Risk management in the real world

There is a lot of talk about the importance of Risk Management and how it can be used most effectively. It is certainly a subject of topical interest. But what does it actually mean in the real world? And how do we get it onto our firms' agenda?

We have to start with our partners or members. Unless we have commitment from the top it is no more than a fringe activity. Three immediate problems come to mind -

1. How do you educate the omniscient? Partners know everything. They have been there. They have built up the business their way.
2. How do you educate the uninterested? How often do we hear - 'Not more of this management c**p!' 'I want to make money; not fill forms in.' 'I want to be a lawyer like Perry Mason!'
3. How do you educate the comfortable? 'We're doing fine'. 'There's lots of work coming in'. 'Gross fees are up'. 'We've managed to renew our insurance for another year what more do we need?'

So educating the leaders in our firm is not the easiest of tasks.

One solution might be the Dad's Army approach - 'We're all doooomed!' In other words we need a Risk Management strategy because we've got to have one, because if we don't the SRA will get us!

In one sense this is partly right. There is a regulatory incentive. The Code of Practice 2007, Rule 5.01 says- 'You must make arrangements for the effective management as a whole and in particular provide for ...... the management of Risk.'

In the guidelines to the Code at paragraph 39 we are told -

'Risk Management arrangements are unlikely to be considered adequate unless they include periodic reviews of the firm's risk profile.'

Paragraph 40 gives us a wide definition - 'Ideally the scope of the arrangements should not be confined to risks arising from professional negligence, but should extend to client related and business related risks of all sorts. A non-exhaustive list might include complaints (including a complaints log); client related credit risks and exposure, claims under legislation relating to such matters as data protection; IT facilities and abuses, and damage to the offices.'

So this can be an effective starting point. It is a compliance issue and the spectre of an SRA visit can concentrate the mind. But is a 'fear factor' alone going to 'educate' anyone? It can lead to a compliance or even cosmetic response.

If Risk Management is to become a central part of the culture of our firm it must therefore be directly relevant to that culture.

It is those of us who are leaders who need to get the message.

So before we write our policy we need to ask some basic questions about our business -

What type of firm are we?

What do we do?

Who do we work for?

Where have we been successful? (Partners love that one)

Where have we been less successful?

Where to we want to be in 1, 3, 5 years time?

And then -

What might stop us in our tracks?

What might bring it all tumbling down?

Where are we in danger of losing our hard earned money and reputation?

The question then moves from -'do we need an Risk Management policy'? to '... What steps should we take to protect what our partners have built up? How can we equip ourselves as we move forwards?

We all have different stories and differing firms.

So in this way we write our own definition of risk. It isn't what the management books say; it isn't even what the SRA say. It is about what might cause our firm to lose money and reputation. For example -

• - losing cases through sloppy preparation,
• - claims
• - complaints
• - poor risk assessment of cases so the success fees do not adequately compensate for losses
• - poor assessment of new clients - the one who has been with 5 firms and has current complaints with the LCS and is determined to go to Strasbourg
• - inappropriate Office Management Systems
• - paying for work; is profitable or just job creation?
• - poor HR - people leaving, unhappy, unmotivated

In this way the omniscient get involved, the uninterested sit up and the comfortable cease to be complacent.

How do we then achieve 'buy in'? Once the leadership is on board this is less challenging. And young lawyers are far more open to change as they don't have years of success behind them!

To achieve buy in though we must start by ensuring that we are a single business; a body capable of being 'bought into' and - not just a group of talented individuals. Are we a working unit or are we like an expensive group of football players who can't play together? That is another management issue! But it has to be the back-cloth for any form of buy in. Because risk management will only be effective as we see the need to work together - to mutually support each other.

After many years of practice I can say with some authority that lawyers have two basic needs -

• (a) to earn a living
• (b) to sleep peacefully in their beds.

So for example, there is the age old problem of the sceptic file. It is a familiar story. Something starts to go wrong on a case. So the fee earner puts the file to one side. They are scared to tell anyone, because it might reflect badly on them. They will not pass the file to someone else because they might lose the bill. So they are resolved to sorting it out themselves - tomorrow! In the meantime the file gets more and more sceptic so no-one dare go near it. A claim, complaint is on its way. Calls are not returned, client bad mouths the firm, and fee earner loses confidence - and so on....

It is completely different if we have a collective culture that says that we are all in it together. Who has ever woken up early and thought about work? It is a fact of life. It happens to us all. Once we know that then we deal with the problem together. Get rid of the sceptic file. Pass it to someone else - they will certainly have one that they would love to swap. Raise it at supervision. In that way the problem begins to be solved, the fee earner sleeps and the business is protected.

The same goes for claims and complaints - if they are buried then the complaint gets worse, insurers raise notification issues, fee earners become stressed. A supportive management approach can protect our money and our staff.

In my annual email about notifications I always say that we won't bite if you have made a mistake but we will do if you don't tell us. We must build into our culture an acknowledgement that things will go wrong - although we will do all we can to avoid them. Effective Risk Management ensures that they have support to enable them to get on with what they are paid for.

In this way they are buying in to something worthwhile.

And the key to this is supervision. Effective supervision is hard work but hugely rewarding. Supervision can either be the foundation of our Risk Management policy or a merely cosmetic exercise. So the conversation might go like this -

'We have to introduce supervision'

'Why?'

'Rule 5 says so - SRA will be looking out for it.'

'Better do it then'

So we end up with a series of 5 minute supervision meetings. Some forms are filled in and boxes ticked, there may be a cursory look at some files. And that's it.

If this happens a whole opportunity is missed. Professional people benefit from and want effective supervision. In other professions it is the norm. Supervision should be a regular and significant entry in the diary.

So how we make it more effective? And how do we train our supervisors? These are just some helpful guidelines -

• (i) Preparation.

A session which begins - 'Hello, welcome to your supervision meeting....erm....sorry what was your name again?' - is not likely to be effective.

• (ii) Before supervision takes place I tell the supervisor to get and read -
• (a) An open file list
• (b) An inactive file list - 3 months
• (c) Client ledgers
• (d) Files for review.

This helps promote discussion about case loads, potentially sceptic files, potential problems and enables us to get an overview.

(iii)

• (a) The supervision meeting itself is just that - it is not a disciplinary meeting. That must be made clear. So you might say - 'I notice that nothing has happened in the case of Jarndyce for 11 years. I was just wondering whether you could do with some help' or '600 files does seem an awful lot of cases. Would you like to offload some of them?' You can discuss particular issues arising from reviewed files.
• (b) Listen and respond to feedback,
• (c) Record the outcome. This is not just to show the SRA that it has been done. It is to track progress, to see how we have got on, to monitor follow up and ensure that support is given.

I am a convert to Risk Management. There is nothing quite like a convert to irritate everyone else! But effective Risk Management can revolutionise our business. By effective education it can be made something relevant to your firm. It has be part of a corporate culture and backed by effective and sensitive supervision.

This is a summary of a lecture given by Steve at the 5th Annual Risk Management for Law Firms Conference in London on 3rd December 2008. Steve is Deputy Managing Partner with EAD Solicitors LLP and Joint Honorary Secretary of Liverpool Law Society.