Welcome to the Regulation & Compliance Office’s fortnightly roundup, where we look at all the latest stories to keep you ahead and informed in the world of law and compliance.
The RACO roundup is just another way in which we keep the solicitors and other law professionals we work with in the know, so we can ascertain you are never missing the vital developments occurring in your profession.
Below, you will find the most recent headlines selected by our compliance experts, followed by a Security Section, where we will also give you an overview of the latest scams currently impacting solicitors and their clients.
***
How Your Law Firm Can Establish Effective File Reviews and Audits
File Reviews and Auditing within law firms is a subject that, for many, is uncomfortable as it is a diversion of valuable resources and is time-consuming.
It is not uncommon for the file review process to fall into a ‘tick box’ exercise, with the supervisor going through the motions to hit an auditing number rather than actually spending quality time on the review. While it is understandable, this cannot be acceptable, as a firm that adopts this approach puts itself at risk, not only with the Solicitors Regulation Authority (SRA) but also with its Insurers.
The Regulation and Compliance Office (RACO) works with both law firms and professional indemnity insurers and, as a result, sees, at the front line, how firms engage with the file review process with mixed results.
What is clear is that those firms which have directed file reviews focused on what is important and do not audit to ‘hit numbers’ have a significantly improved risk profile that is actively demonstrable to external influencers.
This article provides firms with an insight into how they can manage or adopt their file review/auditing strategy to effectively direct resources and, importantly, review what is important with a significant diversion of supervisors’ time, but also meets the requirements of the regulator and insurers.
Key Stages and Considerations of Effective File Reviews
A structured and effective file review and auditing programme is central to a firm’s approach to risk, compliance and regulation. Below, we cover key considerations of effective file reviews and audits:
- How and When Should Files Be Reviewed?
How should files be reviewed? – A standardised approach to file reviews is always more effective. A generic audit form can be created for many standard areas of law, providing direction and structure. For areas of law that are more bespoke, such as property, a more specific audit form can be generated to direct the auditor on key issues to consider and focus on key supervision touchpoints. Standardised audit forms provide structure, direction and, importantly, focus, and in our view, are a must.
Determine what the audit is looking for. For example, is it a process and procedure audit or a technical audit? The former will be quicker and more general, whereas the latter will be focused and specific on a technical area and will require an experienced auditor to undertake the review.
How often should files be reviewed? – File reviews should be undertaken at regular intervals, and the size of the firm, the type of work it performs, and the number of fee earners (including their experience) will dictate when and how often file reviews should take place.
In some areas, such as property, a monthly file review is appropriate – and a requirement of the CQS accreditation – but file reviews can be more spread out in other areas and those which are not driven by an accreditation. When RACO is engaged with larger firms, we tend to recommend a quarterly file review process, to ensure there is sufficient time between audits for issues to be addressed and rectified. In our experience, reviews at an increased frequency tend not to be as effective as analysing results, and taking rectifying action is not always practical between audits.
For smaller firms, particularly those with only a handful of fee earners, an annual review or potentially six-monthly is appropriate.
A firm must look at its infrastructure and the work it performs and build a file review process that will work for them, taking into consideration its needs and resources.
Including the expertise of external resources can also ensure that file reviews get completed in line with the overall auditing strategy.
- Determining Which Files Should Be Reviewed
This is an essential part of the file review and auditing process. A random selection of files does not always work. While a random audit means that any files could be pulled, the reviews are often not as random as intended.
It is our view that file reviews should be directed alongside some random selection. An effective file review process should include the following: -
- High risk matters – review and focus on the files that have been identified as high risk in your risk assessments. The firm should have a high risk register identifying cases which have hit this categorisation. These files should be front and centre of the audits. It is not a problem auditing the same file multiple times if this file is high risk.
- Closed Matters – a sample of closed files is always important to confirm that matters have been resolved effectively.
- Random selection – as already highlighted, a random selection of files can assist the audit process, as it means that there is complete impartiality to the file selection, but they must be truly random.
