Feature

posted 11 Jun 2004 in Volume 7 Issue 2

Dare to risk

Considering the importance of risk management to a profession that is more exposed to the scrutiny of the insurance industry than ever before, it is still an area that is largely undervalued. John Goreing, finance director at Fladgate Fielder, assesses the risks that the legal profession faces and explains why firms must build a framework and methodology for identifying risk and effectively implement a risk-management strategy across the business.

The modern word ‘risk’ derives from the early Italian risicare, which means to dare. In this sense, risk is a choice rather than a fate. The actions we dare to take, which depend on how free we are to make choices, are what risk is all about.

Risk control or risk management is, in practice, the process an organisation goes through to ensure that the risks it is exposed to are the risks it thinks it is, and wants to be, exposed to (this is not necessarily synonymous with risk reduction). It follows, therefore, that an organisation has to ensure that any decisions made within it are ones it wants to be made or indeed allows to be made.

The range of risks

There is not a turnkey solution for implementing risk management in any organisation, let alone in the legal profession with all its inherent diversities. To enable an effective risk-management programme, it is necessary to create a framework for analysing the risk to which a firm is exposed and then to devise a methodology for changing the day-to-day behaviour of its members.

The risks a law firm faces, aside from direct financial risk, are many and include:

Operational;
Intellectual;
Market;
Brand;
Credit;
Transactional.

Operational risk

In a law firm, operational risk is usually thought of in two main contexts. The first is quality management or the control of business processes. This is an area that has received a far greater focus in recent years, partly driven by the increasing size of firms, but mainly because the market is seeing an increased cost of professional negligence. Firms have started to suffer significant penalties for failures, not only in terms of claims history, but also in procedure, as the influence of the insurance industry on the legal profession increases. As the open market for professional-indemnity cover has evolved, insurers are considering not only the historic claims history of a firm but also analysing the underlying business processes to predict the likelihood of future claims.

The other main area to focus on under the heading of operational risk is business continuation or disaster recovery. In essence, this is the ability of a firm to minimise the disruption to its business in the event of a major incident that affects part or all of its resources. Not only have insurers been demanding greater awareness of this type of planning in recent years but terrorist incidents have made many firms focus on the need to plan for this eventuality.

Intellectual risk

Intellectual risk is, quite literally, the value to the firm of the intellect of those individuals that make up the firm and the cost that would be suffered should they leave.

Risk management in this area, therefore, covers such areas as succession planning, that is, managing the retirement plans of partners to ensure that clients are retained and that any specific knowledge residing with the partner is, to the best of the firm’s ability, shared with others. The same is true for any other key members of the firm, be they assistant solicitors, professional managers or a valued secretary.

It is a common and disruptive situation for a partner when his long established secretary leaves. Similarly, if a key member of the IT team, with an intimate knowledge of the firm’s network, decides that the future is more exciting elsewhere, then the firm could suffer system disruption and loss of efficiency until the replacement member of staff is up to speed.

In recent times, knowledge-management initiatives have been introduced to address such issues. Unfortunately, most of these have tended to focus on legal knowledge as applied to transactions, and consequently look to overcome the challenges via the provision of an IT knowledge-management system. Many firms have since experienced the limitations of this approach and have now invested in knowledge-management professionals who recognise the need for human interaction and co-ordination.

Market risk

This is, at first glance, outside the firm’s control. It is, essentially, the effect on the firm of a reduction in workflow from any given sector of the economy or any client loss. It can be addressed, to a certain extent, by understanding the level of exposure the firm has and, if necessary, allocating resources to develop a balance in other areas. This should be done at the business-planning stage.

Brand risk

Brand or reputation risk is where a firm gains an undesirable notoriety for whatever reason. A consequence of this could be that the firm is precluded from operating in some of its chosen markets. A firm’s reputation can be affected by any number of factors, for example, a negligence action, adverse publicity, fraud, mismanagement, etc.

The rise of specialist PR advisers to the legal industry underlines the increased commitment to this area.

Transactional/credit risk

Transactional or credit risk is the risk derived from the type of transaction that a firm undertakes and the manner in which it does so. At the heart of this is the power that exists within the client-partner relationship.

To date, this appears to have received little consideration from central management within many law firms, although it is an area that potentially represents the most significant risk for firms.

The corporate-governance approach

Although it is the norm for many law firms to consider the risk to their practice of one or more of the above areas, it is a regrettable fact that too few firms take a holistic view.

In this age of increasing competition, it might be appropriate for solicitors to take a strategic approach to risk management, to update their internal controls and to join the ranks of their listed company clients in the world of corporate governance.

A law firm’s approach to risk management is likely to be similar to the principles highlighted by the Cadbury Report. Although this report was commissioned by the Stock Exchange to study the financial aspects of corporate governance of publicly listed companies in the UK, it sets out that the key to any risk programme is the play off between long-term security and short-term effectiveness or profitability, that is: “Striking the right balance between meeting the standards of corporate governance now expected of them and retaining the essential spirit of enterprise,” (Cadbury Report, 1992).

