Closed Consultation

Information requirements from firms

7 August 2008

The deadline for submission of responses to consultation paper 7 on the Legal Services Act was 30 April 2008.

You can download a report, published on 7 August 2008, entitled Consultation feedback on information gathering for risk-assessment (PDF 119K). An executive summary of the report appears below. For reference purposes, the consultation paper also appears below.

Consultation feedback on information gathering for risk-assessment – executive summary

This paper provides feedback on the results of the SRA's consultation paper dealing with proposed information requirements from firms in the context of a risk-based approach to regulation, which was published on the SRA website on 20 February 2008.

The consultation sought views on various proposals for collecting additional information from firms regulated by the SRA to develop a clear picture of the possible risks to clients and to the public interest generally. To achieve this we plan to collect and evaluate various categories of information, and to use this to develop a matrix of possible risk factors. Against this, we will be able to gauge whether particular factors or combinations of factors appear to give rise to a higher or lower risk of default within firms. The consultation also asked for views on various practical issues such as how frequently information might be collected, and the likely impact on business practices and equality and diversity issues.

We received 37 responses and, although this was a relatively low response rate, we were pleased to receive input from a wide variety of respondents. This paper looks at the main themes and issues that emerged from the consultation. It also provides a statistical analysis of the responses from a general perspective, as well as focussing on the profession's views.

In brief, we found broad agreement on the benefits of a risk-based approach, along with concerns about a heavier regulatory burden. It was also apparent that there are concerns about how the information will be used. By and large, we will be looking for indicators of risk. It is also important that we have a baseline of information that shows the current state of the profession. It is as important for us to monitor changes in the profession overall, so that we can anticipate risk, as it is to look at the detail of individual firms.

The consultation was a first step in the process of developing a risk analysis model, and the responses will feed into further work now being undertaken. This will include further consultation on the detail of the information to be sought, to help us to gather the most appropriate information from firms, in the most practical manner.

Download the paper in full: Consultation feedback on information gathering for risk-assessment (PDF 119K).

You can download the consultation paper or read it below.

Contents

1. Introduction and overview – purpose of the consultation
2. Background
   • What principles will guide us in developing our information requirements?
   • What is risk-based regulation?
   • An evolutionary approach
   • Why did we look at what other regulators require?
   • How we are developing our information gathering
   • Confidentiality
   • What information do we currently gather from firms?
    
3. Proposed new information requirements
   • When will we gather this information?
   • Will information be requested on initial application or on renewal—or both?
   • Information we propose to ask of firms
   • Other information we might ask for
   • Who will we ask for this information?
    
4. Questions
5. Annex A – A summary of the main types of information that we found were sought from firms by other regulators and by a range of qualifying insurers

1. Introduction and overview – purpose of the consultation

1.1

The SRA is developing its regulatory framework for the new forms of practice permitted under the Legal Services Act 2007 ("the Act")—legal disciplinary practices (LDPs) and, some way in the future, alternative business structures (ABSs). The Act requires a move to regulating firms as well as individuals. This will provide an opportunity for us to further develop our risk-based approach to regulation).

1.2

The purpose of the consultation is to invite your comments on the types of information the SRA proposes to collect from regulated firms to enable us to fulfil our regulatory obligations most effectively. A separate consultation paper dealing with changes to regulatory procedures discusses how and when we may collect information. This paper concentrates on the content of the information requirements.

1.3

This is an initial high level consultation. Once we have your views, we will need to do further work on the detail of the information requirements, and we will consult again on that detail. However, if you have views as to what more-specific information we should collect in relation to the general areas discussed in this paper, please let us know.

1.4

We have looked at the information requirements of a number of other regulators. Most seek a wider range of information than we currently have, and maintain that such information assists in delivering risk-based regulation—in the interests of consumer protection—and helps the regulator to target resources and avoid unnecessary expenditure by either the regulator or the regulated community. We are very aware that any new information requirements will involve an additional regulatory burden on firms. On the other hand, most firms will recognise the benefit of regulators having access to information which will enable them to target high-risk areas and, therefore, to minimise the burden upon low-risk firms. We aim to be proportionate.

