Compliance Archives - The Cashroom

What is your strategy for law firm data security?

The news is regularly showcasing headlines about companies experiencing cyber breaches, as criminals refine their skills, finding sophisticated ways to get their hands-on personal data and intercept financial transactions. So when was the last time you reviewed your law firm data security?

But when it comes to law firm accounts, how are you able to ensure that the information the business holds is kept safe and secure? And how are you able to ensure that you’re remaining compliant for your regulators?

Law firm data security is one of the many facets of the day to day running of business. One that regularly competes for a solicitor’s attention but may not seem as high a priority as earning fees or other more profitable business opportunities.

Due to the increasingly cyber world we live in, having cyber policies and security in place is vital to ensure cyber criminals are kept firmly in the dark. However, The ‘Cyber Security Breaches Survey 2019’, released by the Department for Digital, Culture, Media and Sport found a number of policy omissions desperately needed to protect a firm and their clients from the clutches of cyber criminals.

Only one third of UK businesses have created a cyber security policy within their organisation, with 26% training staff to spot the signs of cyber crime. Fewer than a third of organisations had also planned for a data breach.

This is where outsourcing your management accounts can help to free up your time, to focus on money earning opportunities and other priorities, whilst leaving the law firm data security, compliance and cyber security in a safe pair of hands.

An outsourced management accounts team take a belt and braces approach when it comes to security measures. They’ll have procedures and policies in place like firewalls, encryption, password protection, physical data centre anti-intrusion systems, software updates and back-up procedures. This approach ensures that your law firm data is kept secure.

The Solicitors Regulation Authority speculated in 2018 that £11million was lost in the legal sector due to cyber crime, and as a result a plethora of regulations have been instigated to help tighten law firm’s defences, and ensure firms share information with regulators as soon as issues become apparent.

Third party suppliers are able to keep their fingers on the pulse of your accounts and flag up anything that seems out of place not only to you, but to the regulators, in a timely manner. This alleviates time pressures and potential to miss an issue and come under further scrutiny.

Why The Cashroom?

Here at the Cashroom our experts are on hand to take some of the stress away from day to day business. Our expert legal cashiers can help to improve the efficiency of your law firm, whilst ensuring firms remain complaint with the SRA Account Rule Changes.

If you are considering outsourcing legal cashiering and would like to chat to someone at The Cashroom, please get in touch.

If you are regulated within the English and Welsh markets then please contact:
Alex Holt E: alex.holt@thecashroom.co.uk t: 07817 420 466

If you are regulated by the Law Society of Scotland, please contact:
Gregor Angus E: gregor.angus@thecashroom.co.uk t: 07875 598 593

Embracing the Use of Portal Technology

Digital innovation has been heralded as an imperative and constantly improving area within the legal sector as more legal service professionals look to reduce timescales, improve efficiency, mitigate risk, lower costs and introduce portal technology.

According to the Solicitors Regulation Authority’s (SRA) ‘Tech and Legal Services’ report, over a third of all UK businesses and half of UK consumers, who use legal services, demand an online service of some description such as portal technology.

Almost a third of all legal services are now provided online in some capacity, increasing to over half in the conveyancing sector.

SRA research indicated that 63% of their regulated firms are preparing to migrate to an e-conveyancing service, deliver more text messaging communication and offer sophisticated online portals in a bid to move away from traditional modern methods of communication like email which are particularly vulnerable to attack.

Current Issues Plaguing the Legal Sector

It is not surprising that more law firms are turning to portal technology to protect client and business information given the increased vulnerabilities to email communication.

Price Waterhouse Cooper’s ‘Law Firm’s 2018 Survey’ found that 60% of all law firms experienced an information security and data loss security incident in 2018.

Over 80% of law firms had been the victim of a phishing attempts last year with almost half (46%) of all firms reporting a security incident involving their staff leaking or losing confidential information.

If anything, 2019 has only accelerated these historic findings with the frequency of cyber attacks involving UK businesses increasing by 243% over the summer when compared with the same period a year earlier.

Whilst the majority of law firms may be adept at dealing with this persistent threat, when communicating with and relying on the public and third parties, it becomes a lot more difficult to confidently protect sensitive information.

Between July and the end of September, 23 email scam alerts were issued by the SRA; this equates to a known email scam targeting the legal sector every four days.

This figure represents the unscrupulous emails that were identified and reported, suggesting that the true threat is a lot more severe.

Portal Technology Protecting Law Firms and Their Sensitive Information

As cyber criminals continue to enjoy the benefits of targeting traditional forms of online communication, finding a technology capable of appeasing a regulatory compliance obligation whilst defending sensitive data from unscrupulous cyber criminality is crucial.

An effective portal has the capability of unifying all communication sources, improving efficiency, protecting client information and improving the consumer journey.

Opting to use the services of outsourced legal cashiers without the security of a portal system exposes a law firm to poor communication, delays in service and the potential of data loss.

The threat of sensitive data being intercepted by fraudsters when it is sent using word processing documents and emails is now too great a threat; especially when a data breach could cause irreparable reputational and financial damage.

Why The Cashroom?

At The Cashroom, we have tested our security measures by employing a specialist firm of “ethical hackers” to help review and improve all aspects of our data security. And, of course, we also have robust confidentiality processes in place to ensure that confidential client information is protected as per the SRA code for those in England and Wales, and the Law Society for Scotland.

The Cashroom’s portal system allows both internal and external stakeholders to communicate in the knowledge that all information is secure as access is restricted to authorised personnel.

The fact that all cashiering services, financial information and communication are completed under one secure platform also ensure full GDPR compliance.

Furthermore, The Cashroom’s portal system will also improve communication and efficiency. Completing tasks without a portal system could mean multiple documents and messages being sent and shared in a variety of places without a clear audit trail.

Emails and correspondence could be overlooked, leading to delays in completed services. The Cashroom’s portal has considered this issue. Any request made by either internal or external users is unique to the law firm and has an automated workflow to ensure that all requests are completed promptly and accurately.

In addition to becoming a lot more secure, The Cashroom’s portal eradicates the sporadic and indecipherable communication issue. Tracking emails and communication can become difficult over time. The Cashroom’s portal logs all requests, tracks all communication and collates them to create a clear and precise audit trail, saving firms time and helping to ensure regulatory compliance.

Whether using The Cashroom for SRA compliance tasks or VAT returns, the portal system offers the law firm round the clock access, enabling the firm to monitor progress and remain informed whilst protecting sensitive information from unscrupulous cyber criminals.

Want to have a chat about how we can use portal technology to help your firm?

If you are regulated within the English and Welsh markets, then please contact:
Alex Holt E: alex.holt@thecashroom.co.uk T: 07817 420 466

If you are regulated by the Law Society of Scotland, please contact:
Gregor Angus E: gregor.angus@thecashroom.co.uk T: 07875 598 593

England and Wales new SRA Accounting Rules

As we suspect you are aware, new SRA Accounting Rules will be effective from 25th November 2019. These come with some significant changes to the current rules and with the added responsibility of understanding what the rules mean to you as a firm.

We have prepared guidance notes and pro forma policy documents which can be used or tweaked for your own firm. We believe these will be extremely useful for all of our current clients and indeed non clients as they will enable compliance with these new regulations, and provide advice on the impact they may have on your current procedures.

These documents are available at a one-off charge of £200 plus VAT for all existing clients of The Cashroom, and £300 plus VAT for all non Cashroom clients. For more information please contact chloe.mcginn@thecashroom.co.uk.

GDPR – what does it mean for legal accountancy?

