Law Firm Compliance Concerns During Coronavirus Lockdown

1.     Introduction

1.1      Most firms are experiencing unprecedented challenges in maintaining their services to clients whilst they are unable to meet with colleagues and access the support facilities of the office during home-working. This has not, however, removed the need to remain compliant with the current regulatory regime as found for the most part in the SRA Standards and Regulations. It is important, therefore, to recognise the particular compliance risks that arise from the current restrictions and ensure that effective measures are put into place to address them – especially whilst home-working.

2.     Supervision whilst home-working

2.1       The ability to supervise the firm is the first and most obvious professional concern whilst staff are home-working. The main requirements here can be found in both versions of the Codes of Conduct – for Individuals and Firms. The Code for Individuals provides at para 3.6 that where you supervise or manage others then you remain accountable for the work that they carry out for you and that you must supervise them “effectively”. In similar vein, para 4.2 of the Code for Firms states that those in charge of the firm must ensure that the service provided to clients “is competent and delivered in a timely manner”.

2.2       Issues to consider in relation to home-working might therefore include:

• Having a plan in place with stated communication lines laid out for home-working with clear instructions as to who has responsibility for all of the issues that might arise. There should be clear instructions as to whom to report to, how and when.
• As part of this be clear as to the circumstances when email sign-off is required before the message is sent and also when a supervisor should be copied into the transmission.
• Line managers should also consider staff welfare issues and how colleagues are coping – some may have particularly stressful home-working conditions or be finding isolation hard to cope with. Two suggestions here are to put formal “buddy” systems in place and also to set up regular team support meetings via Zoom where colleagues can talk about more than just work issues and rather how they are coping in their personal lives.
• Sadly, we are seeing fraudsters taking advantage of current circumstances and various advisory bodies have reported increased levels of cyber-crime activity. Remind your colleagues of the risks of malware attacks and email intercepts and to be even more on their guard than usual for suspect transmissions. A particular risk at present will be so-called “CEO Fraud” where a criminal sets up an email account that purports to be from the named managing partner of the firm: they then request that various payments should be made to bank accounts which, of course, the fraudster controls.

3.     Confidentiality

3.1       The other obvious professional concern to arise from home-working or distance working arrangements is maintaining the confidentiality of client information. This is, of course, one of the most fundamental lawyer obligations and it is unlikely that the SRA will countenance any great concessions because of the difficulties that people are now facing. Within both Codes of Conduct the basic obligation is that  “you keep the affairs of current and former clients confidential unless disclosure is required by law or the client consents” (paras 6.3).

3.2       It is also important here to accept the very different conditions that colleagues will find themselves in when home-working. A lawyer who has a young family may not have great worries in a six-year old child seeing who that employment contract is intended for given that they are likely to be more focused instead on when the next edition of Peppa Pig will be showing. Another colleague living in shared adult accommodation, however, will have a good deal more concerns in this regard. Even for those in family units, however, the duty of confidentiality will extend to spouses and life partners.

3.3       If you have not done so already it would be advisable to send a reminder to all who are home-working as to the importance of client confidentiality, and so making arrangements within their space to ensure that nobody else can access their work data. Remember also that your duty to safeguard personal data does not end by having your front door locked: ICO reports highlight cases involving loss of data from home, including the case of Scottish lawyer Ruth Crawford QC who had her unencrypted laptop stolen by burglars from home while on holiday. Relevant considerations here should include:

• keeping laptops, papers etc secure at home, preferably in a room which can be locked;
• making sure that laptops are encrypted and locked when not in use;
• documents are not left unattended; and
• ensuring that phone calls cannot be overheard.

3.4       Bear in mind also that para 2.2 of the Code for Firms requires you to “keep and maintain records to demonstrate your obligations under the SRA’s regulatory arrangements”. It follows that it is important that you have a record of what you have communicated to your colleagues and when to show that you did address all of these important concerns at the right time.