1.5

In November 2007, we published a strategic paper entitled Legal Services Act: New forms of practice and regulation. We recommend you read this document, as it contains much of the background to the issues raised in this paper. It also contains a glossary of terms which you may find useful when reading this and other consultations.

1.6

The consultation is aimed at all those with an interest in the delivery of legal services and, in particular,

• consumers of legal services, and
• providers of legal services, including those considering setting up a solicitors' firm, whether or not a legal disciplinary practice (LDP).

1.7

We would be grateful if you would read and respond to the consultation. It is an opportunity for you to contribute to the regulatory regime of the future.

2. Background

2.1

To facilitate the move to new forms of practice, the Act amends the existing recognised body regime by allowing the SRA to regulate legal services bodies as recognised bodies. This will include not only solicitors' companies and limited liability partnerships (which currently need to be recognised bodies), but also solicitors' partnerships and LDPs. Sole practices will be regulated in broadly the same way as recognised bodies.

2.2

The move to firm-based regulation must coincide with the introduction of LDPs. It will improve our ability to regulate both traditional and new types of practice and is required by the legislative changes made by the government.

What principles will guide us in developing our information requirements?

2.3

The SRA strategy sets out our high level obligation to regulate in the public interest. It requires that in doing so we will operate as a fair and transparent regulator in accordance with good regulation principles, adopting a risk-based approach to regulation. We believe that the proposals in this paper will help us to achieve some of our key objectives in ensuring that

• we have appropriate information to inform our risk-based approach,
• we will be in a position to take prompt and proportionate action to minimise risk to consumers of legal services, and to the public as a whole.

2.4

The SRA is itself subject to public duties relating to equality and diversity and in fulfilling those duties it is helpful for us to know, for example, whether our regulatory interventions are disproportionately applying to minority firms. While we have some information that enables us to do that at the moment, it is not as good as it should be, and so our analysis could be called into question. Currently, we seek equality and diversity information from individual solicitors, but, in the future world of LDPs, with non-solicitor lawyers and non-lawyers, simply having information about solicitors in firms will not give an accurate picture. We and the government encourage all firms to monitor the equality and diversity make-up of employees within firms, but we do not know the extent to which that is done and whether you would have any difficulties in collecting this information. We are still developing our strategy on this and would be grateful for any initial views on what sort of equality and diversity information firms might be able to produce in future and the potential impact on firms in providing this information.

2.5

We and the government encourage all firms to monitor the equality and diversity make-up of employees within firms, but we do not know the extent to which that is done and whether firms would have any difficulties in collecting this information. We are still developing our strategy on this and would be grateful for any initial views on what sort of equality and diversity information firms might be able to produce in future and the potential impact on firms in providing this information.

2.6

Our November 2007 strategic paper highlighted a number of design principles that we have adopted to drive our approach to the changes that we need to make. In developing our information gathering requirements, we aim to follow these by

• adopting an evolutionary approach in deciding the types of information that will best help us regulate,
• minimising so far as possible the additional regulatory burden for firms in providing that information.

What is risk-based regulation?

2.7

As a regulator, the SRA fulfils its role by regulating in the public interest to ensure safe, competent practice. We need to have a clear picture of the possible risks to clients and others affected by the work of solicitors, as well as ensuring continued public confidence in the profession. This consultation outlines how we will develop our approach to regulatory risk management through gathering and collating information about firms as well as individuals.

2.8

We have published our approach to risk-based regulation.

2.9

Our current risk-assessment processes use information received from a range of sources—clients, other firms and so on, normally raising concerns about possible misconduct or rule breach.

2.10

Our aim is to improve our approach to proactive risk management by gathering and collating information at an earlier stage. This will better equip us to identify possible areas of difficulty and take pre-emptive action before allegations of misconduct arise. It will also put us in a better position to identify firms that present a low risk.