Since the introduction of the General Data Protection Regulations (GDPR) in 2018, we have seen some high-profile companies hit with multi-million pound fines by the Information Legal accountancy Commissioner’s Office (ICO).

Evidence suggests that UK businesses are struggling to fully adapt their policies and protocols to ensure they are compliant. The ICO were inundated with four times more data breaches in the year since GDPR was introduced as UK firms look to embrace their responsibilities and disclose a breach within 72 hours of its discovery.

Whilst many firms may have become compliant with storing and protecting data, policies on satisfying data access requests, were of particular concern. Two thirds (63%) of UK businesses had reported a significant rise in requests by the public for the data a firm holds on them, according to Parseq.

The report also found that 87% of organisations have failed to reply to data access requests within the allotted time limit, resulting in significant delays which will lead to fines, which then have a detrimental impact on a law firm’s accounts. This can be pertinent in the legal sector as solicitors try to balance competing priorities, however as with any job, some priorities can slip.

This is where an outsourced legal accountancy function can help to take the pressure away from solicitors who are juggling many aspects of the business.

Entrusting legal accounts into the hands of a skilled and experienced legal cashier, who can adapt your policies to comply with GDPR, will reduce the threat of possible fines and protect the firm’s valuable reputation.

Why The Cashroom?

But more than that, we have also developed an online portal to help minimise the risk of email fraud. Allowing internal and external stakeholders to communicate and share information in confidence, all exchanges are secure with access restricted to authorised individuals.

We supply you with high calibre, qualified people who are experts in management accounts. This means that we don’t just provide you with all the data and analysis your firm needs, we also take the time to understand your business and what you want to achieve, whilst adding value for money.

Want to have a chat about how outsourcing legal accountancy can help your firm? Speak to one of our advisors today who will point you in the right direction.

If you are regulated within the English and Welsh markets, then please contact:
Alex Holt E: alex.holt@thecashroom.co.uk T: 07817 420 466

If you are regulated by the Law Society of Scotland, please contact:
Gregor Angus E: gregor.angus@thecashroom.co.uk T: 07875 598 593

The Impact of Outsourcing Law Firm Accounting Services to Third Party Experts

When the time comes to consider outsourcing the accounting services of your business, naturally you’ll have some concerns about what this can mean for you, both in the short and long term.

Outsourcing Law Firm Accounting Services After all, change can bring risk, so you need to be confident that the strategy you implement will be worth it. Speaking to third party experts about outsourcing your account services should reassure you that the impact will be beneficial on your business moving forward.

Some law firms worry that outsourcing their accounting services to a third party could have a detrimental impact on the business. But in reality, the truth makes for a much more pleasant read.

Outsourcing doesn’t mean you’ll lose control of your cashiering services, in fact it’s the opposite. Firms are able to gain a greater understanding of what is going on with regards to their management accounts. This in turn brings even more insights as third party experts are able to help the firm identify:

What area(s) of the business generate the most revenue
What area(s) of the business bring in the most money quickly
What area(s) of the business aren’t profitable
Where money is being spent and the return on investment
Area(s) of growth

Outsourcing Law Firm Accounting Services These insights help your business to run efficiently and continue to grow, while some of your competitors lay still in the water.

Outsourcing doesn’t have to be costly and can often save you money and more importantly fee earner time. Companies offering outsourcing accounting services are experts and have streamlined processes to ensure maximum efficiency. Furthermore, they understand best practices which can be passed on as additional savings to you. So, as you can see, the impact of outsourcing a law firm’s accounting services to third party experts has a positive effect on the way the business can grow and thrive.

With the introduction of more stringent Data Protection Laws and the General Data Protection Regulation (GDPR), ensuring data security is paramount these days. Throw into the mix that thousands of criminals are attempting to hack into law firm IT infrastructure, then your concern regarding the impact outsourcing would have would seem justified.

However, third party experts have this area covered too. They have the policies, procedures and technology all in place to ensure that any data they handle is safe and secure, away from the prying eyes of those who wish to exploit it.

Won’t outsourcing make managing cashiers harder? You may think this is the case, but it couldn’t be further from the truth. The right outsourced legal accounts third party will remove that burden.

So, we originally wondered what the impact of outsourcing law firms accounting services to third party experts would have. Hopefully we have shown that it needn’t be doom and gloom. In fact it can have a positive impact on your business, helping it to grow and adapt in a changing legal sector, by enabling solicitors to run their businesses better and to earn fees. The experts will identify areas of focus and working together you can help expand your business whilst working efficiently and effectively.

Here at The Cashroom, our experienced team can be on hand to unburden busy law firms by-

Helping firms to prepare and then monitor performance against annual budgets
Producing cashflow projections
Conducting fee and performance analysis
Providing commentary and advice on monthly performance
Preparing for year-end accounts
And more…

If you are considering outsourcing your law firm accounting and would like some more information about how The Cashroom can help, please get in touch.

If you are regulated within the English and Welsh market then please contact:
Alex Holt E: alex.holt@thecashroom.co.uk t: 07817 420 466

If you are regulated by the Law Society of Scotland, please contact:
Gregor Angus E: gregor.angus@thecashroom.co.uk t: 07875 598 593

The Ultimate Guide to Cyber Risk, Security & Compliance in the Conveyancing Sector

Data breaches and cyberattacks are big news. And, the threat from hacks and fraud have become a stark reality for law firms around the world.

Given the level of trust between solicitors and their clients, it is not surprising that criminals target these relationships for financial benefit. However, offenders are not just looking for financial gain. They are also after the confidential data at the heart of solicitor-client relationships.

Today, law firms are at greater risk than ever before, with around 1,400 criminal organisations actively targeting the legal sector at this very moment[1]. Moreover, conveyancers are a specific focus due to the vast sums of money involved in property transactions.

There has been a 112% rise in legal sector data breaches in just two years.[2]

Despite the risk, conveyancers are ill-prepared for dealing with and preventing cyberattacks. As such, a security-first approach is now urgently required.

Common security threats facing conveyancers

There are catastrophic implications of not defending against data breaches and cybercrime. But, before you can put stringent security processes in place, you have to understand the risks.

Push Payment Fraud

Authorised push payment fraud (APP) fraud occurs when cybercriminals deceive individuals into sending them money. Because the victim believes the fraudulent transaction to be genuine, the client authorises the handover of cash. This is then quickly transferred to different accounts, often abroad, which makes getting it back almost impossible.

£11 million of client money has been stolen due to cybercrime over one year[3]

APP fraud is on the rise. And conveyancers may find themselves liable if they don’t do enough to protect their clients from scammers and are found to be negligent.

Phishing and Spoofing

Phishing sees criminals use emails, texts, websites, phone calls, etc., to pose as a legitimate person or institution. They aim to lure the people in your firm into handing over sensitive data.

90% of data intrusions start with a phishing email[4].

80% of law firms report at least one attack in the past 12 months[5]

With spoofing (or email hijacking) hackers attempt to obtain financial or other confidential information by impersonating your firm. For example, by sending emails or hosting a fake website.

The conveyancing (and wider legal) sector, is at huge risk of financial and reputational losses because of phishing and spoofing. So much so that the SRA is issuing new threat warnings most days.

With fraudulent emails and websites spoofed to a high standard, firms must improve their cyber defences. For example, email security systems can provide robust first-line protection for most attacks.

Property hijackings

security Property hijackings (where criminals pose as owners) are escalating. In many cases, criminals will rent a property and steal the landlord’s post. They then use this to pose as the real owner and sell the house to cash buyers.

