Access Legal research highlights hybrid working compliance gaps

Access Legal has released new research that is encouraging law firms to review gaps in their compliance, given over two thirds plan to switch to a permanent hybrid way of working once restrictions ease.

The legal technology division of The Access Group surveyed a substantial number of law firms and found that 85 per cent plan to offer a mix of home and office working going forwards. However, the survey also revealed several compliance essentials that some firms may have overlooked during the Covid-19 lockdowns.

Almost a quarter of firms (22 per cent) negated to review their health and safety assessment when staff were forced to work from their own homes in March 2020. With firms having the same responsibility for those working at home as they do for those in the office, adjustments should be made to fulfil health and safety obligations, including carrying out home workstation risk assessments and putting procedures in place to maintain direct contact with homeworkers.

When it comes to cyber security, 43 per cent of firms have not fully updated their cyber security policies since moving to remote working, which means they have not properly identified the risks of personal IT equipment being used, including virus protection and appropriate system access tools.

Despite the recent focus the SRA has been putting on compliance with money laundering legislation, 40 per cent of firms had not reviewed or updated their AML Practice Wide Risk Assessments. This goes against the requirement to note reviews even where no updating is found to be necessary. In reality, it is likely the requirements for training, policy, control and procedure updates, supervision, and ongoing monitoring of employees would all have needed updating during the pandemic.

Finally, nearly half (49 per cent) of firms surveyed said  they had not carried out a Data Protection Impact Assessment (DPIA) when moving to remote working. A DPIA is designed to help firms systematically analyse, identify and minimise the data protection risks of a project or plan, which the switch to home working would have been classed as. By not carrying out a DPIA, client data could be at high risk from cybercrime and data loss, especially if this data is being accessed and stored using an employee’s personal IT equipment that may not have appropriate security software installed and is accessible by other members of the family.

Commenting on the survey findings, Brian Rogers, Regulatory Director at Access Legal, said:

“Although most firms appear to be doing the right things, there are quite a few that are placing themselves, their staff and their clients at significant risk. We urge these firms to take urgent action to ensure they seek help to address the gaps highlighted.

“As well as the compliance issues, there were also evident disparities in competency and supervision arrangements, policies and procedures and Business Continuity Plans. With the vast majority of firms looking to make a permanent switch to hybrid working, now is the time to carefully review compliance procedures and ensure that your requirements as an employer are being met.

“Many firms have shared with us that time and a lack of knowledge are the biggest constraints when it comes to addressing these issues but that isn’t going to be an excuse the SRA accepts. Firms have a duty to make the time to comply and understand what requirements they are expected to comply with.”

For further advice on compliance for the legal sector, visit


This article was submitted to be published by Access Legal as part of their advertising agreement with Today’s Conveyancer. The views expressed in this article are those of the submitter and not those of Today’s Conveyancer.

Today's Conveyancer