Starting Right

I've been looking up a few clients today - it seems to be officially the first day back from holiday in most Chambers.

In between hearing about holidays and adventures and quite a bit of drinking in the sun, I've had a couple of discussion about the things to focus on when just back at work. From a management point of view, this is a good time to check some of the basic - Risks, Staff, Marketing & Processes. Yes - it sounds a bit boring, but now - before the work of chambers winds up properly - is a good time to get some of these things done.

So - let's just have a quick look at these four areas. There are some things that you can check quickly...

Risks

Check your Risk Register - you do have a Risk Register, don't you..? Make sure that your list of risks is up to date and reflects any changes that have happened since the last time you checked. Make sure that your Risk Team/Group/Committee think about all the risks and have thought about how Chambers might react if the incident or event happened (and, of course, you do have a Team/Group/Committee...). Then see what you could do now to reduce the possibility of the incident or event happening. Simple.

Staff

Are the staff motivated for the year ahead? Do they know what Chambers is trying to achieve (and it really isn't obvious, I assure you). Make sure that they know the Plan (you do have a Plan..?)  and make sure that you have spoken with them about their role and Chambers' expectations. Talk with them about their expectations - you're likely to be pleasantly surprised. Are the staff happy? It is well documented that happier staff are more productive staff, so it is one of those rare win-win situations where everyone ends happy.

Marketing

Check your marketing plan (you do have...) - is it still appropriate and does it address the needs of Chambers. Have you got the required resources and budgets and to all the right people know what the plan is,, what they can spend, what they should spend and how they and the plan will be measured. Make sure that members of Chambers know what their role is and what they will be expected to do - and how they will be measured. Make sure that the marketing is part of the members' practice reviews.

Processes

This is the most boring one, sorry. If Chambers has some standard ways of doing things (we consultants like to call them processes because it sounds more complicated that way) then members of Chambers and staff will finding doing those things a little easier. Things like Petty Cash; Expenses; Marketing Spend; Practice Reviews. If the standard ways of working are available in a process then everyone can do them in the same way, be measured in the same way and know that their 'thing' will be done fairly, just like everyone else'.

Simple - honestly.

Of course, I would be delighted to help with any of this. See my web site for more details - http://www.mar-aon.co.uk.

Watching the Paper

Law firms love paper. There is tons of it - when I was last employed by a firm, we measured our paper usage by weight...

This blog post by IBB Solicitors caught my eye - it deals with a warning dished out  by the Information Commissioner in connection with the way that paper records were managed by the Council for Healthcare Regulatory Excellence (and they were asking for trouble calling themselves that...) and by NHS Liverpool Community Health. The quote from the Acting Head of Enforcement is telling:

“These incidents should act as a warning to other organisations who handle sensitive papers of the need to make sure their paper records management processes are as robust as their electronic data systems. The protection of data in all formats must be taken seriously.” 

Law firms handle lots of sensitive paper with reams of it delivered every day. How many firms are really sure that their systems are sufficiently robust to ensure its security at every stage of its use and storage? I suspect not that many.

I spend quite a bit of time in law firms of differing sizes and it is usually fairly easy to come into contact with a pile of paper relating to one of the firm's matters. Just as importantly, however, is the care of incoming paper within the firm. If there was a fire or flood in your post room or office, would you really know what piles of paper had been destroyed. Is everything scanned when it comes into the building? Is it logged before it is scanned? If it is both logged and scanned - I bet that is a significant cost that the firm is looking very closely at...

This warning highlights the importance of having systems in place to ensure that paper records are managed as effectively as computer records. They must be in the right place at the right time so that they are valuable to the firm - and the firm must know what paper records they have (and where they are) at all times.

Thanks to IBB Solicitors for picking this one up and mentioning it on their Twitter feed (@IBB_Solicitors).

Business Continuity and the Head in the Sand

Before you go any further with this post, you should be aware that I will be including a naked plug for my consulting service. The plug will come towards the end, and I'll make sure that the "plug" paragraph is obvious - so, if you like, you can read most of the post and ignore that section.

So - Business Continuity. Every firm - every type of firm - must be considering and planning its business continuity. Surely that's obvious. Every firm thinks about what would happen if some sort of major problem or disaster were to occur? Sadly it would seem that a great number of organisations have not thought about it in any sort of systematic manner. I should very much like £5 every time I hear "Oh we all know what to do - but it's not, as such, written down...". I don't doubt that they understand how to evacuate the building (although I have known that to be a problem too) - but Business Continuity is so much more that that. What will happen the next day if the building remains unavailable? Where will people work? Will the telephones work? How will we get our email? Where are my files...?

