Risk management is not just about reducing the cost of insurance, says Chris Charman, who highlights increasing interest in self-insurance. A proper strategy can make sure the business is run effectively

Not so long ago, risk management was seen as just a fancy way of selling insurance, but since initiatives such as the Turnbull Report and Sarbanes-Oxley, it has entered the corporate mainstream. However, a formal risk management strategy remains an oft-overlooked area for those managing a legal practice.


Sadly, law firms are not immune from risks, so having a thorough risk management strategy in place is vital, as it allows partners to plan effectively for potential problems and helps ensure hard-won reputations are not damaged by momentary lapses.


Any risk management project will start by identifying the risks faced by the law firm and the likely consequences attached to each risk. These will be individual in both character and potential quantum, but for most organisations, they will relate to people, systems, customers, suppliers, property and infrastructure.


In short, this means looking at everything in the law firm to see where a deviation from best practice could result in harm to the firm or, perhaps more importantly, clients. This might include quite simple things like diary management, but would also look at extreme events, such as how the firm would cope if its building became inaccessible, or if a quarter of the staff could not work because of a flu pandemic.


Once risks have been identified, the next step is to plan how to manage them. Some risks can be managed away completely - for example, by having secondary checks before documents are sent out - and other risks can be mitigated to acceptable levels, but most will require processes to ensure they are managed.


The key thing to remember is that risks very rarely manifest as expected. Risk management plans need to look at both the broad parameters of the situation as well as what actually happens - not just what should happen.


This in itself needs careful management, as staff may find it difficult to understand why their work is suddenly under such scrutiny, unless they fully understand the reasons for and benefits of the strategy.


No matter how robust an organisation's risk management, there will always be some risks that are likely to have financial consequences. Law firms need to know that they have the financial resources in place to meet the cost of such consequences.


The traditional response is to purchase insurance from the general insurance market. However, not all risks are insurable - either because they are too specialist, or a bad loss record makes the cost prohibitive - and so law firms may need to adopt a form of self-insurance. Self-insurance is also a popular solution for law firms with very good loss records that would like to have insurance, but feel they should be getting more financial credit for their lack of claims.


Self-insurance through a captive (an offshore insurance company owned by the firm) is a feasible and attractive option for larger firms to retain their risk, in order to minimise cost and potentially even create a new profit centre. Such options are not for everyone, and will require a thorough feasibility study, but can generate substantial benefits if correctly set up and managed. Mutual insurance is another potential self-insurance tactic, through, for example, the Solicitors Indemnity Mutual Insurance Association.


Another two self-insurance options do exist, namely: simply retaining liability and paying claims as they arise out of the firm's income, or setting funds aside each year to pay deductibles. However, neither of these options can be recommended - they are not tax-efficient, can have a detrimental effect on cash flow and may well not comply with the insurance requirements set by the Law Society.


Risks are rarely static, but instead have an annoying tendency to evolve and multiply. This means that risk management cannot be a once- a-year, box-ticking exercise, but instead needs to have the flexibility to respond to changes in the environment and the development of individual risks.


It is also a truism of risk management that risks never emerge the way you anticipate, so it is important to have systems that allow the firm to learn from its mistakes. It can also be beneficial to test risk management processes and plans to find flaws when the consequences are unlikely to be detrimental.


One of the key benefits of a risk management strategy has traditionally been seen as fewer insurance claims. This in turn helps in insurance renewal negotiations and, perhaps less obviously, reduces the amount of time that needs to be spent internally dealing with claims.


However, reductions in the cost of insurance should not be seen as the only, or even principal, benefit of good risk management. Risk management is essentially concerned with making sure a business is run effectively.


Partners in a law firm must ensure that they are not exposed to personal liability arising from risk management failures, and clients increasingly demand nothing less than the highest possible standards. Most law firms rely on their reputations to gain and retain business, and there is nothing like a high-profile risk incident to damage a firm's good name and profitability.


However an individual legal practice may view risk, and no matter how great the need, there is now an increasing expectation amongst clients that robust risk management practices will be applied to their business. Corporate clients have spent considerable amounts of time and money applying risk management to their own businesses, and private clients have learnt to view the world as full of risks for which someone can often be blamed and sued.


Risk management is now not just a way of reducing insurance premiums, but a fact of commercial life.


Chris Charman is managing director of Thomas Miller Risk Management (UK)