In one particularly high-profile case, property development company Dreamvar purchased a London property for £1.1 million from a seemingly legitimate seller. It was only after the firm began refurbishment work that the scam came to light.

Initially, despite the buyer’s solicitor acting honestly and innocently, it was still found 100% liable for compensation. However, following a long-awaited appeal[6], the court ruled that both sets of solicitors must ensure that a property transaction is genuine or face the consequences. This decision should put conveyancers on both sides of property transactions on high alert.

Money laundering

The National Crime Agency (NCA) believes that the extent of money laundering impacting the UK could be costing hundreds of billions of pounds each year. Moreover, conveyancing firms are a significant target for money launderers. And, when you consider the amount of money that can change hands in just one transaction, it’s easy to see why.

According to NCA figures, residential property transactions made up 32% of all suspected money-laundering activity in the last three years. What’s more, the SRA revealed that there was a 43% increase in money laundering reports in the opening nine months of 2018[7].

Solicitors can incur hefty fines and even go to prison if they don’t report suspicious activity. So, conveyancing firms must do more to protect against this threat.

Malware & ransomware

security Malware attacks – where malicious software is installed on a user’s machine – can be extremely damaging; to your day-to-day operations, your reputation, and your bottom line. Ransomware attacks – an aggressive form of malware which prevents access to systems unless a payment is made – can be even worse.

More than 55% of British law firms suffered at least one cyber-attack in the past 12 months[8]

For conveyancers, being locked out of your IT systems, even for a short time, could make it impossible to meet essential client deadlines. For example, completing a property transaction. And the implications of this could be catastrophic.

Password spraying

Password spraying happens when hackers use common passwords to try to access a large number of accounts (e.g. password123). If one password doesn’t work, they wait long enough so that the account is not locked down before trying a different one.

Once a hacker has gained access to one email account, they use their skills to work through the rest of a firm’s systems. So, having one person using a weak password could put your entire firm at risk.

75% of organisations have accounts with passwords that feature in the top 1,000 passwords, and 87% have accounts with passwords that feature in the top 10,000[9].

Denial of Service (DDoS) attacks

Distributed Denial of Service (DDoS) attack happen when an email or website server becomes overwhelmed. Once besieged, hackers can exploit the weakness of the system to access other content on that server. Cybercriminals might carry out a DDoS attack by sending millions of emails to a single email address in an attempt to collapse a server.

DDoS attacks have been around for years. In 2014, ACSe:Law was forced offline by hacker group 4chan. While the firm’s website was restored, an error led to an archive of internal emails and financial information to be published on the home page. As you can imagine, this caused the firm serious reputational damage.

DDoS attacks have increased considerably over the years. And, as more and more connected devices come online, the risk becomes even greater.

It is estimated that 33% of all downtime is related to DDoS attacks[10].

Human threats

Insider threats happen when malicious users (e.g. disgruntled employees), get their hands on confidential and commercially sensitive data. But, when it comes to human risk factors, it is simple mistakes that are the biggest threat to your conveyancing firm. This is because conveyancers often fail to undertake adequate checks, or don’t know, or don’t follow, the necessary security processes.

Common security issues caused by human error include:

Not undertaking the necessary client checks
Not following established processes (e.g. how to take payments from clients)
Losing mobile devices or leaving them open when working remotely
Sending emails or post containing sensitive data to the wrong person
Not using the BCC function when sending emails to a mailing list
Installing unauthorised software onto work devices
Clicking on dangerous links, downloading viruses or falling victim to phishing scams.

Law firms are still not taking cybersecurity seriously

If your firm is the victim of a cyberattack or data breach, and your security processes are found lacking, you could be liable for a hefty fine.

In July 2019, The Information Commissioner’s Office (ICO) announced plans to fine Marriott International £99.2 million following a data hack. It also plans to fine British Airways £183 million for security failures exploited by cyber-attackers. These fines don’t include any victim compensation payments.

Payment from the compensation fund relation to conveyancing fraud is up from £700k in 2015/2016 to a staggering £3.7m in 2017/2018.[11]

While professional indemnity insurance might cover any losses you incur as a result of a cyber-attack, it is unlikely to include regulatory fines due to negligent security processes. It is also unlikely to cover the potentially significant reputational damage.

How to combat data breaches and cybercrime

Put robust processes in place

Only 55% of law firms have documented policies and procedures for cybersecurity[12]

When it comes to protection from cyber risk, preparation should always be your first line of defence. While not a full and final list, this should include:

Establishing compliant policies and processes

Create (and regularly review) your data protection and financial security policies and processes to ensure compliance with the latest regulations and industry guidance.

You should also have a cyber incident response plan ready. Also, print out a hard copy of this, including necessary reference numbers and phone numbers. If you get shut out of your systems, you may not be able to access this.

Putting the basics in place

Put stringent security controls in place (and make sure that you document these). For example:

Preventing staff from sharing passwords and ensuring suitably complex passwords
Making sure passwords are changed if a firm suspects a system has been compromised
Making sure devices are encrypted and require a password when switched on
Establishing steps to remove outdated info
Using encryption and two-factor authentication.

All your printers, copiers, even iKettles linked to your network need the same rigour of security and password regimes as the rest of your tech equipment. Without this, they could provide a route into your system.

Regular testing and monitoring

Set up regular penetration testing (ethical hacking) to test your systems and proactively identify any vulnerabilities that an attacker could exploit. Penetration testing can be performed manually or done automatically via security software. Also, increase monitoring across websites and apps to defend against attacks.

Keeping everything updated

In addition to ongoing maintenance, make sure that updates and patches are carried out. This should cover things like browsers, servers, operating systems, antivirus software, malware protection and firewalls.

Managing third-party relationships

Cyber-attacks are often possible due to third-party weaknesses. As such, security controls must be a crucial part of any vendor agreement. Also, analyse any data integrations for vulnerabilities.

What’s more, if you’re merging with another firm, check their cyber risk levels. If they have malware on their system, it will infect your firm when you consolidate.

Investing in security accreditation

Information security certification (e.g. ISO 27001 or Cyber Essentials) helps to protect client and employee data. This won’t just keep sensitive data secure, it will also demonstrate to clients (and the ICO) that you take your responsibilities seriously.

Meeting the requirements of the GDPR

Establish a lawful basis for data processing Personably Identifiable Information (and document this). Also, develop GDPR-friendly policies and templates such as Terms & Conditions and Privacy Notices.

Should a data security incident occur, under the GDPR, you must report this to the ICO without undue delay. So, establish compliant processes for responding to data breaches and other security threats.

Protect against human error

All too often, mistakes happen because people do not understand their data protection responsibilities.

“Challenges such as keeping information safe, cybercrime and compliance with anti-money-laundering regulations need constant attention. The threats of criminals using IT to steal client’s funds is an increasing problem. It is important that law firms develop a culture where cyber security is treated as a serious priority, and take sensible steps to warn their clients about the risks”.

SRA Chief Executive, Paul Philip

Security awareness training

Law firms are failing to train staff on data security, leaving the door open to avoidable data breaches and cybercrime. To combat this, conveyancing firms must establish an acceptable use policy (AUP) that spells out the rules of using digital technology.

In addition, training is vital to ensure everyone understands the policy, the risks, and the potential consequences of breaching data protection laws.

Client and financial checks

Law firms have more stringent security requirements than most other professions. As such, safety measures and checks are vital.