According to statistics generally agreed and quoted so often by diverse organisations including The Institute of Risk Management, 90% of companies that lose data in a critical incident go bust within 2 years, and 80% of businesses without a Business Continuity plan are forced to close within 12 months of a fire or flood.

So why don't organisations do it? I find it very surprising - particularly when law firms are required by the SRA (through Rule 5) to manage risk and ensure continuity. More importantly, how do they sleep? I remember when I had operational responsibility for large organisations - my first though was, to quote "Marathon Man" "Is it safe?"

Business Continuity Planning (BCP) is not difficult - in fact most of it can be quite fun for those involved. At the heart of most BCP is scenario planning - getting an appropriate group of people together in one room for a few hours to "walk through" some sort of incident to see what would be done now and what could be done better in the future. I have yet to find a firm that wasn't deeply concerned after the first walk through a scenario - as it becomes quickly apparent that communication systems are inadequate and that there are wide differences in understanding and expectation throughout the firm.

I repeat - this is not complicated and yet so many firms do not do this. Small amounts of planning before an incident will ensure that the firm recovers from it - something that is not otherwise guaranteed.

OK - here is the naked plug. I have a good deal of experience in introducing firms to structured assessments of risk and to BCP. Let me come on site and walk through one serious incident with your team. After two to three hours we will see the state of your Business Continuity. If all is well then you will have the satisfaction not only of being assured that your firm is well managed and of having passed this audit, but of knowing that your can sleep a little more easily at night. If issues arise during the walk through then you have the satisfaction of knowing that you have started to consider your risk and that you are well placed to sort the problem out.

Contact me for more details: Peter Blair 020 3286 5610 or 07885 901297 or the Mar-aon web site.

Optimism - Really?

My last posting on the subject of optimism seemed to generate some interest. I was surprised to find that two potential clients had read it, and felt the need to comment on it. I've also had a couple of emails to go along with the comments on the blog. One of the comments seemed to sum up the general response:

if nobody reads this thing, why bother posting it anyway?

In one sentence the author, about whom I was unable to find any information, managed to convey a lot. He - and I will assume it is a male reader for absolutely no good reason - immediately supposes that no-one reads this blog. What a pessimistic view - but one that I would categorise as typically British (or more typically English). We live in a culture that does not embrace optimism - rather living in a cynical and unemotional world. Fortunately I am blessed with some readers - but, of course, the author himself presumably read the blog before commenting.

He finishes with a "why bother". Well even if I had no readers at all, part of the reason for writing this blog is self-satisfaction - I do it partly for the simple joy of doing it. And why not?

My comment author was not alone, however, in questioning the place of optimism in business. "Business is  a serious endeavour...", I was told on one occasion (by someone working in a not-for-profit organisation too), and he went on to suggest that there was no place for, or need for, optimism in a "grown-up" business.

I disagree. Strongly. All too often, the optimistic response is not considered by mature businesses. I recently set up a "Disaster Response Training Session" for a client. We talked through a scenario of a fire on the floor above my client's offices. The attendees were great  - but did not consider the most optimistic outcome. Happy to consider the total loss of their offices and all their data, they did not, before I prompted them, consider the outcome that had the fire protection working, the data security working and their people doing all the right things. From a risk management point of view, this is not good. From a morale point of view it's not good either.

There is nothing wrong in looking at the optimistic outcome as well as the more pessimistic ones.

The same applies to strategic planning and marketing. Perhaps you already have the competitive advantage; perhaps you already have the competences that are needed to thrive in a market. Perhaps your strategy will work to the point of needing more staff, more offices, more support? These situations must be considered.

Be optimistic - there is nothing wrong with it. You will examine the same options as a pessimistic, but perhaps add a few new ones of your own. Given the choice, optimism is, if nothing else, easier to live with.

New Year, New Start II - The NFP and Charity Action Plan

You run or work for a small or medium sized charity (or even a large, multi-national charity), and the new year is a good opportunity to sit back abnd think "how could we be doing this better?" (whatever "this" is).

