Policy vs Practice: How Law Firms Can Evidence Compliance in the Real World
Most law firms have policies.
They have procedures, risk assessments, training records, file review processes and documented controls. On paper, the compliance framework may look perfectly sound.
But there is another question which matters just as much:
Does what happens in practice match what the policy says should happen?
This is often where the real compliance risk lies.
A well-written policy is important, but it cannot demonstrate compliance on its own. Firms also need to be able to show that their procedures are understood, followed and evidenced consistently across the business.
The gap between policy and practice
In many cases, inconsistencies don't arise because people are deliberately ignoring procedures.
Working practices evolve.
Teams change. New systems are introduced. Responsibilities move between people. Workloads increase. Staff develop their own ways of completing routine tasks and, over time, the way something is actually done can begin to drift away from the written procedure.
Individually, those changes may appear relatively insignificant.
Collectively, however, they can create a gap between the firm's documented compliance framework and what is happening on its files.
And that gap matters.
Could you evidence what happened?
One of the most useful questions a firm can ask is:
If we were asked six months from now why this decision was made, could we evidence it?
Good compliance isn't simply about reaching the right decision. It is also about being able to demonstrate the reasoning behind it.
That might mean showing:
why a particular client or matter was assessed as higher risk;
what additional enquiries were undertaken;
why a concern was escalated - or why it wasn't;
what source of funds or source of wealth information was considered;
what supervision took place;
how an exception to the normal procedure was authorised; or
what action followed an issue identified through a file review.
The precise evidence will depend upon the circumstances.
The important point is that somebody reviewing the matter later should be able to understand what happened, why it happened and how the firm's procedures were applied.
Policies need to reflect reality
Policies and procedures should provide a framework for consistent decision-making.
But they also need to be workable.
If a procedure is routinely being bypassed because it doesn't reflect the way the firm operates, simply reminding staff to follow it may not address the underlying problem.
Instead, it may be worth asking:
Is the practice wrong, or is the policy no longer right?
Sometimes the answer will be that staff need further guidance or training.
Sometimes a process needs tightening.
But occasionally the written procedure itself needs reviewing because the firm's systems, services or working practices have changed.
Compliance should not exist separately from the business. Effective controls need to work within it.
File reviews can tell you what's really happening
Policies tell you what should happen.
File reviews help show you what is happening.
That makes regular, meaningful file review an important part of the compliance framework.
Rather than treating reviews simply as an exercise in identifying individual errors, firms can use the findings to look for wider patterns.
Are the same issues appearing repeatedly?
Are particular procedures misunderstood?
Are records inconsistent between teams or fee earners?
Are decisions being made appropriately but poorly documented?
Is there a recurring issue which suggests that training, supervision or the policy itself needs attention?
Viewed this way, file reviews become much more than a checking exercise. They provide useful management information about whether the firm's controls are actually working.
Training should test understanding, not attendance
The same principle applies to training.
A record showing that somebody attended an AML or compliance course provides evidence that training took place.
It doesn't necessarily demonstrate that the individual knows how to apply that learning when faced with a difficult situation.
Effective training should help staff understand not only what the firm's procedures require, but why they exist and how they should influence real decisions.
That is particularly important where judgement is required.
Policies cannot anticipate every scenario a member of staff may encounter. People therefore need enough understanding and confidence to recognise when something doesn't look right, know what they should do next and understand when an issue needs to be escalated.
What would somebody reviewing your firm actually see?
This is perhaps the simplest way to test the strength of a compliance framework.
Imagine somebody independent came into the firm tomorrow.
They read your policies.
They spoke to your staff.
They reviewed a selection of files.
They looked at your training records, risk assessments and management information.
Would all of those things tell broadly the same story?
If they would, that's a good indication that compliance is embedded within the firm's day-to-day operation.
If they wouldn't, it doesn't necessarily mean there is a major compliance failure.
But it may highlight where some attention is needed.
Closing the gap
Strong compliance is not about creating ever more paperwork.
Nor is it about trying to design a policy for every possible eventuality.
It is about having proportionate controls that people understand and can apply consistently - and being able to demonstrate that they have done so.
Regular file reviews, relevant training, effective supervision and periodic reviews of policies and procedures can all help firms identify where written requirements and working practices have begun to diverge.
Because ultimately, a policy is only part of the evidence.
What matters is what happens in practice.
Final thoughts
Good compliance isn't simply about having the right documents. It is about being able to demonstrate that what happens in practice matches what you say happens on paper.
Strong controls don't have to be complex, but they do need to be clear, consistently applied and capable of being evidenced.
Tracy Thompson is an independent compliance consultant and trainer who supports law firms with AML, CQS, Lexcel and wider regulatory compliance requirements, including independent audits and file reviews.
If your firm would benefit from practical support reviewing whether its policies and procedures are working as intended in practice, please feel free to get in touch.
Comments