Where the bodies lie – the risk report 2014

 

While the regulatory upheaval of recent years has calmed down, our annual risk report finds law firms facing many threats lurking around the corner

In our seventh annual risk management and professional indemnity survey with broker Marsh, we asked law firms if they felt they had got to grips yet internally with the Solicitors Regulation Authority (SRA)’s outcomes-focused regulation (OFR) regime. One firm said: ‘Yes but it is continuous improvement so it can never be “completed”.’

Quite. Just when legal risk teams feel that they’ve dealt with one challenge, another emerges. Like bailing out a leaking boat – the more water displaced, the more comes in.

That does not mean that risk teams’ efforts are futile but the pressure to keep up with an evolving regime and a more interventionist stance from regulators is not easing any time soon.

In recent years, risk managers have been preoccupied with repeatedly moving targets – adapting to seismic regulatory change with the advent of OFR and far greater scrutiny from the SRA, as well as the arrival of alternative business structures (ABSs) and structural changes to the regulatory framework for law. Today, the regulatory environment is fairly stable, at least against the yardstick of the previous five years.

The challenges risk teams now face are largely focused on a more prescriptive stance from the SRA and rising expectations from clients regarding their outside counsels’ governance.

Jo Riddick, compliance officer for legal practice (COLP) at Macfarlanes, outlines four key priorities for her team in the coming year: refreshing IT systems to streamline client work flows and addressing cybersecurity; updating firm-wide training of anti-bribery and corruption laws; and promoting her role as COLP within the firm. The firm also needs to prepare for the new anti-money-laundering directives that will be enacted into UK law in 2015/16 – including preparing a written risk assessment, which is going to be required under new legislation.

Against this, it is clear that, despite appearances, even the regulatory backdrop is far from settled. The SRA has announced controversial plans to extend its fining powers from an upper limit of £2,000 to £100,000. In addition, SRA executive director Richard Collins tells Legal Business: ‘We’ll be publishing the next refresh of the Regulatory Risk Framework in the spring. The material in that will be relevant to the risk teams because that’s our overview of how risks are shifting.’

Collins also says alongside this update of the risk outlook (due in March), the SRA will be publishing a separate paper on cybersecurity, which he says has emerged as a far larger risk that needs to be tackled on its own.

By the time you read this, there could be another set of recommendations for risk teams to digest.

Dangerous Liaisons

The issues risk teams face are happening at a time when the top end of the profession has had to cope with sustained upheaval. Last year was, by any measure, a dramatic year for the Legal Business 100, with the official launch of major transatlantic forces Dentons and Norton Rose Fulbright, bookended by the administration of Cobbetts and subsequent takeover by DWF at the start of the year and the distressed sale of Manches to Penningtons, as well as the CMS Cameron McKenna/Dundas & Wilson and Lawrence Graham/Wragge & Co deals announced towards the close of 2013.

In among that there were long-established firms demonstrating some erratic financial performance. The public failures of Cobbetts and Manches have again raised the spectre of financial performance from a risk perspective. Certainly, this is a major concern for the SRA, reflected by our survey responses. Almost 90% of respondents have had a visit from the SRA in the last couple of years and many have had two, with the second visit largely focused on financial stability.

The level of intervention was further underlined by the introduction at the end of 2013 of a new insurance regime replacing the assigned risk pool (ARP), which hit its last implementation deadline at the end of December. The SRA said in January that more than 100 law firms would have to close having failed to find commercial cover by the end of the so-called extended policy period.

Interventions have also been running high over the last five years. During 2013, the SRA conducted 47 interventions, against 37 the previous year, and had to substantially increase its spending in the area.

In June last year, the SRA announced that 160 firms across England and Wales were under intensive supervision due to the state of their finances and within that, eight were the subject of real concern. Of those 160 firms, 20% were so-called ‘high-impact’ firms – those in the top 200. The SRA’s Collins comments: ‘We have firms on the intensive supervision list who we engage with on a pretty constant basis. Our objective isn’t to make sure they survive, but if they do fail it doesn’t impact negatively on clients or on the market more generally. If they collapse disastrously and we have to intervene, that costs the whole profession money. Some commentators misunderstand our role. It’s not to make sure these firms succeed or survive, it’s simply, if they are going to go, they do so in a way that client interests aren’t threatened.’