Now is the time, then, to examine the way that your charity is running and to make sure that the business side (and there is always a business side to any charity) is supporting the charitable aims, rather than consuming cash and thwarting them.

I suggest the following items as a small "action plan" - things to think through and discuss whether as a Trustee, Manager, Employee, Volunteer, or Supporter of a charity:

• Governance
• Is the charity being governed efficiently and is the charity supported by it's Trustees as much as ios possible?
• The Trustees
• Aer all the Trustees sure of what they are there to do?
• Does everyone involved with the charity know the Trustees and do the Trustees know the people who do the work?
• Meetings
• Are meetings efficiently run and productive?
• Strategy
• Does the charity have a clear strategy which is well communicated to everyone?
• Financial Control
• Do the Trustees and Managers have all the financial information they need?
• Are they confident of the financial security of the charity?
• Have the Trustees (and anyone else who needs it) been offered training in understanding the numbers?
• Fundraising
• Is there a strategy?
• Is it working?
• Can the charity say what they will do with a donation - whether it is £2 or £20,000?
• Risk Management
• Have all the risks facing the charity - operational, financial, reputational etc - been considered and addressed in a systematic way?
• Staff Management
• Are staff trained and offered personal development opportunities?
• Communications
• Does everyone know what is going on?
• Is good news celebrated?

Considering these questions - or at least some of these questions - is a really good start to the year.

Post Strike? So What?

So we now know that we are to face what is likely to become a long postal strike. Papers today report the Communication Workers Union as feeling stronger and more confident than Arthur Scargill before the miners' strike. This could herald a long difficult period for law firms who still, in general, prefer to deal in hard-copy.

Fortunately you saw this one coming. A post strike was one of the risks you identified as part of your standard risk planning. You analysed how much mail you send and receive, you've identified the clients who are very "paper heavy" and you've talked with them about arrangements during the strike period. You've setup an email confirmation system so that you know when post has been received. You also set up accounts with couriers - local, national and international.

You did do that, didn't you? Oh dear... I'd suggest that you get on with all of that as soon as possible. Whilst your clients will know there is a post strike, they will probably assume that, as a professional organisation, you will be ready.

If you have doubted the need for risk management and contingency planning, this is a concrete example of its benefits. If you find yourself in the unhappy position of scrambling about over the next few days sorting things out (to the detriment of your real business) then please set plans in place to consider other risks. An hour in advance saves three hours in a panic.

If you are feeling a little smug because you do have a risk system in place and you do have a suitable contingency plan then (a) you probably should - congratulation, but (b) make sure you "debrief" in a few weeks to see if there is anything to learn or anything you could have done better.

Finally on the subject of risk management - have you considered Reputational risk. The recent mess surrounding Trafigura and Carter-Ruck shows two things. Firstly the need to have a plan in place to deal with bad publicity (or even a plan to review clients before you act for them?). Secondly this affair shows the power of the new or social media. While Carter-Ruck seemed to successfully gag the Guardian and (second hand) the BBC, they were incapable of doing anything about public discussion, fascilitated by Twitter. Food for thought for us all - and something to be considered the next time you are reviewing risk.

Risk Management for Small Law Firms

Having looked at Risk Management Systems in large law firms, I was asked to see how a sensible and pragmatic system could be built into a smaller law firm.

Large firms have the resources to install large systems to manage, address and mitigate all the risks facing the firm. There will often be a number of people responsible within the firm for various types of risk, and it is likely that there will be various consultant used - especially in the field of business continuity. Smaller firms do not have this luxury and so need to find a way to address risk without this task getting in the way of the main business.

Firstly, however, why bother at all? Surely risk management is just common sense, isn't it? Well most things are a matter of common sense, but having a systemic approach can ensure that all aspects are considered and that the firm can demonstrate its commitment to risk management both to the regulator and to prospective clients, who are becoming more and more concerned about risk. It is worth noting SRA rule 5.01(1)(i) which says "...you must make arrangements for the management of risk". While this is a marvellously vague phrase, it is worth considering how your firm would be able to demonstrate that it has made such arrangements.