2.11

A major benefit of risk assessment is that it allows regulators to apply limited resources more efficiently, as they are in a much better position to predict difficulties and target action accordingly.

An evolutionary approach

2.12

This is an initial consideration of the information that we may seek from firms. We intend to review the process over time to evaluate whether some categories of information are more useful than others in developing our risk-assessment framework.

Why did we look at what other regulators require?

2.13

To help us develop our information strategy, we contacted other regulators to explore what information they gather. This has shown that, on the whole, most collect a far broader range of information for regulatory purposes than the SRA currently requires.

2.14

We have explored with other regulators, and are continuing to do so, the benefits they gain from the information they collect. Some gather more than others, but the common message is that information allows them to better fulfil their regulatory purposes. Having a range of relevant information to improve the tools for identifying areas of risk for the bodies they regulate permits greater effectiveness. In practice, this can mean, for example,

• predicting (rather than assuming) and acting on specific factors that may cause risk to clients of their regulated entities,
• assessing firms and applying appropriate (and sometimes different) levels of regulation to them,
• developing their regulation to fit the current landscape of their entities.

2.15

We have also looked closely at the information requirements of professional indemnity insurers. While regulatory risks are not identical to the risk of civil claims, there are common factors, and the information requested by insurers is often based on highly developed risk-assessment systems to calculate underwriting costs. Also, the fact that most firms will have produced certain information for insurers is important, as it helps us to limit any increased regulatory burden on firms.

2.16

We aim to be as effective as possible, by requesting information that we believe will be of relevance for developing our risk-assessment process. The benchmarking exercise has enabled us to refine our proposed approach by looking at other bodies with similar regulatory goals and building on their experience of what they find to be valuable information. In conjunction with this we have based our approach on a broad understanding of the risk factors affecting existing practices, as well as new regulatory challenges arising from LDPs.

2.17

Annex A is a summary of the main types of information that we found were sought by other regulators and the insurers.

How we are developing our information gathering

2.18

We recognise the need for proportionality, and we aim to ensure that we will balance the value of the information that we collect against the cost to firms and the SRA. However, we are starting from a relatively low information base and may not, in the first instance, be able to provide historical evidence to justify all information requirements. We will however keep all requirements under review, and, if we find in future that some information has proved to be of little regulatory use, we will cease collection.

2.19

Following our research, we set out in this consultation (paragraphs 3.9-3.10) the types of information that we believe will build on our experience and improve our ability to regulate most effectively.

2.20

Our assumption is that no individual piece of information will hold the key to risk assessment. Our aim is to collect a range of information that will enable us to identify particular factors that might trigger concern, and combinations of factors that indicate higher or lower risk based on analysis of a bank of factual evidence.

2.21

The work done now on developing our systems in the context of LDPs can be extended when ABSs become possible and the SRA will be able to regulate a greater diversity of firms.

Confidentiality

2.22

We understand that firms will not want to be overburdened with bureaucratic requirements. Although we are likely to be asking for a wider range of details from firms, our intention is to help us to improve our efficiency and therefore restrict regulatory costs.

2.23

We are also aware that there may be concern at giving what might be viewed as sensitive business information, although we believe most firms will expect to provide such details to their insurers and recognise that other regulators usually have access to such information. It is important to note that information collected by the SRA will be for regulatory purposes only and will be stored securely and treated confidentially.

What information do we currently gather from firms?

2.24

Currently, the SRA collects information from recognised bodies on their initial application for recognition and subsequently as part of a three-year renewal procedure (this does not apply to partnerships or sole practices). Additionally, we ask for some limited information in respect of all firms via individual solicitors through the annual practising certificate renewal process.

2.25

At present, the SRA requires the following information from recognised bodies.