Law Society’s Conveyancing Quality Scheme (CQS)

Changes to the Law Society’s Conveyancing Quality Scheme (CQS) came into effect on 1st May 2019. These changes included a strengthening of requirements to mitigate the risk of property and mortgage fraud, money laundering and terrorist financing. Crucially, the new Core Practice Management Standards (CPMS) reinforced solicitor obligations towards client identity checks and checks against the conveyancer acting for the other party.

Find out more about these changes here.

Dreamvar v Mishcon de Reya

Following Dreamvar v Mishcon de Reya, both sets of solicitors are now obligated to ensure that a property transaction is genuine or face the consequences. According to the Law Society[13], the steps that must be followed are:

Reviewing your policy for risk assessing transactions, identifying the facts that make a matter high risk and making efforts to ensure that you have procedures in place to deal with those risks
Reviewing or establishing policies about when you might ask seller’s solicitors or conveyancers questions, for example, about whether they have carried out their AML investigations. Considering raising questions where there are indicators of potential fraud of the type highlighted in the HM Land Registry/Law Society joint note on Property and Title Fraud (if you raise questions but fail to pursue the responses properly, you may be exposed to additional risk)
Reviewing or establishing policies in relation to how you will answer questions from the buyer’s solicitors when acting for a seller
Reviewing or developing policies to establish when you should decline to act if you are not confident that the ‘seller’ is the registered proprietor.

Conveyancers must also be aware of, and put into practice, the following information:

Law Commission Proposals

Conveyancers could be held liable for fraud under new proposals from the Law Commission to reform the Land Registration Act. These proposals would place a new statutory duty to check the identity of clients. Where conveyancers fail to take reasonable care, they could be forced to make indemnity payments to the Land Registry.

Find out about the red-flag indicators that mean a transaction may be suspicious here.

Use technology to combat cybercrime

Training staff to recognise common scams and risks is vital. However, as cybercriminals become increasingly savvy, education alone isn’t enough.

“No training package (of any type) can teach users to spot every phish. Spotting phishing emails is hard. Spotting spear phishing emails is even harder. Even our experts struggle. The advice given in many training packages is based on spotting standard signs like checking for poor spelling and grammar, and while these can be a good place to start, they can’t be used to spot all phishing emails. Bad guys can spell (and some nice genuine people can’t).”

Sociotechnical Security Researcher, NCSC

It’s essential that you bolster your defences. Not least because, when it comes to digital threats, it’s better if these are stopped in their tracks as soon as possible, without relying on human involvement.

In addition to things like encryption, antivirus software and two-factor authentication (which all firms should use as standard), there are some ingenious ways technology can help conveyancing firms improve their security.

Online portals

As phishing attacks and technological vulnerabilities are costing law firms millions each year, emails are coming under intense scrutiny.

Could online portals like The Cashroom’s provide the answer?

In a word, yes. With a portal, all exchanges are safeguarded, with access restricted to authorised members of the firm carrying the relevant security information.

Indeed, firms not using a secure portal service could pose severe security and GDPR risks. For example, financial and personal information sent through word processing documents and email could be intercepted and used by unscrupulous cybercriminals.

OnDMARC

Many conveyancing firms have invested in standard IT security solutions. But these won’t protect them against phishing and spoofing attacks.

DMARC technology combats email fraud by actively blocking phishing attacks and preventing rogue third parties from impersonating an email domain. For example, Lawyer Checker – which provides technology and products to help protect lawyers and consumers – has service designed specifically for the legal profession. By using OnDMARC, conveyancing firms currently vulnerable to email fraud can protect themselves from reputational or financial damage.

Blockchain technology

Blockchain is a digital ledger of every transaction ever made using cryptocurrency. These transactions are recorded forever, and duplicated thousands of times across a network of computers (so they can’t be tampered with).

Crucially, blockchain technology can be used to monitor more than just financial transactions. And, because it is impossible to corrupt, it could play a key role when it comes to preventing fraud and embezzlement.

Outsourcing reduces the security and compliance risk

Outsourced cashiering and management accounts

Your firm is professionally obliged to keep an accurate set of books, and a failure to dedicate the time necessary to accounts-related work increases the chance of human error. Especially when you don’t have access to certified experts. But, should an error occur, the impact on your bottom line and your reputation could be devastating.

The good news is that, when you use outsourced services, the risk disappears.

An outsourced legal cashier will keep your accounts in order. And prepare tax and VAT returns to ensure you meet all regulatory requirement deadlines. They will also enable compliance with the Solicitors Accounts Rules and Money Laundering Regulations. Crucially, an outsourced cashier will also ensure that there’s a clear audit trail as required by your accountant or inspector.

Also, if you have one cashier looking after payments, a fraudster need only get their hands on one set of bank login details. Even if you have multiple cashiers, they will all likely to be on the same network, so it’s easy for hackers to get all the information and access rights they need.

But an outsourced partner will have invested heavily in security measures (e.g. encryption, anti-intrusion systems, back-up procedures, etc.) It is almost impossible for conveyancing firms to ensure the same level of protection.

An outsourced legal cashier and management accounts partner should also offer:

Robust confidentiality processes to ensure that confidential client information will be protected as per the SRA code
A secure online portal to protect those all-important communications
Cyber Essentials Plus certification
A robust GDPR policy
Regular staff training on cyber risk.

At The Cashroom, we provide all this and more. Ultimately, when you outsource to us, you get the peace of mind that comes with knowing the processes and people looking after your firm operate securely.

Outsourced risk and compliance

The burden of risk and compliance has become increasingly complex. Today, a proactive approach is essential to mitigate the risk of a regulatory issue or destructive reputational incident.

But rather than lying awake at night, many conveyancing firms are opting to outsource this aspect of their business. And, in doing so, are gaining access to appropriate experts with all the skills and expertise they need.

Often, outsourcing means taking someone on to help with more specialist work, while in-house compliance teams get on with day-to-day work. For smaller firms that don’t have the budget to employ full-time in-house risk and compliance professionals, the ability to pass everything over to a trusted partner is especially valuable.

Outsourced security technology

The progression of technology has enabled criminals to become even savvier. So, fighting fire with fire is essential when it comes to reducing the cyber-risk in today’s digital age.

This includes using:

Technology that filters out viruses before they hit your inboxes
Business-class antivirus/malware that offers active protection against attacks
Regular and automatic back-ups
Online database checks to highlight any red flags
A digital bank account checker that validates the source or destination of funds
DMARC technology that actively blocks phishing attacks and prevents third parties impersonating your email domain to any recipient such as clients, suppliers or employees.

Conclusion

Digital information and client funds must be safeguarded to protect firms, conveyancers, and clients. And this requires a combination of education, technology and robust processes. What’s more, cyber risk, security and compliance are not one-time activities. The challenges are evolving and require constant vigilance.

Where a failure in security occurs, solicitors could be liable for losing client funds, be forced to pay the money back to lenders, be subjected to raised insurance premiums, and face severe and long-lasting brand damage.

Outsourcing not only reduces the pressure upon conveyancers – who already have to be vigilant when undertaking daily tasks – it also frees up fee earner time. And, just as important, it leaves due diligence to specialists who can keep up with the rapidly evolving issues of a digital world.

