The SRA's new whistleblowing designation - what it means for your firm, and why culture is the part that matters most

An easy-to-overlook regulatory change has significant implications for how law firms are run. Here is what you need to know, and what to do about it.

On 3 June it was announced that the SRA has been designated a “prescribed person” under the Public Interest Disclosure Act 1998. For firms focused on the headline compliance demands of the moment, this may not have registered as a priority, but it should.

In practical terms, the designation means that any member of your firm’s staff – not just solicitors, but paralegals, clerks, trainees, receptionists, and agency workers – now has formal legal protection if they report concerns about your firm directly to the SRA, provided they reasonably believe they are acting in the public interest. Solicitors already carried a professional duty to report misconduct. This extends equivalent protection to everyone else working in or alongside your firm, and shields them from the risk of retaliation by their employer.

For well-run firms with healthy internal cultures, the immediate practical impact may be limited. But the change is more significant than it first appears, and the firms that treat it as a box-ticking exercise are likely to find that out the hard way.

What your firm actually needs to have in place

The starting point is your whistleblowing policy. If your firm does not have one, or has not reviewed it recently, now is the time to address that. A whistleblowing policy is not simply a document that satisfies an audit – it’s the framework through which concerns are raised, recorded, and acted upon. At minimum, it should:

• Set out clearly who staff can report concerns to internally, with a named individual and a named alternative where the concern involves that individual
• Explain what kinds of concerns are within scope i.e. regulatory breaches, professional misconduct, client harm or financial irregularities – in plain language that non-legal staff can understand
• Make clear that staff are protected from retaliation, and explain what that protection means in practice
• Describe what will happen after a concern is raised, including how the firm will investigate and how the person raising the concern will be kept informed
• Confirm that concerns can also be reported externally, whether that be to the SRA, or to other prescribed persons where internal routes are not appropriate or have not produced a satisfactory outcome

Policies that are vague, overly legalistic, or clearly designed to discourage external reporting rather than facilitate genuine internal disclosure are not adequate. The SRA’s designation changes the context in which your policy operates, and it is reasonable to expect that the SRA will take a dim view of firms that appear to have treated whistleblowing obligations as a formality.

The difference between having a policy and having a culture

This is where the more difficult conversation begins.

A whistleblowing policy is a document. A whistleblowing culture is something that either exists in your firm or it does not, and no amount of well-drafted text will substitute for it.

The gold standard of an effective policy is whether you can honestly answer the question “would our staff actually use this policy?” , not simply whether a policy exists. Would a paralegal who observed a partner behaving improperly with client funds feel that raising the matter internally was safe, credible, and likely to result in meaningful action? Or would they conclude – rightly or wrongly – that the internal route was too close to the problem, too likely to result in consequences for them, or simply not trustworthy enough to risk?

The SRA’s designation matters here precisely because it changes the calculus for staff who might previously have felt that internal reporting was their only realistic option. They now have a direct, legally protected route to the regulator. If your internal processes are perceived as weak, conflicted, or too close to those with most to lose from a disclosure, staff are more likely to use it.

This is not necessarily a comfortable observation, but it is a useful one. Firms that invest in genuine compliance culture where concerns are taken seriously, investigated properly, and not met with hostility reduce the likelihood that concerns will go straight to the SRA without any prior internal opportunity to address them. Firms that have the policy but not the culture are more exposed than they may realise.

The particular challenge for smaller firms

In a larger firm, there are structural buffers that make this somewhat more straightforward. A dedicated COLP, an HR function, partners sufficiently removed from day-to-day matters to provide some independence – these create natural channels through which concerns can be raised without the person raising them feeling immediately visible and vulnerable.

In a smaller firm those buffers often do not exist. The COLP is frequently also the managing partner, or one of only two or three partners. HR may be a single administrator who reports directly to those same partners. The person a member of staff would need to report a concern about may be sitting in the next office.

This does not make compliance culture impossible in a smaller firm. But it does make it harder, and it makes the question of trust more acute. Where the internal structure is genuinely too close to allow for independent internal reporting, it is worth considering whether there are external options that could supplement the internal process – whether that is access to an external compliance adviser, an independent HR resource, or simply a clearly communicated assurance that external reporting to the SRA is a legitimate and protected option.

The SRA’s designation, in this context, is arguably most significant for smaller firms. It provides a credible external route for staff who would not feel safe using an internal one. Firms that acknowledge this honestly and take steps to address it are in a stronger position than those that assume the issue does not apply to them.

A more useful way to think about this

It is tempting to frame the SRA’s designation primarily as a compliance risk – something that increases the likelihood of regulatory scrutiny and therefore needs to be managed carefully. That framing is understandable but ultimately unhelpful.

A more productive way to think about it is this: a firm with a genuinely robust internal reporting culture is one where problems are more likely to be identified and addressed early, before they escalate into something that causes serious harm to clients, to the firm’s reputation, or to its regulatory standing. Staff who feel safe raising concerns internally are, in effect, an early warning system. They are more likely to flag the billing irregularity before it becomes a misappropriation, the conduct issue before it becomes a complaint, the process failure before it becomes a negligence claim.

Viewed in that light, investing in whistleblowing culture is not simply about regulatory compliance. It is about running a better, more resilient firm. The firms that get this right tend to be the ones that treat internal reporting not as a threat to be managed but as information to be taken seriously.

The SRA’s designation changes the external landscape. How your firm responds to it is a question of internal culture – and that, ultimately, is a leadership question.

If you would like to review your firm’s whistleblowing policy or discuss how these changes affect your compliance framework, Enderley would be happy to help.