New research shows major compliance gaps in hybrid working arrangements

Access Legal has released new research which reveals that the vast majority of law firms plan to work in a hybrid way going forward, but that many compliance essentials are being overlooked.

The legal technology division of The Access Group surveyed a substantial number of law firms and found that 85% plan to offer a mix of home and office working going forwards.

However, almost a quarter of firms (22%) negated to review their health and safety assessment when staff were forced to work from their own homes in March 2020. With firms having the same responsibility for those working at home as they do for those in the office, adjustments should be made to fulfil health and safety obligations, including carrying out home workstation risk assessments and putting procedures in place to maintain direct contact with homeworkers.

When it comes to cyber security, 43% of firms have not fully updated their cyber security policies since moving to remote working, which means they have not properly identified the risks of personal IT equipment being used, including virus protection and appropriate system access tools.

Despite the recent focus the SRA has been putting on compliance with money laundering legislation, 40% of firms had not reviewed or updated their AML Practice Wide Risk Assessments. This goes against the requirement to note reviews even where no updating is found to be necessary. In reality, it is likely the requirements for training, policy, control and procedure updates, supervision, and ongoing monitoring of employees would all have needed updating during the pandemic.

Finally, nearly half (49%) of firms surveyed said they had not carried out a Data Protection Impact Assessment (DPIA) when moving to remote working. A DPIA is designed to help firms systematically analyse, identify and minimise the data protection risks of a project or plan, which the switch to home working would have been classed as. By not carrying out a DPIA, client data could be at high risk from cybercrime and data loss, especially if this data is being accessed and stored using an employee’s personal IT equipment that may not have appropriate security software installed and is accessible by other members of the family.

Commenting on the survey findings, Brian Rogers, Regulatory Director at Access Legal, said: “Although most firms appear to be doing the right things, there are quite a few that are placing themselves, their staff and their clients at significant risk. We urge these firms to take urgent action to ensure they seek help to address the gaps highlighted.

“As well as the compliance issues, there were also evident disparities in competency and supervision arrangements, policies and procedures and Business Continuity Plans. With the vast majority of firms looking to make a permanent switch to hybrid working, now is the time to carefully review compliance procedures and ensure that your requirements as an employer are being met.

“Many firms have shared with us that time and a lack of knowledge are the biggest constraints when it comes to addressing these issues but that isn’t going to be an excuse the SRA accepts. Firms have a duty to make the time to comply and understand what requirements they are expected to comply with.”

For further advice on compliance for the legal sector, you can visit