So - what to do? I will not suggest that your firm goes down the Lexcel route - not unless you have some spare time and might like to employ a couple of new members of staff. There are some simple steps which can be taken that will not have too great an impact on the running of the firm:

• Appoint one person to have responsibility for risk (the "Risk Manager" or "Risk Partner"). Sensibly this will be the Managing Partner - who might want to delegate some tasks to more junior staff;
• Make sure that everyone in the firm knows who the Risk Partner is;
• Write some policies with regard to Conflicts, AML and other risks - and make sure that legals staff in particular are in no way confused about contact details and protocols. Writing the policies will be a good investment of a comparatively short period of work. Some standard policies may be available online;
• Have a Risk Register - a central list of all risks facing the firm. This can be a complex database or an Excel spreadsheet - personally I prefer the spreadsheet approach;
• Consider all kinds of risk - Professional, Regulatory, Reputational and Operational - and spend a little time thinking about the risks facing the firm in each area;
• Score each risk for the possibility of it happening and the impact should it happen - this will give a "score" to each risk. Don't spend too long on this step - all risks will be dealt with, the score simply gives the priority;
• Think about each identified risk in the priority already agreed. Think about what your firm would do if it happened and what it could do to reduce the possibility of it happening.
• Write this down! Do the tasks identified in the previous step to reduce risks happening!
• It sounds like a lot of work - but the eight steps above could be spread over a good period of time. The important thing is to address risk in your firm in a systematic manner, and examine the Register annually for new risks.

One of the easiest ways to start is though scenario planning. Think of an incident - or select one of your high priority risks from the Register - and spend a couple of hours (possibly over a glass of wine at the end of a day) talking through the scenario. Imagine there is a fire in the building, or that a former client has posted a blog full of (false) claims about the firm's mistakes. What would you do; who would take decisions; can everyone contact the people they need to; can the firm contact those outside agencies and suppliers necessary?

Small law firms face almost all the same risks faced by "Big Law". By addressing risk before an incident occurs, your firm can be sure of survival, be more likely to come out of the incident well, and be able to demonstrate a professional approach to regulators and clients alike. In this difficult PII climate - a solid risk system is likely to help with negotiations.

Contingency and Risk Planning

I am lucky enough to both live and work in EC4 in the City of London. I have the wonderful benefit of walking to work and walking to visit clients and very much enjoy being in the heart of the City.

At 9pm on Tuesday evening, we had a power failure. This is very unusual, and we did all the usual things from checking our supply and trip-switches to ringing EDF. The fault was traced to a damaged underground cable and was fixed by about 11am the next morning.

As a consultant in, amongst other things, Risk Management I'm pleased to say that I had already considered the scenario of a power failure. Being in the centre of London, I have many options available to me. I have, however, made some effort into ensuring that I can continue to work in difficult circumstances. My backups are available remotely and incoming mail is scanned into my filing system - so I am in a position to take my laptop, find a new space with power and an internet connection, and start work.

Power failure, however irritating, is one of the easiest incidents to deal with. With my interest in risk, I have considered fire, theft, flood, regulatory problems, PR issues, professional problems, client issues etc etc etc

If you haven't done all of this - and done it in a systematic manner - you really must. If you are a partner in a firm and don't know for certain that your firm has all of this in place - ask now. Sadly I suspect that many firms would have a somewhat embarrassed reply to that question. It is never too late to sort your risk management out.

Mar-aon Consulting can help with your risk management - and provide a pragmatic, workable system fit for your firm. See www.mar-aon.co.uk for more details.

Guesting

I've written a guest blog on the Geotrupes' site: it's available here.

Enjoy!

News, information, data and decisions

I have been looking with interest at the way that the various news agencies have been reporting the Mexican flu outbreak. Let me give you a few examples:

The deadly swine flu virus can no longer be contained, says a WHO official, as the health agency raises its alert level - from the BBC's UK News main page, Tuesday 28/04/09

The first British victims of swine flu were named today as Scottish newlyweds Iain and Dawn Askham, from Falkirk. They flew back from Cancun in Mexico last week. - Daily Mail, 28/04/09

World Health Organisation raises threat level posed by disease to unprecedented 4 as the first cases emerge in Britain - The Times, 28/09/09

First UK swine flu cases confirmed. Pandemic worries dent stock markets - Financial Times, 28/04/09

From reading these headlines - and I have deliberately only taken the headlines at the moment, it would appear that we could all well be at danger from a pandemic the size of that in 1918 which killed tens of millions.

Those were the news agencies - now let's try to dig a little deeper. Actually it's not hard. A more careful read of the items above does give a slightly different picture:

Two quotes from today's FT - Professor Neil Ferguson, a member of the WHO’s pandemic influenza taskforce, said 40 per cent of the UK population could eventually be infected if the country was hit by a pandemic.

