certain indicative behaviours that will lead to a desired outcome. If firms follow suggested behaviours and the outcome is not achieved, at least they may be able to point to the fact that they followed the indicative behaviours in the handbook.

Some of the largest firms estimate that they will have to spend around £1m updating manuals, training staff and adding new personnel. The SRA would perhaps counter this by arguing that some firms may have been too hasty in splurging on OFR compliance. It has said that the purpose of OFR is to let well-run firms continue to run their business their own way, so attempting to ‘comply’ with OFR is perhaps a waste of time. If firms’ existing rulebooks worked well enough to meet the overall objectives laid down in the proposed revamp of the Code of Conduct, then perhaps there is no need to change them.

As Nick Eastwell, the recently appointed chief adviser to the SRA on City law firms, told LB recently: ‘At this stage, no one knows how the new regulatory regime, along with the potential for multi-disciplinary practices and alternative business structures (ABS), is going to pan out. I am confident that the SRA and the City law firms can and will work together to come up with grown-up solutions to any problems that might arise.’

Guidance needed

Nonetheless, there is no doubt that the advent of OFR has led to consternation among risk teams judging by the comments received from firms right across the board. One top-ten firm highlighted a specific problem that could arise when risk teams start to speak to fee-earners about vague ‘outcomes’, arguing that such discussions would ‘create more opportunity for debate and confusion between the lawyers and the central team’.

‘There is concern that “writing up” such regulation will create something vague and difficult for the firm to adopt.’
Sandra Neilson-Moore, Marsh

The very nature of OFR is to strip out the prescriptive rules and leave behind a basic regulatory framework but another respondent puts their thoughts on the shortcomings of OFR bluntly: ‘Lawyers tend to respond to rules and believe they can do something unless you can point them to something that says they can’t. This will often be impossible under OFR.’

Jonathan Westwell, general counsel and partnership secretary at Baker & McKenzie in London echoes this viewpoint. ‘We are moving from a system where we had specific guidance to a new system in which the guidance is not yet clear. That obviously creates a challenge in so far as it’s not clear what approach will be required. The worry is that once the rules are in place and guidance has been given then firms will only have a short window in which to affect any changes that need to be made. The concern is more the lack of guidance and time.’

According to Emma Dowden, director of operations and best practice at Burges Salmon in Bristol, one of the greatest problems for the risk teams in law firms will be the dual role they look to be expected to play under OFR. The new reporting obligations imposed by OFR appear to expect risk teams to act both in their traditional role as adviser to lawyers, but also as the eyes and ears of the SRA in a form of ‘internal audit’ function. ‘This dual role could well serve to discourage lawyers from coming forward to talk to their risk teams about potential problems and ethical issues,’ says Dowden. ‘This in turn could deprive lawyers of a valuable source of advice and support and create a culture within the profession of “sweeping issues under the carpet”.’

However, Bill Richards, head of risk and compliance at LG, says that it is too early to draw conclusions on how OFR will affect risk teams. ‘Until we know exactly how the SRA is going to police OFR, we’re a bit in the dark. I hope whatever happens there’s not going to be a dramatic change in the operation of our regulatory regime. I think wholesale confusion is unlikely. Ultimately, those of us that are well-run businesses with a proper regard for risk management shouldn’t be affected too much.’

Again, as with ABS and the assigned risks pool (see Part IV), there is a feeling among the larger firms that this is an issue that will affect the more remote outposts of the profession. It seems the SRA has quite successfully laid responsibility at the door of the firms themselves. The message is clear: if you’ve done nothing wrong, you have nothing to worry about. But it seems that the strain on resources is happening, regardless of the intent of the SRA to simplify matters. LB

mark.mcateer@legalease.co.uk

georgina.bennett-warner@legalease.co.uk