The risks of outsourcing

Managing the regulatory risks of outsourcing

They, whoever they are, are constantly telling us that as a profession, lawyers must all start to embrace new business models and practices if we are to survive the ABS revolution. They, whoever they are, are probably right. However, and it is an important however, as lawyers we must approach any changes with a degree of circumspection and ensure that we are not moving forward in a way which places our clients, or own firms, at risk.

Nowhere is this more topical than in relation to the ever growing trend for firms to outsource.

The following article looks at some of the regulatory issues and risks which firms face when considering this.

The forms of outsourcing

Outsourcing is big business and over the past six or seven years has gained a rapidly growing prominence in the legal world.

Outsourcing can take many different forms, including:

• outsourcing office services such as word-processing and secretarial services,
• having elements of the legal work outsourced to lawyers outside of the firm, sometimes overseas where labour costs are lower,
• sharing serviced offices so that the firm does not have to worry about problems relating to premises, and
• cloud computing – where firms store their data off site, run computer programmes remotely and access files and records via the Internet.

In the USA, where outsourcing has taken off far more than in the UK, many firms are having substantial parts of cases handled externally to the firm, including:

• discovery,
• document review,
• due diligence,
• drafting,
• legal research, and
• paralegal support.

In one way, solicitors have outsourced aspects of their work for a considerable time – instructing counsel to draft pleadings or give an expert opinion. This, however, has never been viewed as a problem since barristers form another group of professionals with rules of ethics and conduct as strong as those affecting solicitors. The problems only start to arise when firms outsource matters to businesses that are not subject to strict rules of conduct, which are not tightly regulated or even who are in a foreign country and may not even be subject to the same rule of law as solicitors here.

Whilst many firms continue to be uncomfortable about outsourcing legal work to third party providers, the reality of the situation is such that that a great deal of the work undertaken by law firms is relatively routine and does not need to be undertaken by highly qualified and costly solicitors and barristers. Overall costs, therefore, cam be reduced substantially if the more routine aspects of a case can be dealt with elsewhere.

The benefits of outsourcing

There can be no doubt that for many firms, the benefits of outsourcing are considerable. Law firms’ costs, particularly staff, premises and insurance costs are constantly increasing whilst at the same time the pressure upon firms to reduce fees, do more work for less money and limit disbursements places many firms between the proverbial rock and a hard place. Added to this, many clients are seeking improvements in speed and efficiency from firms whilst at the same time requiring that firms increase their levels of accountability.

Understandably then, outsourcing, which allows many firms both to reduce cost and to improve service, is becoming an increasingly attractive option.
Many of the providers of outsourced services are basing themselves overseas in economies where labour costs are lower, premises are cheaper and where the employment rules are less onerous and the benefits lower, or even non-existent. Even were the actual individual costs not lower, the ability of outsourced service providers to ensure that staff are more effectively utilised can in itself reduce costs. If a secretary or junior fee-earner is not employed fully then the incremental cost of their time increases.

From a perspective of continuity of service, the use of external providers can ensure that peaks and troughs are ironed out and that there is always a sufficient resource to undertake the work which needs to be done. Moreover, it means that the firm can simply purchase that support which it needs at the time at which it needs it.

Furthermore, fixed costs can be reduced because the firm does not have to rent space to house workers or purchase equipment and technology for them to use. There are no pension contributions to be made. There is no sickness pay to be found. There are no redundancy payments if levels of work decrease. There are no recruitment fees to pay when work levels pick up.

If one looks more widely and considers issues such as cloud computing external IT services, the benefits become even more apparent. Not only can firms can reduce capital expenditure on expensive IT equipment and the cost of IT support departments, but also they can allow fee-earners the greater flexibility of being able to access data and programmes anywhere where they can gain access to the Internet.

It looks like a win all round. But is everything really that easy? Can the firm simply find the cheapest supplier of services and watch the overheads fall?

The simple answer to that question is “No”. There are risks associated with all forms of outsourcing – not least of which are the regulatory risks – and it is these which we will consider in the remainder of this article.

The regulatory risks of outsourcing

So what are the risks associated with outsourcing and to what extent should firms be concerned about them?