A further key tenet of the Cadbury Report is that risk management will only become common behaviour throughout an organisation if the responsibility for it is within the remit of someone very senior. Again, this approach could equally be applied to law firms.

The Turnbull Report, which was published to add practicality to the principles established by Cadbury, indicates that a company’s internal-control system should:

“Be embedded in the operations of the company and form part of its culture;
“Be capable of responding quickly to evolving risks to the business arising from factors within the company and to changes in the business environment;
“Include procedures for reporting immediately to appropriate levels of management any significant control failings or weaknesses that are identified, together with details of corrective action being undertaken.”

The overall essence of Turnbull is to “implement control over the wider aspects of business risk in such a way as to add value rather than merely go through a compliance exercise”.

To assist in adding focus and prioritising the many risks an organisation faces, the Turnbull Report suggested the template shown in figure one.

Areas that fall within square A are clearly of the most concern and require immediate and rigorous attention. Areas within square B are of significant concern and require serious consideration, especially as their impact may be mitigated by a contingency plan. Square C contains areas that may require attention, while areas within square D may merely need periodic review to ensure that the allocation is still correct.

Creating change

The analysis of the risks to which a law firm is exposed is, of course, only half the battle. Analysis must be followed up by action. This is likely to result in exacting greater control over the decisions made on a firm’s behalf, particularly in the areas concluded to be of greatest concern.

Improving management of the decision making within law firms can be done in one of two ways or via a combination of the two. The first is a prescriptive approach, which reduces people’s freedom of choice thereby creating the decisions that fit the agreed strategy. The second approach seeks to improve the decision-making skills of an individual by increasing the confidence in an individual’s ability to make the right decision.

Culture

Neither approach is necessarily more preferable than the other, nor do both approaches have risk reduction as their overall objective. The type or blend of approach a firm adopts is very much dependent upon the culture or type of firm.

An entirely statistical (and therefore procedurally driven) approach to risk management requires two constants: the sample size needs to be large enough and credible; and the situational context within which the risk is being considered needs to be very similar to that upon which the original statistics were based.

It is likely that these constants will exist only in firms that handle high volumes of similar work that can be standardised (usually with an IT system) and where relatively little room is left for individual intervention. By adopting a highly prescriptive approach, firms can offer ‘commoditised’ services at a lower cost, while maintaining overall control of risk in that area.

At the other end of the spectrum are very large firms where the evolution in management that has been required for the sheer scale of the firms has been such that individuals have become used to less autonomy and more able to adapt to changing procedures that are decided on centrally.

In the middle sits a raft of small and medium firms where partners have a high level of autonomy, particularly in relation to the client-partner relationship and the undertaking of client transactions. The risks associated with this area are some of the most significant that exist for these firms.

Within this grouping, it is the culture of an individual firm that will define or constrain what is acceptable and achievable. For many firms, improving the management of the decision-making process will depend to a large extent on the willingness of partners to accept change. However, changing the attitudes of partners is far from easy.

“It should be borne in mind that there is nothing more difficult to handle, more doubtful of success, and more dangerous to carry through than initiating changes… The innovator makes enemies of all those who prospered under the old order and only lukewarm support is forthcoming from those who would prosper under the new. Their support is lukewarm, partly from fear of their adversaries, who have the existing laws on their side, and partly because men are generally incredulous, never really trusting new things unless they have tested them by experience,” (Machiavelli, 1514).

Although Machiavelli was writing at the beginning of the 16th Century, it appears that he could be talking about modern law firms. It is a reality that within the management of law firms today, deciding on the action that needs to be taken is often the ‘easy part’. The profession is littered with well documented business plans or strategies that have never evolved into day-to-day action or behaviour.

One of the main reasons for this failure is that the strategy is frequently set without full consideration of the practicalities involved in its achievement. In particular, one of the fundamentals that is commonly ignored is the accompanying change of behaviour that is required.

It is often the case that an organisation or individual will recognise the need for change when they feel in crisis. The greater challenge is to exact that very change before the crisis occurs and so avert it. This is, in essence, what good management is about.

An eminent management consultant, writing on the subject of risk, uses this scene from Casablanca to illustrate an attitude that can be found in many of today’s business leaders:

Captain Renault: “I am shocked, shocked to know that gambling is going on here.”

Emil: “Your winnings, Sir.”

Captain Renault: “Oh, thank you very much.”

Casablanca (1942)

He then goes on to say: “Captain Renault exhibits two interesting traits. He feigns surprise at a transgression in which he has participated willingly all along, and he does not hesitate to take credit when the game has gone his way. These traits are not uncommon in the business world. Senior leaders often look the other way when rules are broken, and they frequently mistake luck for skill in risk taking.”