Certainly the majority of risk managers we spoke to are divided over whether financial security is largely a concern for a handful of specific firms and whether the absence of prudence by some has had a knock-on effect on the attitude of qualifying insurers providing top 100 firms with professional indemnity insurance (PII). ‘Firms like Cobbetts and Manches may have been over-leveraged,’ says Riddick. ‘Such firms tend to be on insurers’ and the SRA’s radar. For the firms that are financially strong, the impact is different. If I were insuring a firm, I would be interested in the levels of debt out there.’

However, Angela Robertson, general counsel (GC) of Eversheds, feels that insurers in particular are taking a much closer look at law firm balance sheets. ‘It’s absolutely clear now, the risk management of the firm is very important but the financial stability piece almost took over in 2013,’ she says.

Sandra Neilson-Moore, European practice leader for law firms’ professional indemnity at Marsh, says that the only real effect these public collapses have had on the professional liability insurance market is to cause the insurers to try to work out the best way to determine which firms are financially stable, and which are not. ‘This has resulted in a few additional questions around financial conditions at the firm,’ she says.

Where financial problems are more of an issue is when a struggling firm is snapped up by a much larger rival and the new entity becomes a different insurance proposition. In those circumstances, it is vital to ensure that bad habits do not infect the new firm and any problem areas are decisively addressed. Deborah Abraham, director of risk and compliance at DWF, has more experience than most of the effect of rapid consolidation on the risk profile of the firm, with her firm completing five mergers in a little over two years, including the takeover of Cobbetts. She says the potential effect of an acquisition on risk is a fundamental part of due diligence. ‘You’re not getting into bed with every single firm you talk to maybe because of what you find in due diligence. There’s also the people risk – losing key players from the firm you want to merge with. Insurers will look at mergers favourably if it looks like a firm will fail without it.’

‘The important thing is that risk profiling is involved in the strategic part of the merger,’ says John Verry, risk director at TLT, which completed a tie-up with Scottish practice Anderson Fyfe in 2012 and also opened offices in Manchester and Belfast. ‘Doing it after is like shutting the stable door after the horse is bolted. In terms of risk, get in early – is it a marriage of convenience or necessity? Convenience is easier. If it’s a marriage of necessity, you have to look very carefully at why that is the case. You have to look at different financial profiles, claims profiles, complaints profiles – there’s no point in taking on something that is going to end in divorce as they cost money.’

However, merging can be advantageous if the two firms are both in a strong position financially, says Clyde & Co professional negligence partner Richard Harrison, who experienced this as part of the union of Clyde & Co and Barlow Lyde & Gilbert in 2011. ‘The major insurers are now keen to pitch for and win the combined account of firms on merger. Globalisation and consolidation in the large law firm sector has meant that there are fewer, more valuable, accounts in play,’ he says. ‘The major brokers and insurers increasingly target firms pre-merger to persuade them that it would be in their interest to change their insurance arrangements. When we merged, one of the issues we had to work out was what to do about our professional liability insurance, as the two firms had different lead insurers. We concluded that the combined firm would be sufficiently attractive to the major insurers that we could expect to make a substantial saving in premium and retain in our combined programme the existing providers, thereby achieving potentially greater flexibility for the future.’

Emma Dowden, director of risk and operations at Burges Salmon, believes that mergers are a major distraction for risk teams – so it is just as well that her Bristol-based firm is steadfastly independent. ‘It’s imperative that risk teams understand the risk profile of the merged firms – systems have merged, processes have merged, policies have changed and there are different attitudes and appetite to risk,’ she says. ‘You’ve got to seek alignment on your combined risk profile so you can manage the risk of the new business, which I imagine would be time-consuming and a distraction for risk teams.’