On initial application for recognition

• name, Registered Office and practising addresses
• details of specified persons (e.g. solicitor qualified to supervise, money laundering compliance officer, etc.)
• predecessor or related partnerships
• whether client money is held and the firm's accounting period
• insurers and policy details
• share-owners, members and directors
• qualified employees transferring from predecessor partnership
• details of disciplinary action, convictions, insolvency of share-owners, members and directors
• declaration of compliance with rule 14 (Incorporated practice) of the Solicitors' Code of Conduct 2007 (the Code of Conduct) and Solicitors' Indemnity Insurance Rules

On renewal of recognition

• confirmation of details given on initial application
• fresh declaration of disciplinary action, convictions, insolvency
• fresh declaration of compliance

We propose to continue to request this information, on the grounds that it has a clear regulatory purpose.

2.26

As part of the annual practising certificate renewal process, we also ask for the following additional information about firms:

• practice manager,
• opening hours,
• confirmation of complaints-handling procedure,
• details of referral arrangements.

We will consider whether there is sufficient regulatory benefit in continuing to collect this.

3. Proposed new information requirements

When will we gather this information?

3.1

We will put in place a structured process to gather the information—this is expected to be on an annual basis and is likely to coincide with renewal of practising certificates. We believe this will dovetail with firms' existing processes. See our initial policy paper.

3.2

Passporting – To facilitate the move to firm-based regulation, we propose to 'passport' existing practices, including sole practices, into the new framework without need for any administrative steps or information-giving at that point. This will happen as soon as the framework is in place and is expected to be in early to mid-2009.

3.3

After the coming into force of changes to legislation permitting LDPs and requiring firm-based regulation, all newly established firms will need to complete an application for recognised body status (or the equivalent for sole practitioners) and to respond to the new information-giving requirements. LDPs applying for authorisation will also need to provide some additional information (e.g. to satisfy the 'fit and proper' requirements for any non-lawyers).

3.4

Firms that have been passported will be asked to respond to the new information-giving requirements in November 2009—this will be their "first renewal", although in reality it will be the first declaration of information on behalf of the firm.

3.5

In November 2010, we will be able to establish a "normal renewal" system that applies to all recognised bodies, regardless of whether they have been passported. We plan to have renewal forms that will recite the information previously given by the firm and simply ask for confirmation or details of any changes.

Will information be requested on initial application or on renewal—or both?

3.6

We are still considering what information we will require of new firms making an initial application. The purpose of that information is to help us to make a decision as to whether to grant recognition or not. We expect that there will be broad similarity in the requirements on initial application and renewal, although there will need to be some areas of difference—for example, new firms will not be able to give the same historical information as existing firms but will need to give some information that may only be required to support the initial application.

3.7

In addition, it may be that we will seek some categories of information less frequently (e.g. three-yearly rather than annually).

Information we propose to ask of firms

3.8

In 2009—in addition to the information currently asked of recognised bodies (see paragraph 2.24)—the regulatory information we consider that we will require from firms on renewal in order to regulate effectively is as follows. (Please note that, in some cases, our proposals are put forward only in principle and we recognise that further work will need to be carried out on the detailed requirements. Some of the same information, where practicable, will be required of new firms seeking recognition for the first time.)

3.9

The types of information we propose to request

Who will we ask for this information?

3.11

We think that initially we should seek the same types of information from all firms regardless of the nature of the body, that is, whether it is

• a sole practice, a corporate body or a partnership,
• a solicitors' practice or an LDP, or
• an LDP with only lawyer managers or an LDP with lawyer and non-lawyer managers.

We aim to ensure an objective, fair and non-discriminatory approach, and believe that at present a uniform approach to information gathering will give us a sound basis for assessing all firms and looking at whether there appear to be different risks associated with different types of structure. In the future, we will expect to have a sufficient range of data to be able to reconsider whether it is the best use of resources to collect standard information from all firms.

If you do not agree, we would like to know your reasons and any other suggestions that you have.

Thank you for taking the time to read this consultation. Please refer to the questions below.