[1] HM Government

[2] Xyone Cybersecurity roundtable

[3] Xyone Cybersecurity roundtable

[4] Xyone Cybersecurity roundtable

[5] Hiscox Cyber Readiness’ Report

[6] Dreamvar v Mishcon de Reya

[7] Upholding Professional Standards 2017/18 report

[8] ‘Hiscox Cyber Readiness’ Report

[9] The National Cyber Security Centre (NCSC)

[10] Verisign/Merril

[11] https://www.sra.org.uk/sra/how-we-work/reports/annual-review/annual-review-2017-18.page

[12] https://www.logicforce.com/2018/11/02/cyber-security-scorecard-q4-2018/

[13] https://www.lawsociety.org.uk/support-services/advice/articles/dreamvar-informative-and-case-summary/

The Ultimate Guide To Outsourced Legal Cashiering

An increasingly strict regulatory regime has changed the legal sector forever. At the same time, the financial pressure on many firms has grown substantially as challenger firms and online providers have made their presence known.

What’s more, with many law firms registering as Alternative Business Structures (ABSs), there has been a rise in non-lawyer experts taking on management roles. And these non-lawyers are applying tried and tested business techniques to improve standards, deliver consistency and reduce costs. In response, more and more traditional firms are having to adopt a similar business-like management approach to keep up.

But it’s not just about surviving. By modernising the way they operate, law firms can also thrive in today’s challenging legal landscape.

One way that savvy firms are choosing to innovate and respond to change is by outsourcing essential business tasks. In particular, legal cashiering is one back-office function that has become increasingly popular to offload.

“Outsourcing to The Cashroom has been painless. So easy to deal with accommodating everything that we need to do, when we need to do it, whilst keeping us on the right side of the vast array of regulations.

We have complete trust in them to ensure our compliance, and have a Law Society Inspection Report which proves what a great job they are doing for us.

We will never have a cashier in our office again.”

Kate Anderson, Director at Masson Cairns

Why outsource your law firm’s cashiering?

Rather than wasting time on routine, non-legal tasks, many law firms have chosen to contract things out, while they focus on the more lucrative aspects of winning new business and keeping clients happy. And, with lawyers increasingly expected to do more with less, the appeal of outsourcing is only getting stronger.

Here are just some of the ways that outsourcing your legal cashiering can help your law firm.

Reduce the cost and burden of managing employees

Legal accounting is a complex administrative task, so it’s vital that your firm has access to experienced staff. This is especially important in such a highly regulated industry. But, with a shortage of quality legal cashiers, finding qualified bookkeepers can be tricky. And, interviewing and assessing candidates’ integrity and skills is not straightforward for a law firm.

At the same time, the total cost of employing in-house cashiering personnel is expensive. Because, in addition to wages, you also have to take the costs of recruitment, induction, training, mentoring, sick pay, maternity cover, holiday cover, pension contributions, and National Insurance into consideration.

Also, law firms face the challenge of having to fund sufficient senior cashiering resource to deal with complex, high risk elements, while using that same resource to carry out the more mundane, junior tasks. And that’s not cost-effective.

Employing a full-time legal cashier may not even be financially viable for smaller firms. And, if you are one of the 523 new law firms planning to open in the next year^[1], you will need affordable, quality cashiering support to challenge the larger players.

Using an experienced outsourcing supplier lets your law firm tap into recognised, certified expertise, without the burden and cost of employing and managing your own staff; making it a much more affordable option. In addition, a resourcing approach provides you with 9-5 support and real time cashiering, but at a cost based on the actual activity and skill level your firm requires.

Respond quickly to a changing marketplace

Today’s legal market is in a state of flux. Because outsourced services are scalable, your firm can adapt quickly to rising or slowing demand for services, without the worry about hiring or laying off staff. And you only ever pay for what you use.

So, by partnering with a trusted outsourcing expert, smaller law firms benefit from a more agile approach. As such, embracing an outsourcing ethos could help you to adapt and thrive. And secure your long-term survival.

“The Cashroom offer an invaluable service for any solicitor’s firm. Their approach is efficient, professional and responsive. They have allowed us to deal with rapid growth by taking on all accounts functionality.”

Alexis Brassey, Managing Partner and Notary Public at Cavendish Legal Group

Save valuable office space and costs

We have already looked at how outsourced legal cashiering can help your law firm to cut down on employment costs. But the savings don’t stop there.

With outsourced cashiering, you will also save on infrastructure and associated office costs (e.g. energy, floor space, hardware, software, etc.). Indeed, when you consider the total cost, you can save thousands of pounds year-on-year by outsourcing.

Reduce the compliance burden

Compliance is now a pressing concern for most businesses. Not least because the rules and regulations are continually changing. But for law firms, the need for demonstrable security and integrity is vital.

For example, when it comes to legal cashiering, your firm is professionally obliged to keep an accurate set of books. But for lawyers, preparing accounts can be stressful and worrying, especially when they don’t have access to certified experts. However, not taking the time to dedicate the focus necessary to accounts-related work is not an option. Because unintentional accounting errors can prove costly, and, if a mistake happens, the risk to your reputation and your bottom line could be devastating.

However, if you employ an outsourced legal cashier, they won’t just keep your accounts in order. They will also enable compliance with the Solicitors Accounts Rules and Money Laundering Regulations. And, crucially, an outsourced cashier will also ensure that there’s a clear audit trail as required by your accountant or inspector.

With the Solicitors Regulation Authority (SRA) accounts rules set to undergo their first major overhaul in years this November, with significant changes that all firms will need to prepare for, firms should look to get their cashiering processes in order now to stay ahead of the game.

“The Cashroom has definitely been a good business move, not only because of efficiency but also in relation to compliance which can be daunting at times.”

Susan Ayre, Partner at Simon A Holt & Co

Plan for business as usual

Law firms that don’t want to suffer any downtime due to unexpected events have to be prepared. For example, how would you cope if unforeseen and long-term absenteeism hit your business?

By offering support that never stops or takes a break, with outsourced legal cashiering you are free from the burden of sick days, jury duty and family emergencies. So, as well as saving you money, it can also boost your productivity.

Also, as alarmist as it might sound, extreme weather conditions are on the rise. And, with global warming set to lead to more and more changing weather patterns, you have to think about how you can continue to operate if you can’t access the office. Outsourcing business services such as legal cashiering can help to support your disaster recovery planning. With remote support available when you need it.

Free your solicitors up, to get on with what they do best

Law firms depend upon a steady cash flow to survive, so keeping on top of your bookkeeping is essential.

But, for many practices, this can be both challenging and time-consuming. Correcting errors is a costly waste of your valuable time; especially where many other responsibilities need looking after. For example, if you don’t nurture and grow your client base, your business will suffer, you’ll spend less time earning fees, and the less profitable you’ll be.

With time one thing none of us has in excess, it pays to acknowledge that you can’t be an expert in all areas of your business. Instead, you should focus on your strengths.

Removing the hassle from your shoulders, expert outsourced legal cashiering will take care of everything for you. Leaving you free to spend more time with clients and other tasks that make your firm money.

By outsourcing your legal cashiering you’ll also have peace of mind that you are working with people who have experience in dealing with day-to-day bookkeeping, as well as the escalation of matters where necessary.

“We operate a business which requires efficiency and certainty of service. The Cashroom has augmented our own internal accounts team, taking control of key elements and working closely to provide a seamless service to us.

We have found them to be extremely professional and helpful, at a cost which has achieved significant savings as against an in-house approach.”

Andrew Kwan, Solicitor-Advocate at Clear Law Solicitors

Help your law firm to grow

An outsourced cashier will ensure an up-to-date log of case-related fees and expenses for regular claim back purposes – resulting in a healthier cash flow. And that’s crucial to business growth. But more than this, with the right support, you will also get access to better forecasting data. So, using an outsourced cashier can provide valuable business insights that can be used to identify trends and inform your overall business strategy.

For example, forecasting data can be used to assess the profitability of certain matters, to intelligently determine opportunities for growth, and to identify legal service areas that are becoming problematic.

