Posted by Samantha Griffin, professional development manager at Legal Futures Associate the Institute of Legal Finance & Management
Griffin: Hybrid working can expose assumptions built into systems
Hybrid working is now a usual part of working life across professional services, and despite recent noise around the ‘return to the office’, for many law firms it remains an established working pattern.
For legal finance teams, this has had an impact beyond just where people sit; it has also changed how information moves, how approvals are obtained and how colleagues communicate when something does not quite fit the usual process – and this is important when client money is involved.
The Solicitors Regulation Authority’s (SRA) accounts rules require firms to have systems and controls appropriate to the nature and volume of client transactions they handle and the amount of client money they hold.
The challenge for firms is therefore not simply whether they have a documented process, but whether that process remains effective when the people involved are working across different locations.
The main risk may lie less in one obvious control failure and more in the gaps between otherwise sensible controls.
When a process becomes a chain of hand-offs
Let’s consider a typical client account payment as an example of a frequently occurring transaction.
Information might originate with a fee-earner working from home, be passed electronically to the accounts team, entered into the banking system by one person and authorised by somebody working somewhere else.
Each individual step may be controlled. But is anyone overseeing the transaction as a whole?
In an office, an unusual request might prompt a quick conversation. A legal cashier may ask a fee-earner why payment details have changed, or an authoriser might query something before approving it. Those informal interactions should never replace formal controls, but they can provide an additional opportunity to spot something unusual.
Hybrid working can remove some of those natural points of challenge. A request arriving electronically can appear more transactional, particularly when teams are busy and communication is largely task-based.
For finance leaders and COFAs, this makes the quality of the hand-off important. Does the person authorising a transaction have enough context to make a meaningful decision, or are they effectively confirming that somebody else has already checked it?
Approval is only useful if it involves scrutiny
Separation of duties remains an important safeguard. ILFM guidance highlights the value of separating the inputting, authorising and transmitting of client account payments. But separation alone is not enough.
There is a danger in any environment that approval becomes habitual and remote systems can make that even easier: notification arrives, details appear familiar, approval is clicked.
A stronger control will ask what the authoriser is expected to verify. For example, can they see the underlying authority for the payment? Are they checking the client ledger and purpose of the transaction? Is there a clear process for independently verifying changed bank details? Do they know what should cause them to stop and ask another question or seek clarity?
The SRA guidance on client accounting records similarly stresses the importance of appropriate access controls and visibility around computerised accounting systems. The objective should be meaningful challenge rather than simply adding another name to an approval trail.
Watch out for exceptions
Well-designed processes tend to work well when everything is routine. Risk often appears when something falls outside the norm. Perhaps a payment is urgent, an authorised person is unavailable, or a colleague cannot access the usual system from home. Someone asks for approval through a different communication channel because it will be quicker.
None of these circumstances automatically means something is wrong. But repeated workarounds can gradually become an unofficial second process, not up to the same standards as the original system.
Legal finance teams therefore need visibility of exceptions. If a control is bypassed, who knows? Is the reason recorded? Is there a pattern involving particular teams, transaction types or stages in the process?
This can be more useful than just knowing that the firm’s written procedure is technically correct.
Access can quietly expand
Hybrid working can also change who needs access to systems and information. Temporary cover, changing working patterns, new starters, outsourced support and periods of absence can all result in permissions being added. The risk is that they are not always removed or reconsidered afterwards.
The SRA advises firms to consider carefully how many people have access to passwords and systems, noting the competing risks of too little access creating a lack of resilience and too much making effective oversight harder.
A periodic review of permissions should go beyond checking whether an individual is still employed. Does that person still require that level of access? Can they initiate and approve activities that should be separated? Are temporary permissions genuinely temporary? These issues should feed into governance as well IT best practices.
Does management information still tell the whole story?
One less obvious consequence of distributed working is that senior finance professionals may have less day-to-day visibility of how processes are actually operating.
Reports can show that transactions have been completed and approvals obtained. They do not necessarily reveal the email exchange that preceded them, the workaround used because somebody was unavailable or the repeated difficulty a cashier is having obtaining information from a particular department.
This is where communication also becomes part of the control environment. Legal cashiers and finance teams are often well placed to notice recurring friction before it develops into a significant problem. Firms need routes through which those observations can be raised, discussed and acted upon.
The ILFM’s wider approach emphasises the value of closer collaboration between COFAs, legal finance professionals, support teams and senior leadership, particularly where it improves governance and risk management. That becomes particularly important when colleagues are no longer routinely in the same room.
Test how controls work in practice
The ILFM’s COFA guidance recognises the importance of procedures being practical, effective and proportionate rather than creating unnecessary burdens. For hybrid firms, the more useful question may therefore be: does the control work under the conditions in which people actually work?
You can check this by taking a real transaction and following it from instruction to completion. Look at who touched it, what information they received, what they checked, how exceptions were handled and whether anybody had the opportunity and confidence to challenge something unusual.
Hybrid working does not inherently weaken client money controls. But it can expose assumptions built into processes designed around people, information and oversight being in the same place.
The goal is to make sure that wherever people are working, the control environment remains visible, connected and capable of identifying when something does not look right.
For further information on best practices and client money controls, visit the ILFM website www.ilfm.org.uk
Leave a Comment