managingrisk - home | lockton...managingrisk managingrisk - winter 2012 table of content mark...

Winter 2012

ManagingRisk

w

ManagingRisk

ManagingRisk - Winter 2012

Table of content

Mark Whittell - CobbettsEmbedding Risk Management Culture In Law Firms 01

Allegra Benitez Moatt - CKFT SolicitorsThe Importance Of Being Earnest 03

Simon Gildener - Clyde & CoFormalising Risk Management Within Your Firm 05

Steve Holland - Lockton Companies LLPThe 2011 PI Renewal Season At A Glance 07

Megan Howe - Robin Simon LLPCan You Ever Have Too Much Information? 09

Sheona Wood - FishburnsRisky Business Or Doing What Comes Naturally? 10

EditorSheridan MadgeT: 02079332204E: [email protected]

DesignerHector OsholakeT: 02079332731E: [email protected]

PR Chris Don T: 02079332634E: [email protected]

General PI Steve Holland T: 02079332726E: [email protected]

Winter 2012

Winter 2012 - ManagingRisk

ManagingRisk

he single question I hear most from Risk

Managers and Risk Partners is “We have the

procedures in place. How do I get my fee

earners to follow them?” Since OFR incept-

ed, I’ve been hearing it even more.

The short, deeply unsatisfying answer is “instill a

pro-risk management culture in the firm”. Building

a risk management culture is easier said than done,

and not just because it involves a lot of work. Not

only is there no blueprint - the way in which firms

nurture an internal risk management culture

necessarily vary enormously according to the unique

style and business objectives of each – but even

when the process is meticulously planned and

pursued, it’s going to take awhile.

To make things a little easier, we’ve collated the

thoughts of a number of experts in the field of risk

management for law firms on this subject. Here they

consider a number of issues, ranging from how to

get the buy-in of all staff, including senior

management, to the idea of risk management culture

to how to assess risks facing the practice as a whole

(and evidencing that assessment to the SRA) to

supervision, process and training.

Hopefully this will provide a useful springboard for

you in considering your own firm’s efforts to build its

own risk management culture.

Pam Grover Mitchell, Risk Management Executive

020 7933 2639 [email protected]

Lockton Companies LLP

to the winter 2012 edition of Managing Risk

Winter 2012

TWelcome

Still, a firm with the world’s most gold-plated risk management system will not benefit until the firm’s culture supports its use. Whilst solicitors may pay enthusiastic lip service to risk management, it is often seen as an administrative task and is sidelined whenever there is fee-earning work to be done. As a result, embedding a risk management culture is not easy. Here are ten tips which may assist:

1. Avoid mystery. Risk management is sitting down with your colleagues, thinking of every

factor that could stop the firm/practice area/team from achieving its goals, ranking those risks in order of priority and adopting mitigation plans for the top five.

2. Design your risk management system specifically for your firm. Your firm will have its own style, work profile and most importantly, its own characters; one size does not fit all.

3. Get senior management’s buy-in. If junior lawyers see senior members of the firm as interested in risk management then they are far more likely to take it seriously.

4. Embrace risk management in its totality. Risk management is more than a compliance tool to help firms fall on the right side of applicable legislation and keep the SRA happy; far greater benefit can be had by looking at the risks firm wide. We have conducted Cobbetts’ risk evaluations on everything from the adequacy of our AML procedures, to the effect a double dip recession might have on us, to a catastrophic IT systems failure, and to the scope of our engagement letters.

5. Sell risk management to colleagues as simple, universal and common business sense. Plcs have to have risk management; law firms are no different.

OFR reflects the SRA’s recognition that risk management is essential to a law firm’s daily operation. Principle 8 requires firms to run their businesses “in accordance with...sound financial and Risk Management principles.” Specifically, Chapter 7 stipulates that firms must;

“...identify and monitor risks in compliance with all the principles, rules and outcomes and other requirements of the Handbook...and take steps to address issues identified” (7.3) and,

“...maintain systems and controls for monitoring the [firm’s] financial stability...and risks to money and assets entrusted to [the firm] by clients and others and... take steps to address issues identified (7.4).”

EMBEDDING RISK MANAGEMENT CULTURE IN LAW FIRMS

ManagingRisk Winter 2012

01 ManagingRisk - Winter 2012

6. Remind fee-earners of the third parties with an interest in the firm’s risk management – not just the SRA but also insurers, who increasingly want to see firms firmly embed their risk management cultures. In a hard insurance market, embracing risk management can mean the difference between attracting a reasonable or hefty insurance premium – and, in extreme cases, becoming uninsurable.

7. Use training. This can demonstrate the common sense benefits of risk management to junior fee-earners (which helps risk management culture to spread from bottom up as well as from the top down) and plug any holes you discover in the firm’s risk management procedures. Use CPD points as a lure for fee earners who need to learn more about risk management – I strategically arrange our CPD-accredited risk management training around September and October.