Distraction or not, 2013 was the year of the law firm merger. It was a record year for consolidation – with 28 deals announced involving – or potentially creating – at least one top 100 UK firm, eclipsing 2012 with 26 such deals, according to research from consultants Jomati. Neilson-Moore points out that while some combinations will be a concern to insurers, mergers are fundamentally beneficial for the PII market: ‘When firms merge, two (or even sometimes three) become one. This means that a set of insurers will lose out, because the cost of the combined insurance will always be less than the aggregate of the separate policies was. This results in enhanced competition.’

Alternative risk

While 2013 was brisk for legal consolidation it was also very much the year when ABSs finally arrived in earnest. The number of new ABS launches in 2013 had already surpassed 2012 levels by the end of May last year, and by October the SRA had announced that it had awarded 200 ABS licences since it began issuing them in 2012. Many major corporate brands now have ABS licences – BT, The Co-operative, AA, Saga, Stobart Group and BLG Group (comparethemarket.com).

At the end of January, a potential game-changer was announced when PwC received approval to become an ABS, meaning that it can directly own its limited liability partnership, PwC Legal, bringing together a 2,000-lawyer network. Collins says that the SRA has now licensed 230 ABSs, while a report commissioned by the regulator, released in February, said that anything up to 700 companies, public authorities and charities could currently be considering the business case for applying to become an ABS.

‘You will see ABS begin to have an impact in other sectors,’ says Collins. ‘The growth of professional services will challenge some of the mid-tier legal firms because of the ability to link in other professional services and leverage their services off a much wider range of offices, as well as having the ability to invest. PwC might be the beginning of the next phase of ABS.’

But the main ABS issue from a risk perspective is the ability to allow outside capital into a law firm, creating more opportunities for investment as well as the attendant risks of ceding financial control beyond the traditional law firm partnership. Law-firm attitudes have softened slightly to external capital in recent years: two years ago, 23% of firms said they would consider outside investment as a method of raising capital, while over half (52%) said they would not. This year, while the proportion of firms saying they would consider outside investment is essentially unchanged (21%), the number of firms that have changed position from an outright negative response to a ‘don’t know’ has changed, 46% now saying ‘no’ and 32% unsure.

Neilson-Moore believes this modest shift in attitude can be attributed to the profile of ABS currently. ‘It is almost certainly the case that the type of organisation that would seriously pursue outside investment is a relatively unusual one in law firm circles,’ she says. ‘The traditional model of partner investment and closely held equity still works for most firms and is flourishing. It is probably not a question of “game changers”, but rather of an expansion of the type of business model, allowing different approaches to fill different niches.’

Harrison of Clyde & Co, who specialises in advising law firms in professional negligence cases, says he is witnessing a growing acceptance of the possibilities that ABS has to offer law firms but warns there are risks attached. ‘If capital is concentrated in a few hands, it can be hard for equity partners to retire from the business without compromising the finances of the firm. As a result, some firms could be attracted to bringing in private equity investment to replace the departing capital,’ he says. ‘Although the PE houses will want to tie-in the key players for a period, there is a risk that organisations will use the PE capital to avoid the destabilising influence of senior departures, rather than to develop the business. But the PE houses will still want the anticipated return on their investment, which could lead to a dangerous squeeze on profitability.’

Simon Callander, GC and partnership secretary at Olswang, agrees that allowing external investment is still a last resort option. ‘ABS investment has been aimed at high-volume work,’ he says. ‘For more traditional firms of our size and structure you look at it as a form of finance and compare it to the other forms of finance available to you. Other options may well be cheaper and involve less ceding of control to the investor. Private equity companies want a high return and a high level of control.’

Even for insurance-driven advisers, especially those with substantial volume service lines that can be repackaged or hived off, outside investment is still not the preferred option. Says DWF’s Abraham: ‘This is something close to our hearts because of the type of the business we’re in. Approximately 50% of our business is insurance and when you look at this industry and the potential for ABS to come in, we did discuss it with clients. A lot of clients were quite sniffy about ABS, which is dying away now. However, I would be very surprised if the strategic board plans to go down that route without thinking carefully about whether to move to external investment. Presently, the board’s strategy remains that it will retain ownership within the DWF partnership.’