What type of firm needs outsourced legal cashiering?

We help many types of law firms with their outsourced legal cashiering needs. Including:

Sole practitioners up to mid-sized firms.
Firms where the cashier has retired (as it can be difficult to recruit cashiers)
Firms where the cashier is going on maternity leave
Firms that are restructuring and dealing with TUPE options
Firms that need help to improve following a Law Society Inspection
Firms where the lawyers have been trying to do it themselves and have no real knowledge of compliance
Forward thinking firms with a desire to do things differently.

The challenges of outsourced legal cashiering (and how to overcome these)

When it comes to introducing outsourced legal cashiering into your law firm, the benefits are clear. But what are the challenges you will face?

Data security

Law firms are a particular target for cyber criminals, not least because of the huge sums of money transacted each day. But criminals are not just looking for financial gains; they are also after the confidential data which is at the crux of the solicitor-client relationship.

When it comes to protecting client money, it’s only natural that you’d be worried about putting your valuable data and finances in the hands of a third-party. But, in most cases, an outsourced partner will have invested heavily in security measures such as encryption, firewalls, password protection, physical data centre anti-intrusion systems, software updates and back-up procedures. They should also have a robust confidentiality process in place to ensure confidential client information is protected as per the SRA code. It can be hard for smaller law firms to provide the same level of protection.

Let’s face it, if you have one single cashier who sets up and authorises payments, a fraudster need only obtain a single set of bank login details. Even if you have multiple cashiers to check payment details, they are all likely to be on one single network, so it’s easy for a hacker to get all the information and access rights they need.

Modern law firms are like mini banks, but without the resources required to protect the money they hold securely. That is precisely where the added value of outsourced provider comes in to play.

The burden of managing a third-party supplier

Some law firms are concerned that managing a third-party could be just as complicated as looking after in-house staff. But this shouldn’t be the case.

Yes, it’s true that, if your requirements are complicated, you may rely on multiple outsourcing partners. And this can become tricky, not least because, in an age of interconnected systems, getting a supplier to take responsibility if something goes wrong can be a challenge. But the right outsourced legal cashier will be used to a multi-party model and will do everything possible to streamline and simplify things for you.

Of course, there are also benefits of simplifying supplier management. For example, using one partner for multiple tasks such as cashiering and management accounts.

Fear of change

Change is both risky and exciting. But it can also foster self-doubt. Will all your effort be worth it?

As we established earlier in this guide, the law is not just a profession; it is also a business. So it’s vital to keep moving forward. And, with a wealth of benefits to be had, not taking the leap could mean that your competitors get ahead while you stagnate.

Cost

When investing in outsourcing, price is always going to be a concern. So, when making your business case, it’s crucial to understand the total cost of ownership (TCO).

What’s more, price doesn’t always mean value. In many cases, spending money and saving yourself time is more cost-effective.

Being stuck with the provider

When looking to outsource, one of the biggest concerns faced by law firms is that they will be stuck with the service provider in some unholy death grip.

Many outsourcers combat this fear with exit clauses in their contracts. However, even with an agreement which allows for termination, you could face difficulties replacing the service, either by taking it back in-house or by finding another, better outsourcer.

There is also a concern about ‘professional behaviour’ on separation. With numerous horror stories where the outsourcer makes life extremely difficult – either by ‘working to rule’ or by being generally obstructive as the service is taken off them.

To ensure this doesn’t happen to you, due diligence is needed before signing any agreement. This should include obtaining a reference from a firm which no longer uses the service and putting a plan in place for end of contract.

Integration with other processes

The last thing you want to do when appointing an outsourced legal cashier is to have to switch all your existing systems. But modern partners should be able to work with your current setup.

To make this work they will look at things such as:

How your systems are hosted and how they access them (e.g. server-based or cloud)
How the system works (e.g. how are documents stored and how will financial information requests be forwarded)
Who will manage the process your end (e.g. will there be a specific contact, or will they liaise directly with fee-earners).

The Cashroom has a totally system agnostic approach. This means that firms need not change their systems before benefiting from the service.

Things to consider before you appoint an outsourced legal cashier

Outsourcing your legal cashiering will have many rewards. But as with any investment, there are some things to consider before making the leap.

What questions should you ask your preferred provider?

Who will manage your account?

For example, will it be a dedicated individual, and, if so, who will cover for sickness or absences?

You should also make sure that you will be supported by specialist legal cashiers. It is vital that any partner you appoint doesn’t just have a firm grasp of accounts, but also possesses an ILFM qualification and has an in-depth understanding of the SRA Handbook, SRA Accounts Rules, and other relevant guidelines.

Can you get a reference from other customers?

A few positive words from a happy customer can put your mind at rest and give you confidence in your decision. As such, ask the outsourced legal cashier for references.

What are the terms of your agreement?

It’s vital that you understand the terms of any contract and Service Level Agreement (SLA) you are entering. Things to look out for include:

Data protection processes and guarantees
If they have an established business continuity and disaster recovery plan
How they would handle a security incident and rectify any data or financial losses
Whether they hold professional indemnity insurance
Who owns your data
What happens if you want to end the contract
If they will support you during a compliance visit.

Do they offer an online portal?

In an age of intense regulatory compliance, demanding client needs and increasing levels of cyber crime, it is imperative that any online portal is able to protect client information, improve the customer journey and provide increased efficiency.

Remain Cyber Secure and GDPR Compliant

Traditional forms of online communication, like emails, are coming under intense scrutiny as phishing attacks and technological vulnerabilities are costing law firms millions each year.

An effective portal can minimise this risk as both internal and external stakeholders are able to communicate and share information through the secure portal. All communication exchanges are secure with access restricted to authorised members of the firm carrying the relevant security information.

Using an outsourced legal cashier without such a secure portal service poses serious security and GDPR risks. Financial and personal information sent to the legal cashier through word processing documents and email could be intercepted and used by unscrupulous cyber criminals causing financial and reputational damage to your firm.

Improving Efficiency

Working outside of a portal creates a myriad of opportunities for communication to be lost or seriously delayed. It is extremely easy to mislay or overlook an email. Busy practitioners working on legal services are bombarded with email requests meaning the legal cashiers could be delayed. Similarly, sending a request to the outsourced cashier means that your firm’s request is buried within the work of their other clients. This could delay important transactions and reduce efficiency.

A portal can solve this. Each request that is made both internally and externally is unique to the business. Here at The Cashroom, all tasks also have an automated workflow, ensuring that deadlines are adhered to and communication is clear for all concerned.

Portal functions also enable the legal cashier to eliminate internal and external email. All requests are clearly tracked and progress is monitored via the technology. This means that each task has a clear and easily accessed audit trail; something that becomes extremely time consuming when using emails alone.

How quickly can you get up and running?

As with any investment, it’s essential to get up and running quickly. Ask your outsourcer how long this will take, whether there will be any downtime or disruption, and if there is a migration plan to ensure a smooth transition.

Do they offer any other outsourced services?

As previously discussed, it’s not unusual for law firms to be put off by the idea of managing multiple third-party suppliers. To keep things streamlined, find out if they offer any other outsourced services to help you consolidate your supplier management. Could they be a ‘one-stop-shop’.

Why work with The Cashroom?

Pioneers in the evolving legal landscape, at The Cashroom, we supply you with high calibre, qualified and experienced legal cashiers – at a fraction of the cost of employing your own staff. We also help you to unlock a huge range of additional outsourcing benefits.