8. Use external speakers to further your agenda. Our insurers present a humorous but to the point, risk management DVD involving a young solicitor, his pernicious supervisor and a messy real estate transaction. When I ran it with CPD points, not only did we get 10% of the firm’s CPD points in one hit, but everyone was suddenly interested in talking about risk mitigation.

9. Devise a dynamic system which suits your firm and the characters within it. People may readily accept the necessity of developing a risk plan, but if they see the risk team’s job as to take the risk away (not to facilitate risk

identification and the development of appropriate risk reduction plans) they may not be ready to follow that plan. Cobbetts operates a risk traffic light system: if risk plans fall one month behind in implementation, they show up in amber rather than in green on internal reports. After three months, they turn to red. This gives us both a reporting carrot/stick mechanism, and a tool which enables the risk team to monitor plans at a glance, and intervene if necessary.

10. Keep risk plans simple. Limit them to five action points for the highest-priority risks, designate someone responsible for each of those actions and timetable them. Do not aim for exhaustive detail: solicitors tend to spend too much energy drafting the perfect plan and far too little on implementation. Achieving 70% of something simple is better than achieving 0% of something perfect but verbose, and which took far too long to produce.

Finally, remember - there is no quick fix. A risk culture cannot be established in a law firm in a year. Instead of perfection aim to improve your firm’s risk culture year on year – and persevere!

Mark Whittell, Risk Partner

Cobbetts

EMBEDDING RISK MANAGEMENT CULTURE IN LAW FIRMS

ManagingRiskWinter 2012

Winter 2012 - ManagingRisK 01

Allegra Benitez-Moatt, Solicitor and Senior Associate

CKFT Solicitors



Buried within the Practice Framework Rules is the suggestion that firms prepare a compliance plan. If drafted, implemented and monitored appropri-ately, it should help firms prioritise business and risk management needs; provide standards and a framework for staff, and constitute evidence of compliance which can be provided to the SRA on request.A compliance plan must be appropriate for the firm and the needs of the clients; it is very unlikely that a sole practitioner will need the same processes as a multi- partner firm. Areas to cover may include:• Management - effective structures; compliance

officers; compliance with statutory and regulatory obligations.

• Business-contingency planning; finance management; equality and diversity.

• Staff - vetting; training and development; supervision; outsourcing.

• Client - client care standards; complaints; control of undertakings; accounting procedures; safekeeping of client money and assets.

Don’t be afraid to seek external assistance or training on the creation of the plan. A fresh pair of eyes or guidance from the experts can save you a lot of time and help you get it right first time. Staff can be encouraged to engage with the plan through:-• Education - appropriate training on the

Handbook, need for risk management policies, and the plan.

• Consultation - staff can identify areas of risk and solutions, and key personnel (senior management, accounts, IT, HR, compliance officers) should contribute to creating the plan.

• Information - understanding the real costs of non-compliance (loss of billable time and fees; increased insurance premiums; fines and compensation).

• Participation - senior management to communicate clearly and openly about risk management; create a no-blame culture, and actively encourage ideas, action and feedback.

Finally, once created and implemented, the plan will need to be kept under frequent review and revised to remain relevant, effective and responsive to the changing needs of clients and the business.

The importance of being earnest….

About instilling a risk-management culture within law firms has been recognised by the SRA as central to achieving consumer protection, so much so that business management has been elevated to Principle status under the new regulatory framework.

owever, my seven years at the SRA showed me that changes in policy filter down slowly, and that firms (no matter how willing or able) often struggle to understand (and implement) the new culture. This time-lag was notable in 2007 when the rules changed (even though they were prescriptive rules, backed by considerable guidance and supported by practice standards visits). Four years later, the rules have changed again, but this time to flexible, outcome-focused requirements which deliberately refrain from imposing rigid rules. Firms must therefore work out for themselves how to run their

business effectively and with proper risk management in place.

with a compliance plan

H

Plan for change ManagingRiskWinter 2012

Winter 2012 - ManagingRisk 04

Formal i s ing Risk Managementwithin your Firm

Whichever approach to RM an organisation chooses, it needs to be embedded into the culture of the entire organisation to be effective. Embedding RM requires clarity of thought, clarity in communication, and consistency in delivery. Organisations must be able to explain to their employees in easily digestible form what their risk appetite is, what risk they face, and how that risk is to be controlled. The clearer this message is, the easier it is to be consistent. It follows that there is much to be said for a formal, documented framework.

Beyond the obvious practical benefits of formality, there are regulatory benefits too. The OFR regime demands effective systems and controls. This requires evidence that those systems and controls are in place. Just saying, “Of course we already do these things – it is part of what we do,” means little if it cannot be proven when challenged.