- Targeted matters – review files with potential issues or are at critical stages. For example:
- No time posting for 90 days
- Aged client balances
- Matters set down for trial
- High risk (referred to above)
- Complaints (to follow up to ensure the matter is now on track)
- Complex key or difficult clients
- Trainees and juniors – making sure the less experienced staff are well supervised.
A firm should understand the nature of its work and files and be able to direct audits to important stages and touchpoints to ensure the correct files are being reviewed.
Also, consider how many files should be seen. A department with high volumes, low complexity, or value may have more files looked at as opposed to a high value complex department, which will need to review fewer files as it should follow that fee earners will handle fewer cases and are probably senior in their own right.
Read the full article here.
***
Solicitor of 50 Years Practice Fined for Breach of Undertaking in Property Deal
A solicitor with 50 years’ experience has been fined by the Solicitors Disciplinary Tribunal. The tribunal heard that a sole practitioner with a Bedford-based firm acted for a seller in a conveyancing transaction when they were subject to a complaint by the buyer’s solicitors.
The firm making the complaint claimed the solicitor in question breached an undertaking after a restriction on the title of the property was not removed, causing the buyer’s application to register the property at HM Land Registry to be rejected, thus resulting in considerable loss of time and finance.
When speaking to the Solicitors Regulation Authority, the solicitor denied giving an undertaking despite agreeing to the Law Society’s code of completion for the transaction. The solicitor also completed and sent the Law Society completion information and undertakings form TA13.
When communicating with the SRA, the solicitor stated: “I clearly indicated to [the other solicitors] during the conveyancing process that forms RX3 and ST5 could be provided to enable the restriction on the proprietorship register of the title to be cancelled.”
They went on to explain: “I do not believe that I gave an “undertaking” as such. If I give an undertaking, I actually use the word “undertaking”. The SRA submitted to the tribunal that the provision of the RX3 and ST5 on completion were undertakings and were clear, unequivocal declarations of intention addressed to the buyer who placed reliance on them.
The solicitor (who did not attend the hearing and was not represented) acknowledged that it took far too long to make the application for the Land Registry to cancel the restriction in the proprietorship register of the relevant title. Regardless, the tribunal found that the agreement to complete in accordance with the completion code was indeed an undertaking.
The SDT concluded that the solicitor “had provided an unequivocal and categoric confirmation that [they] would provide the documentation upon completion. That confirmation was reasonably relied upon.” It also added that the fact that the solicitor “did not expressly use the work undertake or undertaking did not mean that he had not provided [it].”
Qualified in 1975, the solicitor reportedly failed to cooperate with the SRA investigation after missing various deadlines for responses. He had furthermore been fined £15,000 by the tribunal in 2019 for failing to return client monies promptly and failing to progress at least five probate matters.
Lastly, they were fined £17,500 and ordered to pay costs of £5,500. The solicitor was also barred from acting as a sole practitioner for 18 months.
See full article here.
***
Data Protection and GDPR For Solicitors – Protecting Your Firm and Ensuring Compliance
Cyberattacks against law firms are one of the biggest threats facing the legal industry, with the number of successful cyberattacks against UK law firms on the rise. Law firms are known to hold vast amounts of sensitive personal and financial data, making them prime targets for cyber criminals.
Law firms must take their compliance with GDPR obligations seriously and detail how their data is protected, ensuring that robust and effective policies, controls and procedures have been implemented. Without appropriate cyber security defence measures, firms leave themselves open to data security threats and sanctions from industry regulators for breaching the requirements.
Below, our compliance team takes a closer look at the requirements and steps firms should be taking to ensure they are meeting regulatory requirements.
Data Protection – Your Responsibility
Law firms are entrusted with sensitive and confidential information from their clients and staff, making managing, controlling, and protecting data an essential element of their compliance and regulatory strategy. Firms should also be mindful that Rule 4.2 of the Code of Conduct for individuals and Rule 5.1 of the Code of Conduct for firms, places an obligation on the profession to ‘safeguard money and assets entrusted to you by clients and others’.