For example, when you work with us, we will:

Save you money
Offer a fixed monthly fee, so you stay in control of your cash flow
Work with your existing practice management system (or provide recommendations where wanted)
Remove the burden while making sure you stay in control
Help to keep you compliant with industry rules and wider regulations
Facilitate and support your business growth
And more!

More than outsourced cashiering, we also offer management accounts and payroll support to law firms across the UK.

With trained lawyers on our team, and board members who were previously managing partners of their own firms (along with a chartered accountant), we also understand what it takes to run a successful legal business. And we share all this knowledge and expertise with you.

But we don’t expect you to take our word for it. As well as having won multiple industry awards, we are also happy to supply references of current and former customers to give you all the peace of mind you need.

“We have been using The Cashroom’s services for three years now. We brought them in to provide a secure, efficient, compliant cashiering function to support our growing business with their flexible resource model.

They have delivered exceptional service with a real personal touch, saving us money but delivering a quality finance function which suits our forward thinking approach to the provision of legal services to our clients. Their processes work especially well for our very busy conveyancing team.”

Gareth Jones, Practice Manager at Easthams Solicitors Limited

What type of tasks can we help you with?

The Cashroom provides all the legal cashier services typically provided to a firm of solicitors; the difference is we employ “your” cashiers, and they work remotely from our offices. Among many other things, we:

Maintain up-to-date books and records
Process all day to day transactions
Make bank payments
Reconcile firm and client bank accounts daily
Pay suppliers
Perform day and month end routines
Prepare and submit VAT returns
Assist with VAT inspections
Prepare Law Society Certificates and assist with inspections (Scotland only)
Provide information for Accountants’ Reports
Ensure full compliance with Law Society Accounting Rules /SRA.

In conclusion

Today, outsourced legal cashiering is not only helping law firms to make significant cost and time savings, but it is also leading to improvements in productivity and growth. Crucially, outsourced legal cashiering is helping to relieve the massive compliance worry. But when it comes down to it, the most significant benefit of outsourced legal cashiering is that it frees up lawyers to focus on client work.

To find out more about how outsourced legal cashiering can help your firm to flourish, contact Alex Holt alex.holt@thecashroom.co.uk or take a look at our services page on our website.

^[1] Hazlewoods, Chartered Accountants and Business Advisers

The Growing Impact Of Cyber Crime In The UK

Cyber crime is a significant threat to the legal sector and is on the increase. Unless we develop a culture to up our cyber knowledge, it’ll be a threat that’ll only continue to grow.

In the Cyber Security Breaches Survey 2019, conducted by the Department for Digital, Culture, Media and Sports (DCMS), 32% of UK businesses had reported a cyber security breach in the last 12 months. Over a third admitting this breach led to a loss of data or assets.

Poor cyber hygiene is to blame, of which staff training is a contributing factor. It seems silly that something that could cause such catastrophic damage both reputationally and financially, has so little resource attributed to it.

Cyber criminals use sophisticated social engineering techniques to conduct their cyber crime; however, these do have red flags which people can be trained to spot. Some of which have been highlighted by the Solicitors Regulation Authority’s (SRA) scam alerts.

The SRA issued 217 alerts in 2018, informing people about criminals replicating reputable and genuine law firm websites and spoofing emails in a bid to steal client/firm money. The DCMS report found that 80% of UK businesses had experienced sustained phishing attacks last year.

In the past 3 months, Linklaters have reported several attempts on their domain name. Each time, a subtle change was made to look like the original e.g. @linklaters.co or @linkiakers.com. Impersonation fraud, the act of using fake domain websites and email addresses extremely close to the originals, cost the UK £92.7milion in 2018.

‘Fraud the Facts 2019’ report highlighted that email (malicious redirection) fraud has become a lucrative business. Fraudsters use emails to convince a home seller or law firm to change their bank details before a payment is made resulting in £123million lost in 2018.

According to the Financial Commissioner’s Office, the UK has amassed a total of 10,600 notified breaches since 24th May 2018. This equates to over 1,000 notified breaches per month and over 42 per day.

When breaches are so frequent and attempted attacks are even more persistent, how can law firms ensure they are able to defend themselves?

Lexcel and CQS urge members to adopt Cyber Essentials, a Government backed accreditation which encourages business owners to consider the ways they protect their businesses from cyber crime. It adds extra kudos if you’re dealing with a firm that has cyber essentials as you can be confident, they’re doing all they can to combat the cyber criminals.

Changes to the SRA standards and regulations come into force on 25^th November, look at expanding the role of the Compliance Officer for Legal Practice (COLP) focusing on staff training and breaches, covering the base of employees receiving regular training and as a result increased accountability in the future.

Similarly, firms should have protocols, procedures and responses securely in place, so staff are aware of the next steps if and when a serious breach occurs. Ensuring that your law firm is cyber aware is not only a definitive way of protecting the firm’s reputation and data, it is also a regulatory imperative.

As the threat of email impersonation and spoofing increases, using email encryption to ensure the message you send is received by the intended recipient, or DMARC email services that ensure the law firm’s domain is spoof proof can also offer increased protections.

The Cashroom Ltd

Cyber Risk – scary and real

I was a huge Doctor Who fan as a child. I’m ancient, so my favourite doctors were Jon Pertwee and Tom Baker. I loved the monsters most of all though. There were so many great villains, and while I thought the daleks were OK, they never really felt scary. Giant pepper pots who would struggle to deal with uneven terrain or stairs.

The ones that really used to freak me out and have me cowering behind the sofa were the Cybermen. They were dead eyed, relentless, ruthless and had seemingly infinite resources.

By this point you will be sighing and rolling your eyes at another of Holt’s shoehorning in of cultural references, and to be honest you’re right.

It’s just that we are back in the throes of terrifying cyber threat.

Three or four years ago, any conference you went to featured doom and gloom and scary stories about cyber threat. It became almost an industry joke- the method used by purveyors of solutions for all your cyber risks. The numbers quoted were horrifying- often hypothetical and often using statistics from other sectors, as information specific to legal was scarce.

But we listened, and took steps. At The Cashroom we realised the use of email made us vulnerable so we invested in the development of our secure client communication portal. We, and others, sought certificated reassurance- we are Cyber Essentials Plus accredited. We, and others, implemented detailed training programmes to ensure our people were empowered and vigilant, and working to sensible secure processes. cyber threat

And for a couple of years, the tone of the messaging around cyber threat calmed a little. Of course there were high profile examples of issues, which kept the threat visible, but the hysteria of the messaging at conferences and in articles cooled off.

However, anyone who thought that the threat had receded is in for a shock. Because the pause in threat level was illusory….it was more a gathering of data, and now the statistics are there to show exactly the seriousness of the cyber threat faced by the legal sector.

I took part in a round table discussion, hosted by our friends at Xyone Cybersecurity, and attended by representatives from the police, insurance, tech and legal sectors. A fascinating discussion took place over coffee and bacon butties, but some of the statistics put us off our breakfast.

59% of UK and US companies suffered data breach caused by a third party.
Two thirds of SMEs who suffer a breach will not survive.
90% of data intrusions start with a phishing email.
Nearly 0.5% of all emails sent globally were phishing emails.

And some stats were specific to the Legal Sector

112% Rise in Legal Sector Data Breaches in 2 years
£11 Million of client money stolen due to cybercrime over 1 year
60% of law firms reported to have suffered information security incidents last year

There were some great tips, some of which were pretty obvious, but some (iKettle risk!) were a surprise-

All your printers, copiers, even iKettles which are linked to your network need the same rigour of security and password regimes as the rest of your tech equipment or else they can be used as a route into your network.
All your suppliers may provide a route into your systems if they don’t have rigorous procedures and protections in place. Carry out DD on them to check this out.
If you’re merging with another firm, check their cyber risk levels. If they have malware already on their system it’ll infect your firm when you merge.
Have a hard copy of your Cyber Incident Response plan, including necessary reference numbers and phone numbers- if you get shut out of your system, you may not be able to access that info!

