---

Managing risk is accepting that things go wrong

Risk management is about accepting that things will go wrong and putting systems in place to minimise the impact, a practice management webinar has heard.

In reference to the Professional Indemnity Insurance (PII) renewal deadline (1 December) Julie Brennan, managing director of LQSI, advised the DSBA event that the common proposal form can provide a starting point for risk assessment.

The solicitor said that while it is understandable that many firms use the short form for PII renewal, others, “as a matter of good practice”, choose to fill out the common proposal form annually.

Filling it requires “time and attention”, Brennan said.

Filled in at senior level

She added that it should be filled in “at senior level” by someone who has, “full visibility of all the questions that are being asked”, such as the principal or partner.

The largest section of the form is on risk management.

“There are detailed and thorough questions asked of your risk management procedures,” Brennan explained, adding that this “gives a good indication of what insurers are looking for and where claims are coming from”.

“Make sure that you sell your firm as a good risk in your cover letter,” she advised, suggesting the inclusion of things such as positive reports following routine Law Society inspections, awards, relevant expertise and procedures for mitigating risks in higher-risk practice areas.

In-office attendance favoured

Acknowledging it as “contentious” Brennan also recommended mentioning if nobody in the firm works remotely.

“The risk will always favour staff being in the office and learning all the time, and people being supervised, and everything being much more visible in the office,” she explained.

A good risk management strategy will have layers and operate all year.

“It's your team meetings, it's the review of files, it's reviews of your registers, it's even your post procedures so that if something isn't caught in one place, it'll be caught somewhere else.”

Brennan also advised recording staff responses “in the event that anything happens to be incorrect”.

Acknowledging the growing complexity of compliance, Brennan also highlighted what she called the “compliance multiplier”, with every hour invested in compliance saving six hours in the long run.

Standalone risk register

She recommended that a good place to start is a standalone risk register" “Because effectively, all of the risk pertaining to your firm will flow from your risk register, and we would read that in tandem with a risk management policy.”

“Ultimately your risk register is going to be very particular to your own practice”, Brennan said/

“There's a huge amount of areas that need to be taken into account when populating it."

These can be professional risks, client engagement risks, financial risks, compliance risks, strategic risks, operational risks, physical risks, reputational risks, and more. Brennan pointed out that overreliance on one client is a risk in itself. 

Compliance priorities

In her overview of what LQSI considers top compliance priorities for Irish law firms heading into 2027, Brennan included:

• AML compliance,
• AI governance,
• Cybersecurity including the risks posed by phishing, malware, lost devices and sensitive data, alongside the relevance of NIS2-aligned controls even for firms not directly covered by the directive,
• Data Protection, including increased regulatory scrutiny of data governance and accountability and “an ongoing expectation that firms maintain documented retention schedules, and third party and cloud provider oversight will continue to remain a key risk area, so it's another area of which firms need to be very mindful”,
• Third party and vendor risk management,
• Professional standards and client care (Law Society and LSRA),
• Environmental and Social Governance (ESG) and sustainability expectations.

ESG expectations are now reaching smaller firms, Brennan said, noting that larger corporate clients are increasingly requesting ESG information from legal service providers during panel selection and procurement.

She suggested the minimum policies to consider implementing would include environmental policies, diversity and inclusion metrics, supplier due diligence, and governance frameworks.