Time bombs

While wider concerns about the effect of a rapidly changing business and regulatory environment are having an undoubted impact on risk teams at a broader level, for day-to-day risk management issues, the same old fears lurk beneath the surface and, if anything, have intensified in terms of being a threat. A glance at our risk profile chart shows that an IT security breach, or data management accident or breach, remains by far the biggest fear for law firm risk managers. This is because of the aggregate score across the two charts for ‘impact’ and ‘potential’. It has an aggregate score of 3.4/5 – whereas risk managers consider that an IT breach may not have quite the same impact on their business as a natural disaster or a situation where the firm’s liabilities exceed the limits of its insurance cover, a cyberattack is far more likely to happen than those other two scenarios.

‘It’s an area that requires constant attention because it only takes one mistake and you’ve got a major impact,’ says Verry. ‘It goes back to your fundamental duty of client confidentiality.’

That is why Neilson-Moore doesn’t need to tell her clients to focus on getting their house in order from a cybersecurity perspective. ‘It is important that it gets good focus inside the firms and we believe that this is happening,’ she says. ‘Among other drivers, the law firm’s clients are insisting on attention to this. From what we can see, this issue is very high on the agenda of any sensible firm.’

Andrew Cheung, EMEA GC at Dentons, says that it has to be top of the agenda throughout a firm, not just the primary concern of the risk function. ‘Large law firms are in many ways particularly exposed as we have large institutional clients doing enormous international deals that will be of interest to governments, competitors, hackers and organised criminals. Cyberattacks from each of these threats is a real and present danger and it is not a coincidence that MI6 and the FBI have started briefing law firms on this issue,’ he says.

He points out that the level of sophistication from organised crime gangs is at unprecedented levels. ‘The stakes are high for firms working on big deals,’ he adds. ‘It is a massive responsibility holding and protecting this sort of information and requires not just doing the bare minimum but taking concrete steps to understand and respond to developing threats, and working with clients to ensure they have the levels of protection they expect.’

One major concern is managing clients’ expectations around IT security and reassuring them that a firm’s systems are robust enough to withstand attacks. The problem, according to Lee Mulligan, head of risk and compliance at Lawrence Graham, is that law firm systems cannot always keep up with the level of sophistication of clients. ‘Law firms have historically been viewed as having archaic systems and that can make us vulnerable,’ she says. ‘As risk managers we need to ensure that wherever possible there are protective measures in place.’

For DWF’s Abraham, it is a simple equation. ‘If you want to work with clients who spend a lot on cybersecurity, they want to know that you’re in line with them.’

What are the main barriers to implementing a risk management culture at your firm?
LB100 rank	Selected comments
Top 20	‘Outdated IT systems to manage compliance; requires additional resource to manually manage systems.’
Top 20	‘Partners too focused on client service.’
Top 20	‘Pressure from clients to produce quick and cheap advice.’
Top 20	‘Day-to-day issues take up too much time to focus on structural changes.’
Top 20	‘Geographical spread of offices.’
21-50	‘Lack of investment in the compliance function.’
21-50	‘Client demands, including for transfer of risk to its lawyers.’
21-50	‘The client service imperative being top-down endorsed and widely understood, resulting in risk management taking a secondary (and less popular) role.’
21-50	‘Low impact of regulator compared to financial services.’
21-50	‘Lack of organisation.’
51-100	‘Partner knows best.’
51-100	‘Time.’
51-100	‘The constant changes in the regulatory requirements.’
51-100	‘People not understanding potential impact.’
51-100	‘Multi-site location.’
100+	‘Compliance training fatigue.’
100+	‘Cost constraints.’
100+	‘Failure to think through risks properly.’
100+	‘People taking it seriously enough.’
100+	‘Lack of understanding/interest of senior fee-earners.’