So the analogy with the Cybermen isn’t too tenuous- they have huge resources. They are relentless and ruthless. They are…scary. It’s time to come out from behind the sofa and face the threat, because it’s real and the mattel plastic replica of a sonic screwdriver just won’t cut it, I’m afraid.

Alex Holt,

Director of Business Development, The Cashroom

How outsourcing your Legal Cashiering can save time and money

The Legal Institute of Forward Thinking says; “Law firms don’t fail for lack of profits; they fail for sufficient cash to operate.” Change is inevitable in the business world, but how you adapt to this change makes the difference between whether you sink or swim. One way that savvy firms are choosing to adapt is by outsourcing essential business tasks, like legal cashiering.

An outsourced legal cashier provides a variety of functions, including but not limited to: processing the day to day transactions, set up bank payments, assist with VAT inspections as well as preparing and submitting VAT returns. The list is endless.

Having the right person delivering your legal cashiering service is vitally important. If you were looking at having an in-house cashier, you’d have to take time recruiting, vetting, training, providing cover for any absences. Add in the costs for computers, software, pensions and wages, the cost of having an in-house cashier continues to increase. Combine that with the time put into recruiting and managing the cashier, it goes to show that someone’s time will be heavily constrained, preventing them from conducting their daily business.

By outsourcing the legal cashiering service, you are introduced to a talent and knowledge pool of people who can provide cashiering support every day, their training and management needs are taken away from you. They also ensure that you remain compliant with the SRA, CLC and the Law Society of Scotland.

What is the cost benefit of outsourcing?

Maximise your resource: Benefit from a cost based on the actual activity and skill level your firm requires, rather than having to fund sufficient senior cashiering resource to deal with complex, high-risk elements, while using that same resource to carry out the more mundane, junior tasks.
Access expertise and insights: Get access to better forecasting data which provides valuable business insights that can be used to identify trends and inform your overall business strategy.
Improve your cashflow: Ensure an up-to-date log of case-related fees and expenses for regular claim back purposes – resulting in a healthier cash flow.
Reduce your exposure to risk: An outsourced partner will have invested heavily in security measures and will assume compliance responsibility.
Improve efficiency and productivity: Free your employees to get on with what they do best and benefit from more streamlined processes.
Become more agile: Scale resource up and down as you need it, without the hassle of hiring and firing employees.

Outsourcing this part of the business, frees up lawyers to do what they do best, win business and earn fees. This enables your business to grow.

About The Cashroom

When the property market is causing enough headaches for legal service professionals, The Cashroom is ready to help ease the pressure on your law firm by ensuring compliance with the solicitor’s accounts rules, saving firms money and providing accurate and timely management accounts and management information.

Let The Cashroom worry about your firm’s legal cashier and payroll services so that your firm can focus its resources and time on providing expert legal advice to the consumer. Additionally, our management accounts and management information on budgets, cash flow projections and monthly management allow you to reflect on the work that has been completed and accurately predict where your firm is going in the future.

New SRA Accounting Rules 2019

The Solicitors Regulation Authority has recently confirmed, that the changes of the SRA Accounting Rules will be effective from 25^th November 2019. These new reforms were approved by the Legal Services Board (LSB) last year and are part of the Looking to the Future programme, allowing solicitors greater flexibility in how they work.

The new SRA Accounting Rules are designed to be far more outcome-focused, and are shorter and more targeted than the existing rules. They continue to focus on the protection of client money but with the freedom for solicitors to use professional judgement in considering how the standards are met, by applying simpler accounting rules that focus on the principles of safeguarding client money, rather than lots of specific technical rules.

November will also see the SRA Digital badge becoming a mandatory requirement for all regulated firms who run a website. Further information is available on the Solicitors Regulation Authority website.

Under the current rules, period controls are specifically described, for example the transferring of costs within 14 days and the banking of client monies by next working day. However, under the new rules, these period controls have been replaced with the word “promptly”, leaving it open for you as a firm to decide what “promptly” means to you.

This also means that you could make the decision to continue using the old rules period controls for handling client money, as long as all areas of the new rules have been considered and changes made where necessary.

The SRA has promised some form of guidance in addition to the new rules. However, we have not yet received any confirmation when this will be nor what form, this will take.

Significant Changes to the SRA Accounting Rules

Under the current rules, firms can transfer money from client account to reimburse the firm for incurred or paid disbursements. However, under the new rules (4.3) firms must provide a bill of costs or other notification of costs incurred to the client or paying party first, before the transfer of funds can be completed. The definition of costs includes disbursements.
The current rules include a section on the dealing of residual client balances. However, these are now silent under the new rules with only rule 2.5 referring to the prompt return of client money as soon as there is no longer any proper reason to hold those funds.

Other Key Changes to the Rules

The number of rules has been reduced to 13, compared to the current 52.
Changes in what is classed as client money under certain circumstances means some firms may not be required to hold client bank accounts. This includes money received in advance for fees and disbursements (where they are the only client monies held and clients are informed in advance) and money received from the Legal Aid Agency.
Professional disbursements are currently considered separately to disbursements. However, it appears all disbursements will be treated in the same way under the new rules.
Agreed fees are no longer considered as separate to costs. Under the new rules, agreed fees are classed as client money until the bill is raised (unless the firm follows the changes in point 2).
The new rules now formally require the COFA or manager of the firm to review and sign off the client account reconciliations. Any differences on the reconciliation should be investigated and resolved promptly.
Firms running client’s own accounts will now be subject to reconciliations every five weeks. Considerations will need to be made on how this is completed as it is unusual for these accounts to be recorded on the client ledgers.
New rule 11 specifically refers to the use of TPMA’s (Third Party Managed Accounts). You are permitted to enter an arrangement with your clients to the use of a TPMA. You however must still ensure to obtain regular statements from the TPMA provider and ensure these accurately reflect all transactions on the account.

Considerations in Advance of the Rules

We recommend that all firms review the new rules which are available on the Solicitors Regulation Authority’s web page, to ensure you are comfortable with the changes due to commence from the 25^th November 2019. Below are some considerations to be made for the more common process changes required under the current rules:

Firms that current rely on the transferring of incurred and paid disbursements for cashflow purposes or as part of their usual cashiering procedures, need to consider the new rule 4.3 on billing or notifying clients in advance of transferring these costs. Changes to the current process will be need to be considered to either;
1. first supply disbursement only bills, or
2. only transfer costs on the creation of a final bill
Under the new rules the concept of unpaid or incurred disbursements has been removed, meaning disbursements are only to be considered as disbursements when paid.
Defining the meaning of “promptly” for your firm. Under the new rules, “promptly” is referred to on the banking of client monies received, and on the transferring of office monies from client account for costs (this includes disbursements). As a firm you will need to consider if you are required to adopt changes to adhere to this rule. It is recommended that documented systems and controls are in place to ensure the definition of “promptly” is familiar to all.

The Cashroom Clients

The Cashroom offers recommendations for adherence to these new rules and provide advice on the creation of a suitable policy to ensure compliance for our clients. If you are interested in what The Cashroom can offer, please get in touch…

Katie Wilson,

Head of Cashiering England and Wales