Creating a culture of compliance

Compliance is not just an annual series of refresher training sessions or something to react to when a competitor is hit with a fine and regulatory censure.

Compliance is the foundation to good business and excellent client relations: a culture of compliance embeds compliance into everyday processes with application of policies, procedures and regulations as part of the day job. Compliance should be an integral part of client and file management, and not regarded an additional burden or separate area of work.

It should not be taken lightly… ultimately it can make or break your business.

The cost of compliance

We’ve seen many examples of firms either getting compliance wrong, considering it an afterthought, a mere administrative burden – or all three. Case(s) in point – Ed wrote about this very recently Shropshire law firm client money fine and ICO Enforcement against law firm. You only have to read the many accounts of SRA AML fines to know that in reality the cost of compliance is far less than the cost of non-compliance. And the costs are not simply financial, as eye watering of the fines often are; there is a huge time cost in putting things right, and potential reputational damage too.

Most firms like to think they’re compliant, but in reality, are your processes robust? Or, is it more a case of ‘winging it’, living on a hope and a prayer that everything is in tip-top shape? Are you truly sure everyone in your firm is adopting a compliance mindset into their every day??

Reticence around compliance

How often have we heard colleagues saying, ‘Why do we need to do this?’ or ‘We never used to have to do this’ ‘this isn’t billable time’ or ‘Oh, there’s just so much compliance. I’ll get to it later’ (that often never comes!). Many would argue that the cost of compliance is just eating resource and time. Yes, to a certain degree that’s true. But is the cost of getting it wrong and remediating the gaps following a regulatory visit cheaper than embracing compliance? Isn’t ‘doing the right thing’ good business sense?

The scrutiny by regulators across all sectors is increasing rapidly as they look to ensure that firms have policies and procedures in place to respond to and mitigate risk and in particular the risk of AML and Sanctions. In particular, the SRA is being extremely proactive in its AML inspections (both desktop and on site), especially of firms which do a lot of residential conveyancing, and it’s not skipping a beat when referring for investigation and dishing out fines to those firms with breaches.

How to establish a culture of compliance?

Establishing a culture where compliance is embraced by throughout the firm requires three main things:

Continuous vigilance. Resource. Time.

There’s no easy way around it, no back doors. To influence widespread and deep change, firms have to commit and have frameworks in place to build compliance practices into their everyday workflow. Leaders also need to lead from the front in adopting a compliance mindset.

Basics of compliance

Awareness

Understanding not just changing regulation but embracing regulatory expectations is key. This sets a higher bar than just black-letter compliance. Ask yourselves, are you complying with the spirit of the regulations? Are you anticipating regulatory expectations?

Leadership

Senior management and partners – empower your COLPs, COFAs, MLCOs and MLROs!

These roles are business critical but all too often are viewed as a poisoned chalice. You – senior management and partners – set the tone of the firm and by championing these roles, (and adopting a compliance mindset yourself) you will influence and drive the desired change in culture. Senior leaders need to live and breathe compliance, in both word and action, as ‘the right thing to do’. Driving the compliance mindset from the top, positioning your compliance officers correctly and mentoring those at other levels of the firm enables adoption across the firm. It becomes part of the firm culture.

Communication

Discuss, define and document the compliance culture openly, along with the criteria and objectives set to measure it. Organisational attitude to compliance culture should be intentional, documented, easily articulated, accessible and understood. It should not just be a series of policies sat in a drawer and dusted off when an asked for by the regulator!

Model and communicate culture via the tone from top, with management communicating the importance of culture. Communicate the expected culture throughout the organisation, embedding compliance across all functions and levels to develop individual accountability and engagement.

Commitment

Invest in your teams – they are the first line of defence against compliance risks. Recruit the right people, give them the right tools and support them with the right training.
Compliance training should be tailored to your individual firm and its values:

• Repeat key messages in different formats
• Focus on a few critical messages
• Deliver in bitesize chunks
• Explain the “why”

Alongside your compliance officers, consider appointing ‘compliance champions’ within the business to assist fee earners. Again, ensure the compliance function is adequately resourced and supported. They are your second line of defence to provide an independent view and feedback.

Embed and incentivise

Instil personal responsibility around compliance behaviours: integrate compliance outcomes into employee performance management. As standard, you set targets and objectives for your employees’ improvement as they strive to develop their careers, you should also include compliance as an element of that continuous development. 

Integrate a compliance ethos by incorporating compliance into product and process design and workflows at the start and throughout development, instead of relying on checklists that bolt on at the end.  Wrong continent but right message, as the former Director of Enforcement at the Securities and Exchange Commission, Stephen M. Cutler said in 2004, 

“For at the end of the day, the most effective way to communicate that ‘doing the right thing is a priority, is to reward it’

Transparency

When an incident of non-compliance arises or is identified, own it, fix it and learn from it. Having open discussions about what went wrong and being comfortable having those conversations means that your teams can voice concerns knowing they will be listened to without fear of being spurned or of retaliation.

Use your compliance culture as a competitive advantage!

Have you considered Lexcel accreditation? Lexcel is the Law Society’s legal practice mark of quality for client care, compliance and practice management. It’s something to be proud of, to shout about, and gives assurance to clients (and prospective clients) that everything in your practice is done by the book. Furthermore, what we see with clients who we support with Lexcel accreditation (and reaccreditation) is that team members comply with its requirements – quite simply, nobody wants to be that one person who lets the team down when it comes to assessment or reassessment! 

A firm that ensures that compliance is central to its operating model making adjustments to approach where needed, as well as having effective eye on the ever changing regulatory landscape can proactively steer the firm onto a successful compliance path with positive business and client outcomes.