A failure to implement the necessary policies and procedures to manage, control, and protect this data can result in severe consequences for law firms. Not only will they be in breach of legislative requirements, but they will also be in violation of their SRA code of conduct. These failings will put them at risk of facing regulatory scrutiny and could expose them to reputational damage. Read our previous article – Cyber Security Failures Leave Firm in Hot Water with ICO.
Policies, Controls and Procedures
To ensure that they comply with the requirements set out by UK General Data Protection Regulation (the UK GDPR), the Data Protection Act 2018 (the Data Protection Act), and the EU GDPR, law firms must have appropriate data protection policies in place. These policies should be designed to manage and control the significant amount of personal data that law firms handle regularly. As standard practice, firms should implement and approach policies that include:
- A data protection policy that details how the firm protects, uses, and manages data.
- A data protection notice that is issued to clients confirming how the data is used, protected, and processed.
- An IT Security policy that sets out how the firm manages and controls cyber risks
- Training for staff on the firm’s policies and procedures.
- Consent (Positive opt-in) for the use of data.
- A Data (GDPR) annual audit to establish the effectiveness of the firm’s data protection approach.
Appointment of a Data Protection Officer
One of the other requirements of GDPR is that firms that handle sensitive personal data on a large scale must appoint a Data Protection Officer (DPO). However, determining what constitutes “large scale” can be subjective and may vary depending on the size and nature of the firm. You can read guidance from the Law Society here: Appoint A Data Protection Officer (DPO)
Regardless of who is responsible for data protection, firms need to appoint someone who is knowledgeable in data protection law and understands how the firm collects and uses data. This may involve collaboration between different departments within the firm, such as marketing and IT, and may require the advice of an in-house data protection lawyer or external specialist.
It is essential that the data protection lead instils good practices throughout the firm. This role requires not only personal expertise and authority but also support and commitment from the firm’s management team.
If a firm is legally required to have a DPO and resources or expertise are unavailable in-house, it can appoint an external service provider to fulfil the role, such as the compliance specialists at The Regulation and Compliance Office. We work with firms of all sizes to implement effective data protection policies, controls, procedures, and GDPR Audits as part of an overall compliance structure.
By taking these steps, firms can ensure they are complying with GDPR and protecting the privacy of their customers’ personal data.
Read full article here.
***
Taskforce Urges Firms to Lead Client Vetting Overhaul
A London-based law firm has become the first to embrace the six-step client ‘gating process’ after an IBE taskforce argued it was desperately needed to change the profession’s reputation as a conduit for dirty money.
‘For several years we have been working to enhance the principles on which we base our business acceptance decisions, beyond the minimum regulatory criteria,’ said the firm’s risk and funding partner on its decision to adopt the gating process. ‘We urge other law firms to similarly endorse the principles.’
Established in the wake of Russia’s invasion of Ukraine to probe the role of solicitors in advising oligarchs and kleptocrats, the taskforce was led by Guy Beringer CBE KC (Hon), a former senior partner of a multinational law firm headquartered in London. The taskforce also reviews how UK law firms decide whom to represent in the context of “kleptocracy, state capture and grand corruption”.
The taskforce calls on firms, when considering whether to take on a client, to apply an ethical framework that goes beyond observing the letter of the law. Its view is that complying with anti-money laundering regulations is not enough on its own, and further steps are required to “return the legal profession’s responsibility to the public interest to the heart of the client acceptance process”.
In addition, the taskforce calls for a “legitimate provenance of wealth test”. This would require credible explanations for clients’ wealth and “address gaps in AML frameworks”. It is estimated that between $660bn and $1.26tn of illicit funds enter the global financial systems annually. This wealth is often facilitated by professionals working within legal frameworks but “at the edge of ethical boundaries”.
The taskforce stated that the profession should be leading the client vetting overhaul and that if improvement wasn’t forthcoming within two years, “alternative approaches” should be considered.