A risk register is often a good place to start. It should be accessible to all. It should be comprehensive in scope, without being so overwhelming in detail that people are deterred from referring to it. For example, addressing E&O risk in a multi-disciplinary organisation at a micro level would render the document unmanageable. The register should also be reviewed and updated regularly, to reflect the ever-shifting risk environment.

There is a dizzyingly wide choice of possible approaches to Risk Management (RM). One size truly does not fit all.



RM behaviours should permeate organisations. Management sets the agenda, but all employees should be encouraged to take responsibility for managing risks connected with their own roles, and which are within their control. Risk ownership is distinct from negative concepts such as blame and liability. It is about encouraging proactive and independent thought, and recognising that everyone has something worthwhile to contribute. A formal mechanism for staff to escalate their RM-related concerns may help with this. Direction on what is reported, when and how, may be appropriate, but an overly burdensome approach will deter volunteers.

For most lawyers, the fundamental behaviours underpinning RM already exist, and simply need to be polished and enhanced. For some, the process of changing ingrained behaviour will be a war of attrition. Cultural change takes time and firms need to be resolute throughout. Fortunately, when RM has become a living, breathing part of every decision taken within an organisation (whether the decision-takers realise it or otherwise), the benefits will be clear to all.

Simon Gildener, Partner

Clyde & Co



At a glance….the 2011 solicitors Professional Indemnity (PI) renewal

his year’s official figures from the Qualifying Insurers (QI) have now been released and as anticipated the total premium pot for solicitor’s PI insurance has increased again. However the 15.76% increase in the overall premium pot does not tell the whole story when we look at how individual firms fared this year.

The declared premium pot last year was distorted by virtue of the “ARP mitigation strategies” that a number of the QI’s adopted to reduce their exposure to claims arising from Assigned

Risks Pool (ARP). This year the SRA closed the loop holes that had enabled insurers to under declare their premiums. This years’ total premium pot of £255million (up from £220 million in 2010) is the highest declared premium that we have seen since the commercial primary PI market commenced in 2000. Before then the premium contributions to the Solicitor’s Indemnity Fund totalled £256 million.

In the report by Charles Rivers Associates, commissioned by the SRA, on client financial protection arrangements, they estimated that the total pot for 2010 should have been nearer £260 million. If this figure is correct it is arguable that the total premium pot declared this year is in fact a reduction, not an increase. At Lockton we saw a mixed picture for our clients, ranging from premium reductions to increases dependent upon the risk profile and claims experience of each firm.

T



Insurer 2010 Position 2011 Position Premium Market share change

XL 3 1 £46,762,284 +55.8%

QBE 6 2 £34,508,478 +82.36%

Hannover 2 3 £31,999,015 -5.68%

Travelers 5 4 £29,667,782 +16.65%

Zurich 4 5 £24,063,685 -11.45%

Chartis 1 6 £22,681,580 -41.03%

Allianz 7 7 £14,762,795 +7.83%

Barbican 19 8 £8,938,026 +1674.75%

Alpha 12 9 £8,600,000 +365.72%

Aviva 8 10 £8,521,533 -6.23%

ERIC N/A 11 £8,335,419 New Entrant

WRB 11 12 £3,750,000 -22.62%

Liberty 13 13 £3,409,074 +148.53%

Enterprise N/A 14 £2,927,000 New Entrant

First Title N/A 15 £2,750,000 New Entrant

RSA 10 16 £2,744,598 -39.54%

Chubb 17 17 £875,000 -12.55%

Pembroke 18 18 £406,247 -58.39%

Lemma 9 N/A 0 Exit market

SIMIA 14 N/A 0 Exit market

Aspen 15 N/A 0 Exit market

AG Dore 20 N/A 0 Exit market

The percentage of premium written by the top eight QI’s is down to 80% - 10% less than last year. One of the main causes for this reduction has been due to the entrance of new capacity. Though welcomed by many in the profession, rather worryingly a large proportion of these new entrants are without any security rating or below the level that many brokers including Lockton consider acceptable for their clients.

The new entrants concentrated on winning market share at the smaller partner firm level which was the very sector of the market that a number of the established QI’s were moving away from due to their loss experiences. The churn of insurers within the solicitor market and the volatility of the loss experience especially in the smaller part of the profession, coupled with the unrated security of the insurers, is we believe storing up potential problems for the future.

