1. Implementing an effective risk management strategy in a law firm
Peter Scott
Peter Scott Consulting

2. Who has a risk manager?

3. Law Firm Risks Law Firm People IT Regulatory Operational Reputational
Competition
/business
Economic,
political,
fiscal
Financial
Asset
Reputational
Law Firm

4. Is your management in control of your risks
People
Operational
Regulatory IT
Competition
/business
Economic,
political,
fiscal
Financial
Asset
Reputational
Management

5. Operational Risks – negligent advice
Law Firm
Operational

6. Examples of Operational Risks
Negligent advice
Lack of management commitment to best practice and risk management
Lack of knowledge by management
Lack of supervision
High risk work
Client vetting / fraud
Client care / matter care
Resource capability
Lack of knowledge/expertise/experience
Precedents / multiple use of advice
International work / overseas offices

7. Why manage operational risks?
“The pursuit of excellence, with the aim of doing things better for the clients”
Director of Risk of a ‘top ten’ UK law firm

8. Which common factors are necessary if risks are to be adequately managed?
Top level ‘buy in’ to management of risk
Knowledge by management of its
Business
A ‘no guilt’ culture to encourage disclosure

9. Risk Management / KM Risks are inter-related
Failure to manage knowledge involves widespread risk
KM is an essential part of an integrated risk management strategy

10. Your Risk Areas? Where does the knowledge in your risk areas reside?
Can you access it?
Do you have systems to maintain and
upgrade your knowledge?

11. Risk/KM
Risk
Management
Knowledge

12. A Risk Management / KM integrated approach
Approach risk from a KM viewpoint and vice versa
Need to manage the risks relating to knowledge in any event
Managing the risks
Quality assurance
Greater competitiveness

13. Implementing a Risk Management Strategy
DIAGNOSIS
Identification and assessment
MITIGATION
Control, transfer and avoidance
MONITORING
Auditing, tracking and reporting
When a risk crystallises
LIMITATION
Minimising the effect of crystallised risks

14. Risk Identification Involves:
Being management driven
Top down / bottom up
Brainstorming sessions
Facilitated discussions

15. Risk Assessment
Incidence - probability
Impact - severity

16. Risk Diagnosis Assess severity of high-level risks
Identify high level risks
Set criteria for assessing risks
Identify detailed risks
Assess severity of detailed risks
Risk map
Risk summary

17. Risk Mapping

18. Some key factors in identifying and assessing risks
Areas of law
Claims record
Number and location of offices
Fee income / size of firm
Commitment to best practice
Knowledge management
Are risk management procedures in place?
Supervision levels

19. Risk Mitigation
Designed to:-
Avoid
Reduce
Transfer
Accept

20. Risk mitigation Risk map Residual risk summary
Consider impact/probability correlation
Required controls summary
Insurance requirements summary
Contingency plan requirements
Residual risk summary
Consider available mitigation techniques

21. Monitoring involves Auditing, tracking and reporting
Comparing actual outturns to preset indicators
Confirming effectiveness of risk responses
Reporting compliance and exceptions

22. Risk monitoring Required controls summary
Contingency plan requirements
Insurance requirements summary
Set risk indicators and methods to monitor them
Annual Risk Management Report

23. Limitation involves Risk crystalisation scenarios Contingency plans
Limitation procedures
Post event assessment

24. Use of risk management tools?
Use an integrated risk management system to quantify, assess and control risk by :
streamlining diagnosis, mitigation and monitoring
embedding common risk management procedures
providing information access to all who need it
creating and maintaining one central, up to date risk database

25. Advantages of a formal risk management process?
Structured approach focuses on key risks
Elimination of redundant procedures
Comfort / assurance to PI insurers
Universal application to all risk areas
Continuous monitoring ensures management of risk is “lived” day to day

26. Is your management in control of your risks
People
Operational
Regulatory IT
Competition
/business
Economic,
political,
fiscal
Financial
Asset
Reputational
Management

27. Any questions?