Early warning: risk management, file reviews and a risk portal for your COLP and COFA

What the SRA expects

• Systems and controls: firms must have effective governance, systems and controls, and keep records that demonstrate compliance.
• Material risks: the firm must identify, monitor and manage all material risks to its business. A risk register is not mandatory, but it is the simplest way to show this.
• Compliance officers: the COLP and COFA must take all reasonable steps to ensure compliance, record breaches, and report serious ones to the SRA promptly.
• Supervision: work must be properly supervised, and file reviews are the main evidence that it is.

The pressure is rising. Following recent high-profile firm collapses involving client money, the SRA is tightening its oversight, including changes due from 2027 that, in larger firms, stop owner-managers who control the firm's decisions from also acting as its COLP or COFA. A compliance officer who is not running the firm needs a clear, reliable view of risk across it, not a monthly conversation.

File reviews: from tick-box to early warning

File reviews are often done because an accreditation requires them, on a fixed sample, on paper, with the results filed and forgotten. Done well, they are the firm's best early-warning system.

• Risk-based selection: review more often where risk is higher: new joiners, high-value or complex matters, work types with more claims, fee earners with past issues.
• Consistent checklists for each type of work, covering both file management and the substance of the advice.
• Actions tracked to completion, with a due date and an owner, and the file re-reviewed if needed.
• Trends reported: the same failing across several files is a training or process problem, and possibly a risk to report.

A risk portal, driven by your data

Most of the signals a COLP and COFA need already exist in the practice management system. A risk portal brings them together, with thresholds that raise an alert and escalate if nobody acts:

• Client account: ledgers in debit, unexplained reconciliation differences, residual balances, payments to new or changed bank details, unusual transfers.
• Anti-money laundering: matters progressing or money received before ID and AML checks are complete; high-risk matters without enhanced checks.
• Key dates: critical dates missed, nearly missed or unacknowledged.
• Supervision: overdue or failed file reviews, overdue review actions, matters with no activity for a long time, fee earners with unusually high caseloads.
• Undertakings and complaints: undertakings outstanding beyond their expected date, complaints approaching their deadlines.
• Money and work: old unbilled work in progress, write-offs above limits, matters running far over estimate.
• Security: overridden controls, ethical wall exceptions, unusual downloads.

Every alert should lead somewhere: an owner, an action, a record of the decision, and, where needed, an entry in the breach register with the decision on whether to report to the SRA.

Matter risk at the front door

Risk management works best when it starts at matter opening. A short risk assessment for each new matter, covering the client, the work, the value and the money involved, can set the supervision level, the file review frequency and the AML checks automatically. High-risk matters then get more attention by design rather than by memory.

What to ask, and what to see

1. Show a risk dashboard for the COLP and COFA, with alerts, thresholds and escalation, built from live data.
2. Show a risk-based file review: selection, checklist, scoring, actions and trend reports.
3. Show a matter risk assessment at opening setting supervision and review frequency automatically.
4. Show an alert becoming a breach register entry, with the reporting decision recorded.

We help firms design risk management and file review processes around the systems they already have, and make sure their COLP and COFA can see what they are responsible for, independently of any vendor.