Steve Holland, Senior Vice President020 7933 2444 [email protected]

Lockton Companies LLP

saw a number of significant changes in market share for the QI’s - as shown in the chart opposite:

2011

The increases in market share for the likes of Travelers, QBE, Barbican and Alpha can be misleading however, due to the ARP mitigation strategies they adopted in 2010. These figures also include premium never previously declared due to the structure of the insurance programmes often purchased by the largest international law firms. These are included as a result of the SRA’s clamp down on the avoidance techniques to declare primary premiums.



information?You need to get under the skin of your firm and really understand what makes it tick. The principles apply across all professional firms, but following the introduction of OFR risk management has now become a conduct issue for law firms. With this in mind it seems timely to examine this issue in that context.

Here are 5 ways a risk manager can understand more about their firm and discover where the actual risks lie:

• Develop a close working relationship with the decision makers and financial controllers (including the COLP and COFA) to understand the business of the firm, the strategy for growth, the potential for financial risk, e.g. the strength and depth of financial controls, the firm’s financial dependence on each department / partner and the remuneration structure for all staff, including partners.

• Identify the rain makers and get to know their modus operandi and their personal and professional strengths and weaknesses.

• Understand how supervision (including peer review of partners) works in practice – speak to supervisors and supervisees at all levels and in all departments. Are procedures uni-formly adhered to across the firm?

• Liaise with those responsible for trainee re-cruitment and development, induction of new staff and training for all staff (including non

lawyers) to ensure consistency of approach and delivery of the right “messages”. Include non legal staff in training on issues such as money laundering, Bribery Act, equality and diversity.

• Undertake a risk management audit and be-spoke training to address uncovered issues. E.g. one department may have a history of failing in a specific conduct area e.g. updating costs estimates promptly and accurately, whilst another may have a history of claims arising from a technical deficiency / lack of legal knowledge. People will be more open to embracing the risk culture if it is seen as relevant.

No one said life as a risk manager was easy and the enormity of developing or improving a risk culture at a professional firm made up of individuals used to doing things “their way” can be daunting. But by getting to know the idiosyncrasies of your firm and its ambitions for the future, you’ll be a long way down the track to creating a risk culture that is relevant and proportionate for your firm.

Can you ever have too much

Megan Howe , Partner Robin Simon LLP

…as a risk manager looking to create or improve the risk culture in a professional firm, the answer is a resounding “No!”



Can you ever have too much


Winter 2012- ManagingRisk 10

What Comes Naturally?

t is widely recognised that client profiles, priorities and working conditions vary considerably between, say, a small general practice on the one hand, and a multi-part-ner, multi-disciplinary practice on the other. That said it is possible to list a number of features that are universally recognised as

representative of good risk management practice. This would include having certain agreed and documented systems relating to such matters as:• Post opening and sending.• Telephone message taking.• IT back-up procedure.• Complaints procedure. • External audits of working conditions.

It is vital that these systems are properly disseminated throughout the practice with regular updates by way of training and discussions.

This is particularly important where matters have not gone as anticipated and lessons can be learned. An efficient risk management system is one which should not run the peril of information overload to the point of becoming counter productive. A decision should be taken as to the appropriate level of risk management overall and in particular areas of operation not limited to those risks which have only financial consequences.

With the Solicitors Regulatory Authority’s (SRA) introduction of a risk based approach to regulation through Outcomes Focused Regulation - firms have been given much more flexibility to devise and implement a bespoke risk management system that will work.

I

Risky Businessor Doing



Allied to that must be the removal of a blame culture. This will assist in the implementation and development of risk control procedures within a firm. Members of a firm need to be encouraged to identify weaknesses in their operating systems without fear of being called to account and secure in the knowledge that there is a common objective, namely to provide a better service.

Dialogue between the relevant members is essential - if people across the disciplines are not in proper communication and there is no central record as to how these matters are to be dealt with, then people are operating in a vacuum and are destined to repeat the mistakes of the past.

It has been suggested that senior management should take the lead by being heavily involved

in the risk management process in order to demonstrate its importance to the rest of the firm. An alternative view would be to involve people at all levels of seniority and in differing roles so that a “whole firm” picture is obtained and responsibility is shared.

To be effective, proper thought needs to be given to establishing systems that are right for your particular practice – a system which is neither extravagantly over-elaborate nor under specified out of cost concerns – and one that everybody is properly informed about and can participate in freely. That way the practice will be enhanced and an instinctive risk management culture will prevail, rather than the exercise being or risk being viewed as artificial or cosmetic.

Sheona Wood, Partner

Fishburns LLP



0845 0501 471www.lockton.com/solicitors

Solicitors Professional Indemnity

a new direction




NOTES

A division of Lockton Companies LLPAuthorised and regulated by the Financial Services Authority. A Lloyd’s brokerRegistered in England & Wales at The St Botolph Building, 138 Houndsditch, London, EC3A 7AG, Company No.OC353198

www.lockton.com

managingrisk - home | lockton...managingrisk managingrisk - winter 2012 table of content mark...

Documents