In essence, this Casablanca Syndrome, as I have termed it, encapsulates the mind-set exhibited by senior professionals who, as long as overall profitability is maintained, do not focus on the extent to which their business is exposed to risk by the actions of individuals. Rather than reward a skills set that is astute in risk assessment, remuneration is more usually linked to areas that have succeeded, with little attention given to those that have not.

Decision making

In contrast to the prescriptive approach to improving management of decision making, the alternative approach seeks to increase the ability of an individual to make the right decision. Without central interference, individuals are likely to make decisions about what risks they will take, conscious or otherwise, based upon their perception of past experiences or, in essence, their knowledge. By influencing an individual’s knowledge, it therefore follows that a firm may be able to influence the decision-making process of their partners and the risks they will take.

However, it must be borne in mind that individuals respond to new information on the basis of a clearly defined set of preferences. They know what they want and they use information in ways that support their preferences.

The attitude of partners toward client transactions offers a good example of this in practice. Partners have an obvious enthusiasm and are genuinely interested in the affairs of their clients. They want a transaction to succeed and, as such, potentially allow a bias to enter their decision making. They will focus on the outcome they want to achieve, that is, success (their ‘preference’) and subconsciously account for any failure as random errors that could not be predicted. These errors are explained away as a myriad of circumstances that are unique to that transaction.

In addition to the willingness of partners to accept change, another force is at work. Partners are not always free to make choices as they wish; market forces can dictate outcomes that may not be the most comfortable. As a finance director at a leading property-development company said: “There are a lot of providers right now and it’s a buyer’s market. And, in a buyer’s market, buyers dictate the terms. And that’s it. End of story.”

For example, in many cases, a client demands that where the very success of a transaction gives rise to the funds to settle the fees, it is undertaken on a contingent basis. “It’s acceptable for clients to demand because they can and it’s acceptable for lawyers to accept contingency situations because if they don’t, they will lose the work,” said the head of legal at a FTSE 100 plc.

However uncomfortable this situation may be for the management of many of today’s law firms, it will continue for some time to come due to the power that exists within the client/partner relationship. This is manifested not just in the power of clients, as illustrated above, but in the supplemental power of the partners that enjoy their following.

Clients of all but the largest firms tend to instruct the partner they are most comfortable working with and to a certain degree, the firm is ancillary to their decision. The control of the all important fees, therefore, remains within the domain of the partner and with it comes the second or supplemental layer of power.

Tackling exposure to transactional risk will require a reorganisation of this power, which is currently at an all-time high, with clients and partners being more willing to move their patronage than ever before.

In many cases, it follows that the best course of action is to increase the individuals’ understanding of the risks to which they are exposing the firm and improve their knowledge so that they are best equipped to tackle them. The key to both is information flow.

The Deloitte & Touche survey of ‘Useful Techniques for Identifying Business Risk (Implementing Turnbull)’ clearly identifies that the most effective techniques for identifying business risk are roundtable debates followed by interactive workshops; the least effective are checklists followed by management reports. This example again highlights the benefits of personal interaction in drawing out useful information.

To summarise, the turnkey solution to improving risk management does not exist, but many of the tools required to tackle it are available. The most fundamental are the lessons that have been learnt in know-how projects that have sought to encourage the sharing of knowledge and experience, albeit for another, slightly different purpose. The details and practicalities of know-how projects are well documented and it is unnecessary to focus on them here. Law firms are demonstrating a greater appreciation of risk and the importance of its management, but too few firms take a holistic view.

The purpose of risk management is to establish a comfort zone for risk taking and to ensure that people within the firm stay within it. Outside this zone, the potential consequences of failure are more severe than the potential satisfaction from success.

In terms of analysing the risks to which a firm is exposed, a risk review should be undertaken, possibly utilising the tools set out by Turnbull.

The level of risk that is acceptable in achieving a firm’s goals is a matter of individual firm culture and should be debated at the business-planning stage. Similarly, the balance between a prescriptive approach and a knowledge-driven initiative will be a matter for the culture and type of firm.

The more one can find similarity of context (that is, the circumstances being examined) compared to those that will be experienced, the greater the balance is in favour of a statistical or prescriptive approach. The reverse is also true: the greater the diversity of context being experienced, the more appropriate an educational/knowledge/experience-based approach will be.

With either approach, the objective should be to achieve a level of exposure that ensures that a firm is exposed to the risks it thinks it is, and wants to be, exposed to. The greatest challenge is likely to be for full-service, medium-sized firms that do not have the similarity of context to be procedural, nor the culture to easily accept interference from central management.

In these firms, knowledge sharing and developing confidence in the ability of partners to make the appropriate risk decisions will be critical to the long-term success of the practice.

John Goreing is finance director at Fladgate Fielder. He can be contacted at: jgoreing@fladgate.com.