Growing teeth

While there is anecdotal evidence of LB100 law firms fighting cyberattacks on a daily basis, none has so far suffered the ignominy of a far more serious data breach and the subsequent crippling professional negligence claim. The main causes of claims against law firms remain unchanged (see chart): pressure due to unrealistic client demands and failure to properly manage client expectation, as well as lack of available resources for appropriate supervision.

While there was a marked drop off in claims filed against solicitors in the Chancery courts in 2012 – the most recent year for which data is available – down from 125 in 2011 to just 48, there still have been some high-profile instances of firms being criticised by the public, regulators and even the courts for their conduct in certain matters – such as costs, evidence gathering, client confidentiality and conflicts – with the reputational damage arising from this public wrist-slapping far outweighing the financial impact of any fine or sanction.

Says Eversheds’ Robertson: ‘Brand damage is serious as it has much wider application. Clients are aware, insurers are aware and also your own internal people who don’t want to be associated with a firm in the press. It’s very difficult to shake off that negative image.’

As a backdrop to this, one particular issue has polarised law firm risk teams in recent weeks: the proposal by the SRA to increase its fining powers on law firms from £2,000 to up to £100,000, reducing the need to refer as many matters to the Solicitors Disciplinary Tribunal (SDT) for significant fines. While the SRA has the power to issue large fines on ABS, it has been limited in the sanctions it can levy on conventional law firms.

Collins at the SRA argues the process of fining individual lawyers and firms is, in some respects, outmoded. When ABSs were introduced, the watchdog was given extensive fining powers but the ability to fine traditional law firms wasn’t increased at the same level.

‘Because our fining powers for traditional law firms are very limited, it means we have to refer our cases to the SDT and that’s a much lengthier, costly process because we have to prosecute the firm before the independent tribunal, which is quite an archaic way of doing things compared to other modern regulators,’ he says. ‘Yes, the most extreme cases will go to an independent tribunal – all we’ve said is that we can process the cases much more quickly and cheaply, which has a benefit to the whole industry (which pays the costs of doing this). If we had higher fining powers we could deal with a greater range of poor behaviour without going to the SDT.’
But opinion is clearly divided. One school of thought argues this kind of power is to be expected from a credible regulator. ‘If it’s going to be a prudential regulator it has to have teeth,’ says Cheung. ‘Firms are not going to invest huge amounts of money in an insurance and compliance programme that actually works unless there is an incentive to do it and that will, unfortunately, require large fines or high-profile enforcement actions. That is challenging under the current outcomes-focused regime because of the lack of clarity around what constitutes non-compliance in particular circumstances and the complexity of larger practices.’

This camp believes that £100,000 is the appropriate maximum fine, as it has to be a figure that is big enough to hurt. However, there would need to be very clear guidelines as to when the fines are issued. ‘You need to have absolutely clear rules on when and for what different fines will be levied, unless the fines are only levied when a firm is being openly dishonest and unwilling to engage at all in the OFR process – in other words the completely bad apples,’ adds Cheung.

Dowden says to go from £2,000 to £100,000 represents a huge leap, therefore the due process and the transparency of that process become vitally important. ‘While the SRA says it proposes using greater fining powers to drive cases away from the SDT in the hope of resulting in speedier resolution of disciplinary measures, it occurs to me it might do the opposite. If large fines are levied in future, firms will be incentivised to go through a more formalised process because there’s more at stake. It is important the SRA has teeth but clarity is needed about how its powers will be used.’

But, as TLT’s Verry points out, the increased fining powers by the SRA need to be put into perspective by comparing it to other regulators, noting that deterrents are important and in all likelihood a £100,000 fine would only apply to extreme infringements. ‘When you compare to some of the other regulators, for example in extreme cases prison sentences apply for breaching money laundering regulations, £100,000 doesn’t sound that bad.’

Double indemnity

Surprisingly perhaps, given that the market for PII is generally considered to be soft for the top end of the legal market and the average cost of insurance has changed little year-on-year there is some surprising antipathy over the level of competition between insurers. Half of all respondents did not feel there was adequate competition in the market, compared to a third last year.

