Professional Services Group - Risk

1 aon risk Solutions Global and Specialty Clients | Professional Services Group Professional Services Risk Bulletin | aon risk Solutions | Global & Specialty Clients, London | Professional Services Aon UK Limited is authorised and regulated by the Financial Conduct Authority 1 aon risk Solutions Global and Specialty Clients | Professional Services Group Professional Services Group Risk registers a practical approach for solicitors 1. Executive summary A risk register is a business tool commonly used in project management to list all the risks identified within an organisation. The probability and impact of each risk are assessed in order to evaluate priority, a control measure is applied and a risk owner assigned to address and monitor the risk within an assigned timeframe. The register is then used as the key source of risk information within the business.

2 Businesses today are required to manage more risks than ever before and with the increased complexity of compliance representing a risk in itself, risk registers are becoming commonplace as a means of tackling the ever growing challenge of risk management. It is possible to buy risk register software either on its own or as part of a more comprehensive package of compliance solutions, but it is not necessary to commit to this financial outlay. For the majority of firms, it will be sufficient to use a spreadsheet prepared in-house with internal processes to control and review the firm s risks . This paper deals with the basic concepts of a risk register, why it is necessary for law firms, how to start working on one and how to develop an existing risk register. It is intended to assist those who are about to prepare a risk register for the first time and to offer up some ideas for further development to those already well underway with this process.

3 We have also included a template containing some examples of how risks might be addressed in a risk register. 2. Regulatory requirements On 6 October 2011, the Solicitors Regulation Authority ( SRA ) introduced a new risk-based approach to regulation. Outcomes-focused regulation ('OFR') came into effect providing firms with the flexibility to decide how to achieve the right outcomes for their clients. The new regulations are set out in a Handbook ( the Handbook ) which brings together in one place all the regulatory obligations applying to those regulated by the SRA. There are many examples of Principles, outcomes, rules and other requirements in the Handbook (which includes the SRA Code of Conduct 2011), which address the need to manage risk. Firms should focus on these when considering the introduction of internal compliance processes and risk governance.

4 They include: Professional Services Risk Bulletin | aon risk Solutions | Global & Specialty Clients, London | Professional Services Aon UK Limited is authorised and regulated by the Financial Conduct Authority 2 Principle 8 Run your business or carry out your role in the business effectively and in accordance with proper governance and sound financial and risk management principles. Outcome You have a clear and effective governance structure and reporting lines. Outcome You have effective systems and controls in place to achieve and comply with all the Principles, rules and outcomes and other requirements of the Handbook, where applicable. Outcome You identify, monitor and manage risks to compliance with all the Principles, rules and outcomes and other requirements of the Handbook, if applicable to you, and take steps to address issues identified.

5 Rule (b) SRA Authorisation Rules Run your business or carry out your role in the business effectively and in accordance with proper governance and sound financial and risk management principles. Guidance note iii to Rule 8 SRA Authorisation Rules Firms will need to analyse the effectiveness of their compliance and monitor effectiveness on an ongoing basis once authorised. Common areas for consideration will (g) a system for monitoring, reviewing and managing risks . Guidance note x to Rule 8 SRA Authorisation Rules Firms will need to keep appropriate records of failures in compliance to (e) monitor overall compliance with obligations; (f) assess the effectiveness of the firm s systems; (g) be able to decide when the need has arisen to report breaches which are material because they form part of a pattern. IB Identifying and monitoring financial, operational and business continuity risks including complaints, credit risks and exposure, claims under legislation relating to matters such as data protection, IT failures and abuses, and damage to offices may tend to show that you have achieved these outcomes and therefore complied with the Principles.

6 Professional Services Risk Bulletin | aon risk Solutions | Global & Specialty Clients, London | Professional Services Aon UK Limited is authorised and regulated by the Financial Conduct Authority 3 It is generally accepted that the most effective way of demonstrating compliance with the obligations listed above is through a risk register. This tackles head-on the requirement to identify, monitor and manage risks as well as having a positive impact on risk management processes and reporting lines. Press coverage of recent firm collapses highlight the potential consequences of over-leverage. This is a problem which the SRA is seeking to prevent in the future with its emphasis on effective firm management within the Code of Conduct and more widely in the Handbook. Risk appetite is seen as something which an organisation should keep under review in order to maintain the effectiveness of its risk management and business continuity arrangements.

7 A risk register should enable a firm to gauge the level of current risk exposure within the business so that this can be factored into any new strategic decision. It should provide for a more enlightened evaluation of a firm's ability to comfortably absorb additional risk. 3. The advantages of a well-constructed register Meet the obligations of the SRA Handbook. Reassure the SRA that the firm is taking its duty to identify and mitigate risks seriously and that it is instituting appropriate controls to manage risks to the business. Improve internal risk management processes. Heighten risk awareness within the business. Provide support to the Compliance Office for Legal Practice ('COLP'), enabling him to carry out his role to ensure that the firm complies with its regulatory and statutory requirements, and that the firm has systems and controls in place to comply with its obligations.

8 Promote collaboration within the firm since input is needed from across the firm's practice and support groups to compile a comprehensive risk register. Provide for contingency planning with the formal capture and consideration of emerging risks , enabling firms to respond quickly and appropriately to what might previously have been unforeseen events. Facilitate prioritisation of identified risks , development of plans for mitigation and risk tracking, and the means to reduce the potential impact or avoid some risks altogether. Provide the firm with a useful management tool which can be used as an indicator of the firm's current tolerance for risk and as a guide for appropriate future risk appetite when considering important strategic decisions, new office premises, change of major business supplier, focus on a new area of expertise, expansion plans through a significant lateral hire, merger or additional office.

9 Allow for identification of business opportunities as a result of examining and documenting challenges to the business in the risk register. This might involve expanding into new markets or territories or improving efficiencies. Consolidate in one place and communicate clearly to the reader those key risks that need to be managed in order to support the successful delivery of the firm's priorities and challenges and to enable opportunities to be maximised. Professional Services Risk Bulletin | aon risk Solutions | Global & Specialty Clients, London | Professional Services Aon UK Limited is authorised and regulated by the Financial Conduct Authority 4 Useful to analyse the impact of business risks on projects and processes undertaken by the firm. - Evidence of formal commitment by the firm to develop and implement actions to manage risks to an acceptable level and within an agreed timescale.

10 - Reassure partners that there are effective systems in place to manage business risks . - Allow for coherent thinking in a complex business environment. - Use for training purposes in risk management, regulatory issues and business continuity. - Clients frequently choose to work with Professional service firms which have similar values and work ethics to their own. This can extend to enquiries in a tender process about how firms handle risk internally. Well run companies will almost certainly use risk registers and being able to show that a law firm also adopts this approach will reassure current and future clients of the firm s serious approach to risk management. - Building risk awareness and ownership help to enable a risk culture . As an ongoing tool it is a valuable asset in brand protection.