4. Questions

4.1

We consider that information of the following types will assist in risk assessment (paragraphs 3.9-3.10).

Information we think we should gather from 2009

• details of the extent of managers' ownership of firms (paragraph 3.9(a))
• the amount of firms' turnover (paragraph 3.9(b))
• a breakdown of the work types undertaken by percentage of turnover (paragraph 3.9(c))
• associations, connections or relationships with any other firms or non-solicitor businesses (paragraph 3.9(d))
• details of involvement or influence in the firm not evident from the details of ownership (paragraph 3.9(e))
• negligence claims made against firms (paragraph 3.9(f))
• reasons for dismissal of managers and employees in connection with conduct matters (paragraph 3.9(g))
• details of any other roles or occupations undertaken by managers of firms (paragraph 3.9(h))
• information on the financial stability of firms (paragraph 3.9(i))
• general requirement to disclose appropriate information (paragraph 3.9(j))

Additional information that we might gather in future

• equality and diversity information (paragraph 3.10(a))
• details of internal complaints (paragraph 3.10(b))
• confirmation of compliance with professional conduct requirements (paragraph 3.10(c))
• confirmation of standards of competence (paragraph 3.10(d))
• details of training in general conduct and underlying legal issues (paragraph 3.10(e))
• details of legal actions, other than negligence claims (paragraph 3.10(f))
• details of staff (paragraph 3.10(g))
• details of any other income received by firms (paragraph 3.10(h))
• details of banks or other institutions in which client money is held (paragraph 3.10(i))
• confirmation of satisfaction of staff citizenship status (paragraph 3.10(j))

Do you think that some information should be collected less frequently than annually? If so, please say what types of information and how often. Please give your reasons.

What other types of information might we gather to help us in risk assessment?

Are there particular types of information that it is easy to provide? Or is there a particular approach to requesting the information that would make it easier for firms to provide it?

4.2

Our strategy would be to collect the same information from all types of firm (paragraph 3.11).

Do you think there is any merit in collecting extra information from some firms and, if so, what extra information and from what types of firm?

4.3

If you are a solicitor, can you foresee any potential impact on your own business practices—including business processes, confidentiality and data protection?

4.4

Can you foresee any potential adverse impact on equality and diversity?

Annex A

A summary of the main types of information that we found were sought from firms by other regulators and by a range of qualifying insurers

• Entity and ownership – the composition and control of the regulated entity
• Personnel – the personnel (or a key subset) within the regulated entity that provide the regulated service
• Regulatory history – regulatory, insolvency, financial judgements and criminal history of the entity, its key personnel and owners
• Business plan – a business plan enabling assessment of the soundness of the business in light of the chosen business areas
• Financial position – turnover for entity's regulated activities according to business areas Financial obligation/liabilities of the entity/owners enabling oversight of the financial position of the business
• Work types – identification of areas of services provided by the regulated entity within the regulated service area or profession
• Compliance – how the entity ensures regulatory compliance and who is the responsible officer
• Training – the entity's process for professional and other training of all staff in support of regulatory compliance in broad terms: competence, service and integrity
• Client money handling – the entity's process, methods, systems (including IT systems) for dealing with client money, and specific details of where client money is held
• Customer complaints – the entity's process for management and record–keeping with regard to complaints
• Money laundering – how the entity ensures compliance with money laundering regulations, who is the responsible officer, and the internal disciplinary process for non-compliance
• Insurance – the entity's insurance provider, coverage, amount, and any special conditions
• Professional advisers – the entity's auditors, bankers, accountants, solicitors etc
• Further relevant information – the entity's obligation to disclose any factors relevant to the application/renewal that have not been specifically requested
• Responsible contact – a named person with responsibility for dealing with the regulator

Downloadable document(s)

• Legal Services Act: Consultation paper 7 (PDF 112K)
• Consultation feedback on information gathering for risk-assessment (PDF 119K)