This seems strange given that nearly 60% of those taking part in the survey reported a decrease in the cost of the first £10m of their firm’s cover, while 41% said that the cost of their firm’s entire PII had gone down last year. But there is a distinction between fair pricing in the market and perceived competition. The leading firms represent an attractive proposition to the insurance market and so firms in the top 100 are able to use their power to negotiate their renewal terms.

‘There are a limited number of insurers in the market, and for some of these insurers, the larger firms are more attractive,’ says Mulligan. ‘Generally speaking, at present, at the top end of the market there has not been a big shift in the market.’

Neilson-Moore at Marsh feels that options are only more limited at either end of the profession. ‘The market is still diamond-shaped, with the very largest and the very smallest firms having the least choice at the primary level. On the layers of cover excess of the primary level (ie the ‘top-up’ insurance) there is enormous choice and competition. Even at the primary level, we are developing a dialogue with various insurers who have not previously participated there, so that there will be competition for our clients when they need it. There is plenty of room for negotiation, provided that the firm does not have a below average claims experience.’

Larger firms are having some success in securing value. Robertson at Eversheds says that last year a large number of top 50 firms moved their primary layer of insurance to a different provider. ‘My sense was that, by comparison to other years, firms felt they couldn’t negotiate with current insurers and had to move,’ she says. ‘I suspect that more insurers won’t rush to the market as firms have faced pretty significant claims. We’d all benefit from increased competition among insurers.’

Collins at the SRA says there are currently 31 insurance companies in the solicitors’ market compared to 24 last year, and he believes competition will increase now the ARP (the safety net for uninsurable firms, funded by the qualifying insurers) has gone, which was a ‘significant disincentive for insurers to enter the market’. Abolishing the ARP and adopting a zero tolerance policy on firms unable to obtain cover – in January the SRA controversially announced the names of 136 solicitor firms forced to close as they did not have PII – has given insurers a sense that the market is more robustly regulated.

And while there is room for manoeuvre, even with PII considered to be a law firm’s third biggest annual cost after staff and premises, some feel that haggling over the cost of premiums is counterproductive for major law firms. ‘At our end of the market it’s not about price, it’s about reputation and claims management relationships,’ says Riddick. ‘We’ve been with our insurers for more than 25 years and that’s significantly more important than any incremental increase in premiums.’

Lurking around the corner

2014 will not be another year of seismic regulatory change, according to Bird & Bird GC Roger Butterworth: ‘We’re not going to have many regulatory changes this calendar year I would have thought. On the horizon there might be more a review of the whole structure but that’s a few years away.’

Expect the SRA to be more robust in the short term, particularly if it breaks free from the shackles of the SDT and has the ability to levy larger fines itself. This may become more relevant as firms start to see an uptick in work coming in, particularly on the transactional side, as the economy starts to recover.

Harrison of Clyde & Co gives the example of firms failing to get their act together on compliance with court orders, particularly on costs, as an example of unnecessary risk taking. He mentions Mitchell v News Group International (the ‘Plebgate’ case), where the lawyers were prevented from recovering their fees as they didn’t comply with the court’s time limits for filing cost estimates.

‘Lawyers have become careless about compliance with court orders since the Civil Procedure Rules were introduced in 1999,’ he says. ‘However, recently there has been a real sea change here – it was rightly a focus of Jackson and it’s developed from there as a result of the Court of Appeal’s decision in Plebgate and subsequent judgments. As a result, we will inevitably see law firms being sanctioned by the courts for non-compliance and their clients, in consequence, suffering loss. It’s a major risk – the biggest recent development in the area of litigation risk, and it will be likely to lead to a rise in negligence claims now that the courts are enforcing timetables rigorously.’

With old mistakes reoccurring and new threats emerging, now is not the time for risk teams to sit back and reflect on a job well done. As any fan of movie thrillers knows, as soon as you drop your guard, you become a victim. LB

mark.mcateer@legalease.co.uk; david.stevenson@legalease.co.uk

Legal Business would like to thank Marsh for its sponsorship of this survey.