4.     Financial concerns

4.1       It goes without saying that the great majority of firms will currently be experiencing financial problems of one sort or another, most obviously cash flow in the short term and then reduced profits further down the line. The SRA does, of course, have concerns about the risks presented by failing firms and so has long included a duty to report financial problems to them so that they may manage the risks to clients and the compensation fund.

4.2       The duty to inform the SRA of financial difficulty now appears at para 3.6 in the Code for Firms and requires that you “notify the SRA promptly of any indicators of serious financial difficulty relating to you”. There is as yet no definition of what precisely is meant by “serious financial difficulty” in the 2019 Standards & Regulations but examples provided within the former Handbook regime included “an inability to pay PII insurance and or rent or salaries or breach of bank covenants”.

4.3       Our interpretation would be that there would be no need to report if a firm which normally pays its PII insurance premium in a lump sum finds that it now needs to pay by credit instalments during the pandemic. However, if the firm could not obtain credit and had no other means of paying it would need to report. Similarly, if a firm reaches an agreement with its landlord for a deferral of rent this would not need to be reported but if the landlord refused and subsequently took possession proceedings then reporting would be necessary. Firms awaiting payment of government coronavirus grants are likely find that their finances are precarious in the short term but should fairly be able to take the view that once the grant is received things will be on a better footing, and so there should again be no need to report for the time being.

4.4       The best advice here would be to keep a daily log of the way in which your firm’s finances develop so that, if the worst should happen, you should have the means to show why you felt justified not to have reported at an earlier point in time.  Also bear in mind that any SRA investigation is unlikely to occur until the lockdown period has ended so there should be time to take stock once we are permitted to return to our offices and resume normal practice.

4.5       As to bookkeeping and financial controls more generally, rule 8 of the 2019 Accounts Rules provides that you must “keep and maintain accurate, contemporaneous, and chronological records”. There is again no temporary waiver here and, if anything, this is more important than ever. Now may also be the time for the COFA to become better acquainted with the workings of the accounting software. Also bear in mind that remote working could provide an ideal opportunity for employee fraud. Surprise checks often work better than regular pre-planned ones. Regular reconciliations of client account way beyond the minimum five weeks required by rule 8.3 can provide a simple and effective method of checking. Reconciliations of office account may not be mandatory but should also be seen as representing best practice. This aspect of coping during the lockdown is certainly one of the most important as the SRA is unlikely to treat leniently any shortfalls on client account regardless of the lockdown conditions.

5.     Beware social media use

5.1       We have probably all seen the increased use of social media of late. Deprived of our daily interaction with friends and colleagues we have taken more to Facebook, Linked-in and the like. This may be all well and good but venting views on social media can be very risky. The national media has reported one law firm having dismissed a paralegal who posted unpleasant comments about the Prime Minister having deserved his recent serious Covid attack. Many other message clips doing the rounds contain suspect materials, many of them sexist or racist in tone and content. There are further risks in relation to confidentiality breaches if clients might be identified by the contents of certain messages.

5.2       This being the case now may be the time to remind partners and staff of your social media policy and the fact that the SRA can take action even if any postings are in a purely personal capacity. Principle 2 of the Standards and Regulations provides that all law firm personnel are required to act “in a way that upholds public trust and confidence in the solicitors’ profession and in legal services provided by authorised persons”. Remind colleagues that it is important to avoid disclosing the name of the firm and professional qualifications on a personal social media profile so as not to provide a link to the profession and the firm. Better still, everyone should be reminded that care and restraint should be the watchwords when posting on social media platforms and questionable content should always be avoided in any event.

6.     Customer due diligence

6.1       We sent out to all subscribers last month our suggestions on how the normal CDD requirements for individuals might be varied for as long as social distancing prohibit or make very difficult any face to face meeting so that the client’s documents can be inspected in person, as would usually be the case. It is good to see that both the SRA and the Legal Sector Affinity Group have now provided similar advice on this issue. Those with particular responsibility for this issue may wish to consult the LSAG advice on their website which also contains further advice on the reliability of digital checking services.

6.2       To read our earlier advice on this point see our artcile from last month: CDD with Clients and Law Firms in Self Isolation Lockdown