Prof Ferguson, of London’s Imperial College, said cases were likely to die down within a matter of weeks because the UK was moving out of the normal season for flu infection, but there was a risk that the disease would flare up again once the summer was over.

He told the BBC Radio 4 Today programme the 152 deaths in Mexico probably made up a relatively small proportion of the total number infected, who might run into tens or hundreds of thousands.

“So-called bird flu - H5N1 - was a much more dangerous virus,’’ he said. “We are not in the same ballpark. But we can’t at the moment answer the question ’Is it comparable to 1918 Spanish flu, which killed a lot of people, or is it much more like Hong Kong flu?’.’’

and...

Alan Johnson, health secretary, said the UK had “established a stockpile of enough anti-viral drugs to treat more than 33m people,” or more than half the population.

I'm not sure what the opposite of alarmist is, but that would describe me. Thirty-two million people in the UK? I believe there are two reported cases at present, both of whom were in the affected area in Mexico and both of whom are responding well to treatment. That sounds a lot less alarming than describing people responding to drugs as "victims" which, perhaps only to me, implies death.

I decided to go to the source - the World Heath Organisations site. I was concerned about the threat level referred to in the "Times" and wanted to understand the scales used. I found this great graphic (see here):

Now, level 4 does look a little scary. The full text of the release from the WHO, however, stressed that the move to phase 5 was as likely as a return to phase 3 or below. The important thing I learnt from a short period of research is this: it is too early to state the extent of the outbreak.

It is a modern malaise that information is demanded so quickly. Compare the news of a flu outbreak with the on-going story of the recession. "A flu outbreak - my God. It could be pandemic. Is it pandemic - is it, is it?" we demand of scientist through our media, just as we did (and continue to do) regarding the recession "Is it worse. It's over, isn't it. House prices have gone up - we're all safe. The recession will just get worse" and so on and on. I'll repeat - it is too early to say. Both about a possible pandemic and the recession. One of the main drivers is the negative question. No credible scientist of any flavour can respond to the question "So - will you confirm that this is not a pandemic?" with anything other than a bland answer. No-one would ever say "yes" to that question because it is too early to know. Everyone knows it is too early, and yet we continue to ask. Journalists and reporters will even preface their questions with "It will be too early to say, but..."

This demand for early information and early action can be seen in business too. I spoke with a client the other day and, over a very pleasant lunch, discussed the recession and actions his firm could take. Over a particularly fine glass of wine, I explained my theory about the dangers of precipitate action and the need for good information. He generally agreed with me and then laughed and said "But you couldn't say that - either as a consultant or a CEO". I know what he meant. Organisations generally call on consultants for action and advice (or to take the blame for decisions, but that may be a different entry) and so advice consisting of "do nothing too serious yet and let's get more and better information" is unlikely to go down too well.

It is important to remember, however, that a decision based on quality information will be a quality decision. I acknowledge that one can never have perfect data and that most business decisions have to be made with a deadline in mind. Wait where possible is my message of the day.

Let's blame... the Bankers

Wouldn't it be great to be able to blame the meltdown/recession/depression/economic cock-up (select your favourite) on one person or one group of people? To have one face to throw things at and to be able to curse fluently at the right person. That would be great.

Sadly I don't think it's that simple. Do I think that the Bankers were stupid or even complicit? Yes - certainly. There are, however, other people to blame too - us. The shareholders. "Wait", you say. "I wasn't a shareholder". Well if you have a pension (and if you don't, that's pretty worrying), you probably were a shareholder. I was. So at best, I too was complicit in the risk-taking that was going. After all, we the shareholders were demanding high returns - double digit growth(!) - from a mature bank. Now come on - we're all intelligent people and we know that high return demands high (or at least higher) risk. We the shareholders were demanding high returns and were willing to look the other way when confronted with the obvious increase in risk.

Shame on all of us, I say.

Will it change? No, probably not. I imagine that we, as a nation and as a group of investors, will be more cautious in the future. In the end, however, we are a greedy race. My point is that while it's fun to shout and throw things at the bankers (I'm not suggesting that we stop) - we can't wash our hands of all blame. We should examine our own positions and our own demands and accept our responsibilities.

Sermon over for today.