There are at least ten separate regulatory risks associated with outsourcing:

• data security – information being lost or corrupted,
• lack of confidentiality – information being disclosed to third parties or even the use of information to assist in crime,
• risk of conflict of interests – there are a limited number of outsourcing suppliers and therefore a real danger that outsources may become involved in both sides of the same matter – firms wishing to outsource must therefore ensure that appropriate conflict checks are undertaken at the service provider and that where appropriate information barriers are put in place,
• loss of supervisory control – the outsourcing firm not knowing what the service provider is doing or how they are doing it,
• quality of service – the work undertaken by the service provider not being of a sufficiently high quality or of a variable quality,
• level of understanding and knowledge of the work being undertaken – service providers may not keep up to date with relevant developments or may miss cultural indicators that would have been picked up locally,
• availability and the reliability of ready access to information – the outsourcing firm not being able to gain access to information, data or files when required,
• consumer perception – whatever the safeguards that are put in place many consumers may have concerns about work being outsourced generally, may have objections to work being outsourced abroad (and thus depriving the home market of jobs) or may have concerns about the security of data outsourced abroad,
• contractual problems – breakdown in the contractual relationship during the work being undertaken – ability of the outsourcing firm to recover papers and data or to be able to handle the work without the service provider’s assistance,
• problems with local staff – an increase in outsourcing could cause local staff to fear that their jobs are at risk. This could lead to low morale, unwillingness to work with the outsources or even straightforward sabotage of the outsourcing arrangements,
• regulatory problems – breach of rules in the jurisdictions of either the outsourcing firm or the service provider, irrespective of whether any of the foregoing risks exist. This could include, for example, reserved work being undertaken by unqualified staff where the regulator felt that inadequate supervision existed.

In April 2005, the FSA produced a report on the risks associated with outsourcing to India. It concluded that “The main risk identified is the complexity of achieving suitable management oversight and control from a distance.”

Clearly the level of risk will depend upon the particular type outsourcing. Thus a firm that outsources part of its secretarial function will have fewer concerns than a firm which uses an Indian-based company to undertake a part of the legal work. However, both would need to be conscious of the requirement for confidentiality and data security.

The SRA in their response to the LSB’s consultation “Alternative business structures: approaches to licensing” made it clear how they would regard outsourcing when they stated that it would be allowed “subject to the regulated firm remaining at all times responsible for the activities of the outsourcer [service provider], which brings with it the necessity to monitor outsourced activities to ensure that the desired outcomes are being achieved.”

The SRA Code of Conduct

The SRA Code of Conduct 2011 has some important things to say about outsourcing – especially in relation to issues such as confidentiality, supervision and practice management – and places the duty upon firms to measure outcomes as an indicator of compliance, confidentiality, supervision and management.
So far as confidentiality is concerned, outcome O(4.1) makes it quite clear that a solicitor must keep the affairs of clients confidential and goes on to state in Indicative Behaviour IB(4.1) that the solicitors’ systems and controls for identifying risks to client confidentiality are appropriate to the size and complexity of the firm or in-house practice and the nature of the work undertaken, and that they enable the solicitor to assess all the relevant circumstances. In other words, the controls must be appropriate to what the firm actually does, and if this includes outsourcing then the controls must assess this too.

This is further reinforced in indicative behaviour IB (4.3) which provides that a solicitor should only outsource services when they are satisfied that the provider has taken all appropriate steps to ensure that the solicitor’s clients’ confidential information will be protected.

It is perhaps worth bearing in mind guidance note 8 to Rule 4 of the Solicitors Code of Conduct 2007 which stated:

“(f) If you outsource services such as word processing, telephone call handling or photocopying you must be satisfied that the provider of those services is able to ensure the confidentiality of any information concerning your clients. This would normally require confidentiality undertakings from the provider and checks to ensure that the terms of the arrangements regarding confidentiality are being complied with. Whilst you might have implied consent to confidential information being passed to external service providers, it would be prudent to inform clients of any such services you propose to use in your terms of business or client care letters.”

Thus, firms planning to outsource any aspect of their work where confidential client information – or even information capable of indicating that the firm acts for a particular client – must take all necessary steps to ensure that those providing the service will keep that information confidential and should ensure that the client is aware – for example through the firm’s terms and conditions – that such outsourcing could take place.

The main requirements in the SRA Code of Conduct in relation to outsourcing are, however, to be found in Chapter 7 which deals with business management.

Whilst outcomes O(7.9) and O(7.10) are the ones which specifically relate to outsourcing, nevertheless provisions which could affect outsourcing are also to be found in outcomes O(7.2),O(7.3), O(7.6), O(7.7) and O(7.8). These largely replace the provisions previously to be found in rule 5 of the 2007 rules.

Outcome O(7.9) provides that a solicitor should not outsource reserved legal activities to a person who is not authorised to conduct such activities – in other words this places a duty upon a solicitor to ensure that anyone to whom reserved activity is outsourced is adequately qualified.