The Solicitors Regulation Authority and other regulators, however, must “articulate the principles by which law firms can reconcile their professional duties with the public interest”. This would include clarifying guidance in regard to how the principle of access to representation still “affords a law firm discretion over whether to act”.
“The recommendations do not aim to dismantle traditions; they mean to strengthen them”, said Taskforce leader Guy Berringer. “As lawyers, we must adapt to a rapidly changing world while upholding our longstanding responsibilities to society. Trust, accountability and responsible leadership are no longer optional. They must be placed at the heart of the profession if we wish to restore public trust and ensure a continuation of service. This report lays out a roadmap for change.”
At the standing-room-only launch, Beringer went on to discuss the threat of legislation if the profession did not take more prompt action. It was also noted that Labour peer Baroness Hodge is also calling for the creation of a new criminal offence that would see lawyers being prosecuted for failures to stop money laundering.
Law Society president Richard Atkinson stated, “Law firms often have sophisticated client onboarding approaches which factor in a whole range of issues. These approaches are underpinned by the firm’s own institutional values which should be rooted in strong professional and business ethics and adhere to the SRA framework of professional obligations, rules and guidance.”
Read full article here.
***
SC A M A LE R TS
www.lawmaster.info’ is operating and claiming to employ a Jack Andrew as an attorney
The SRA has alerted the public that the website ‘www.lawmaster.info’ is operating and claiming to employ a Jack Andrew as an attorney.
The website also provides an address of genuine firms of solicitors and a telephone number of ‘+447451295201’. Please note that the SRA does not authorise or regulate a genuine firm of solicitors called ‘Law Masters’ or ‘Law Master’.
Any business or transaction through the website address ‘www.lawmaster.info’ or the telephone number ‘+447451295201’ is not undertaken by a firm or solicitor authorised and regulated by the SRA.
Please note, however, that the SRA does authorise and regulate a genuine solicitor called Jack Andrew, who is employed by Masters Legal Costs Service LLP.
Jack Andrew has confirmed that he does not have any connection to the above website or telephone number.
*
Emails that misuse the name of Rafael Singer and Summerfield Browne Solicitors Limited
The SRA has alerted the public that emails have been sent falsely claiming to be from a genuine solicitor and firm of solicitors in relation to a supposed unclaimed inheritance.
The email seen by the SRA was sent from the email address ‘rafael.singer@summerfieldandbrowne.co.uk’ and uses an old logo for a genuine firm of solicitors.
Please note that any business or transaction through the email address ‘rafael.singer@summerfieldandbrowne.co.uk’ is not undertaken by a firm or individual authorised and regulated by the SRA.
Also, please note that the SRA authorises and regulates a genuine firm of solicitors called Summerfield Browne Solicitors Limited. Emails from the genuine firm use the domain ‘@summerfieldbrowne.com’.
The SRA also authorises and regulates a genuine solicitor called Rafael Singer who is a consultant solicitor with Summerfield Browne Solicitors Limited.
The genuine firm has confirmed that neither it nor Rafael Singer has any connection to the emails referred to above.
BEEN CONTACTED?
Here’s What to Do…
When a firm’s or individual’s identity has been copied or cloned, due diligence is necessary. If you receive correspondence you believe to be suspicious, you should conduct your own due diligence by checking the authenticity of the correspondence by contacting the law firm directly by reliable and established means.
You can also contact the SRA directly to find out if individuals or firms are regulated and authorised by the SRA and verify an individual’s or firm’s practising details. Other verification methods, such as checking public records (e.g. telephone directories and company records), maybe required in other circumstances.
Reach Out to RACO
We at RACO are always at hand to provide tailored guidance to help you make the most informed and beneficial decisions. We help you understand the recurrent regulatory shifts and work with you to provide solutions. With our team of professional specialists and our renowned legal expertise, we can work with your firm to ensure you are never left unprepared in the wake of legal changes or cyber threats.
For more information on how we can help, call our consultants on 0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk
