How has the pandemic impacted risk management in SME law firms?

Cathryn Selby, partner and director of professional standards at Nelsons, answers some questions around risk and compliance trends in SME law firms.

Risk and compliance Q&A with Cathryn Selby at Nelsons.

Q. What have been your top priorities when it comes to risk management in a Covid-19 world?
A. We started getting our priorities in order weeks before the first lockdown was announced on 23 March by testing all of our IT and accounting systems to ensure they’d cope with the whole team working from home.

This meant that when we were instructed to make that immediate transition to home working, we were able to have 80-85% of our staff seamlessly logging on from home the next morning – with the remaining 10-15% in the same position by the end of the week. It’s been a real testament to our IT team that, since March, we have been able to continue with business as usual, empowering our clients as we always have done but in a whole new way.

Another key contributor to this year’s success has been due to communication – at all levels – with clients, partners and staff alike. We felt it was vitally important that we kept people fully informed about how Nelsons was responding to the environment created by the pandemic.

Like many firms, we looked into how we could use technology to keep in touch and quickly adopted Microsoft Teams so we could continue to serve clients efficiently. We also increased our PR and social media activity to provide that ongoing presence. And we had an intranet with daily updates for partners and staff, which includes a blog from our CEO where he gives a roundup of what’s taken place over the past week.

We were also commended by the Lexcel assessor on our combination of formal and informal supervision throughout all departments, particularly our regular ‘beers with ears’ sessions, during which staff can get together virtually to talk about whatever is on their mind – whether that’s related to work, home life or both.

As the world moved online almost overnight, one of the main threats we’ve seen reported has been in relation to cybersecurity. Therefore, we provided additional training and raised the profile of this risk internally, reminding people of practical tips such as using complex passwords to ensure the safety of our staff and clients’ data.

The past nine months have seen the continual revision and revisiting of policies and systems to reflect the fact that supervision now has to be undertaken remotely, ensure that the lines of escalation are clear, and that our teams are properly resourced and feel supported. Living in lockdown has been very difficult for some people all the time and hard for others some of the time – we want our staff to know it’s ok to admit it.

Q. How has the Lexcel accreditation prepared you for any increased risks? What was the process like this year?
A. As our systems have worked so well, even in lockdown, the Lexcel process was very similar to last year but the main difference was that interviews were conducted remotely. We consider the results of the audit to be an achievement on behalf of the whole firm but there are always ways to improve or to approach things from a different angle.

Our Lexcel assessor is always very helpful with her feedback and has given us some specific examples of best practice for us to think about and consider how we might incorporate those into our policies and procedures. For example, we were asked to consider the use of social media platforms and text messages on client work. This was to ensure that it didn’t become too informal and risk prejudicing correctly kept record keeping – something that’s easier to lose track of when everyone is working from home and using smart phones. We have a document management system and will be considering whether we can integrate text messages into that.

Q. What changes did you have to make around how risk is assessed, measured, visualised, reported on and communicated?
A. Honestly, and this can be considered a success in itself, we’ve not had to make any significant changes during the pandemic. We revisited our business continuity plan earlier in the year to see how it held up to the reality of a pandemic and only made some minor additions to deal with scenarios such as very lengthy lockdowns. Fortunately though, we already had very solid systems in place.

We’ve increased the frequency of the meeting of our professional standards team from monthly to weekly to reflect the fast-changing nature of the pandemic and ensure we’re kept up to speed with events. Additionally, we’ve been vigilant in observing developing trends and, where we have seen the suggestion that a particular set of circumstances might be becoming more regular, we’ve briefed the relevant teams. However, this is something we have always done regardless of the circumstances.

In the latest accreditation, we were commended for having such a robust attitude to risk and compliance and our arrangements for communicating risk information – both of which are at the very heart of the Lexcel Standard.

Q. Have you had to change how the firm handles data or mitigates risks involved in client processes (things like ID checking, AML and so on)?
A. Understandably, we have had to adapt how we deal with client due diligence and the on-boarding of clients – for example, making sure that we visually see clients by use of technology so as to check their identity. We’ve also created protocols and policies about attendance at the office and client or third-party meetings.

We’ve been able to keep all fee earning employees working from home but still have a core team of admin staff in the offices; it has been very important to us to make sure they feel they are in a Covid-19-secure environment.

Another big change is how to successfully bring new staff into the business. We’ve been incredibly fortunate to have made some great appointments and lateral hires during lockdown and have gone the extra mile to make sure they feel brought into the Nelsons fold. This has included ensuring they’re properly introduced and embedded in their teams and trained on all our processes and procedures as every new starter before them has been.

Some of this process would have previously evolved organically when we were all working side by side in the office but we have recognised there has to be extra support while we are working remotely and have successfully implemented this with all of the new members of the Nelsons team.