Outcome O(7.10) goes on to provide that where a solicitor outsources legal activities or any operational functions that are critical to the delivery of any legal activities, that they ensure such outsourcing:

1. does not adversely affect their ability to comply with, or the SRA’s ability to monitor the solicitor’s compliance with, their obligations in the Handbook;
2. is subject to contractual arrangements that enable the SRA or its agent to obtain information from, inspect the records (including electronic records) of, or enter the premises of, the third party, in relation to the outsourced activities or functions;
3. does not alter the solicitor’s obligations towards their clients ; and
4. does not cause the solicitor to breach the conditions with which they must comply in order to be authorised and to remain so.

However, the duty to take care goes wider than the provisions contained within these provisions.

Outcome O(7.2) provides that a solicitor must have effective systems and controls in place to achieve and comply with all the Principles, rules and outcomes and other requirements of the Handbook, where applicable. In other words, if the solicitor is outsourcing aspects of their work to a third party, then they must make sure that, for example, confidentiality is maintained, discrimination does not take place and so forth. that may be a difficult requirement to achieve if the provider of the services is many miles distant – possibly even based in a different jurisdiction with different rules and a different culture.

Outcome O(7.3) further reinforces the duty in O(7.2) by requiring the solicitor to “identify, monitor and manage risks to compliance” and to “take steps to address issues identified” – a task which might be difficult to achieve where the solicitor does not have easy access to the premises from which the outsourced work is being undertaken.

Outcomes O(7.6) requires that you train individuals working in the firm to maintain a level of competence appropriate to their work and level of responsibility – which inevitably raises the problem of ensuring that the solicitor satisfies him/her self that those who are undertaking outsourced work are adequately qualified – whilst outcomes O(7.7) and O(7.8) both address issues of supervision – again something which could be problematical when undertaken remotely.

Firms who outsource work must, therefore, ensure that there are sufficient procedures in place to ensure that those responsible for the work – i.e. the partners and senior managers within the outsourcing firm – are able to monitor:

• how it is undertaken,
• by whom it is undertaken,
• the level of expertise of those who undertake it,
• the extent to which those doing the work are supervised at a local level and the qualifications of those supervising,
• the safeguards that are put in place to ensure that it is undertaken securely and confidentially,
• that conflicts of interest do not arise, and
• that criminal activities are not supported by the work.

Finally, firms who are considering outsourcing should also give thought to a number of other issues, including:

• equality and diversity implications – see Chapter 2 of the SRA Code of Conduct – although note the problems that this might raise in cases where what is discriminatory in this jurisdiction may not be in another;
• money laundering prevention measures,
• employment legislation, and in particular the implications for redundancy within the firm, and
• contingency arrangements to ensure that they are able to resource the work being done by the service provider should the agreement with that service provider come to an end.

Conclusion

In conclusion, therefore, there are undoubtedly substantial benefits to be derived for many firms in looking to outsource elements of their work and practice.

The caveat to that, however, is that great care needs to be taken in how and to whom the outsourcing is undertaken.

The risks which we have looked at here are only the regulatory ones. We have made no attempt to look at some of the practical risks such as:

• failing to clarify objectives at the start of the process,
• not setting a starting point against which including costs, benefits and delivery can be measured,
• failing to ascertain necessary changes to internal processes and the impact on other work areas,
• underestimating the impact upon employees and others and not putting in place plans to deal with any morale issues, and
• failing to undertake a full risk analysis.

All of the ten risks set out above need to be looked at closely and firms need to be satisfied that they will be able to control those risks at all stages of the relationship with the organisation to whom the work is outsourced.

Above all else, firms must bear in mind the needs of clients and the requirement for confidentiality, competency of service and trust in the integrity of the legal process. Do not overlook the need to draw to the attention of the company to whom work is outsourced the importance of confidentiality and that there is an adequate confidentiality agreement in place. Tell the client that your firm outsources work and the type of outsourcing that it does, make sure that if there are confidentiality issues that the client is aware of these and above all else ensure that the client does not object.

Contact the Lawyers Defence Group

If you require further information about, or help with, outsourcing then the Lawyers Defence Group can assist you.

For further information, or to contact the Lawyers Defence Group about outsourcing:

• phone on 0333 888 4070;
• email on help [Email address: help #AT# lawyersdefencegroup.org.uk - replace #AT# with @ ];
• request a callback using the form in the right hand menu and someone will call you back at a pre-arranged time;
• write to Lawyers Defence Group, Richard Nelson LLP, Priory Court, 1 Derby Road, Nottingham, NG9 2TA

(revised December 2011)