About this post

In our latest Q&A, Tim Bugg, chairman of the International Legal Services Advisory Council, reflects on the role of the council and how it helps law firms flourish in an expanding regional legal market.When Julia Graham first joined global law firm DLA Piper in its London headquarters as chief risk officer about seven years ago, she admits the role put her in a small club. While some firms had started discussing the concept of enterprise risk, very few had taken the next step of appointing a dedicated CRO. “I had a very lonely life when I first picked up this title,” Graham says with a laugh. “I do actually now network with many more people who have this role.”With a background in chartered insurance, Graham is at the forefront of a move by some larger law firms to ramp up their risk management through the acquisition of a CRO. While most of the activity is occurring in the larger United Kingdom and United States legal markets, the presence of global law firms such as DLA Piper, Norton Rose and Allen & Overy is changing the nature of the Australian market and potentially opening the way for more professionals with Graham’s skills. She says it is not surprising that larger firms are starting to follow the trend of mainstream corporate businesses. “Some of it is driven by the nature of the sector in that it has become populated by bigger and more complex organisations … The world of law is becoming more regulated and it’s becoming more complicated. And we are upping our game in these areas.”For a firm such as DLA Piper that has engaged in considerable expansion over the years – it now has more than 4200 lawyers across 30 countries and 76 offices – Graham says risk management must always be a priority. “We are used to growth,” she says. “It’s in our DNA, it’s how we do things.”Risky businessIn the wake of the global financial crisis and ongoing international economic volatility, Graham says it clear that risk management has a greater profile in large organisations and firms. Boards, she adds, are also seeking greater security around compliance issues. “If you can’t give a board comfort on compliance, it can turn people into being a bit more risk averse but less confident about how their business is operating. Therefore, I think that rising tide of risk on the board agenda is both driven by the complicated world that we are in and the financial environment. But it’s also driven by the rising tide of regulation and law and the needs for boards of law firms to take comfort that they are trading in a compliant way.”According to Graham, large law firms are facing the same risks as most corporations – the volatile financial climate; technology-related threats and growing regulation. In the case of CROs, they typically report to senior management and are accountable for enabling the business to balance risks and rewards. Graham suggests a law firm requires significant scale and maturity before needing a CRO. While not all organisations use the same title, she says when boards and senior management start engaging in discussions about enterprise risk management – whereby they identify and proactively address business risks and associated dangers and opportunities – it is the precursor to having a CRO or a similarly defined role. “The fact that I am seeing people doing a job that looks like mine in law firms talking about ERM, I think it is more likely at some stage in the future you will start to see more people with that job title.”A notable aspect of Graham and her role at DLA Piper is that she does not have a background as a lawyer. With more than 30 years in the world of risk and insurance, she brings specialist knowledge and experience to the job and addresses issues such as legal and regulatory risk, operational risk such as health, safety, security and business continuity, and information security, compliance and assurance. By contrast, most risk management in other law firms is still the domain of lawyers.Graham acknowledges that the partnership ethos that drives most law firms means that in most instances lawyers will manage a firm’s risk profile. However, she says the trend towards externally trained finance, marketing and HR professionals is a pointer to the future. Similarly, more CEOs and COOs are being appointed in law firms without having come up through the ranks as a lawyer. “This is not an avalanche by any means, (but) you may well find in the future that CEOs of bigger law firms are not necessarily lawyers. But I don’t see any big change in that regard,” says Graham, who notes that DLA Piper is well served by Sir Nigel Knowles, a person who combines great leadership and legal skills.Specialist skillsGraham argues that there is some merit in “airlifting” in a specialist risk manager to a law firm. She and her CRO colleagues can bring specialist training and knowledge to the role. “It’s what I am qualified to do,” she adds. “I am a chartered insurer and it’s my professional practice. I’ve had a big learning curve, but I also bring in with me knowledge and learning that otherwise wouldn’t have been in the firm.”While law firms considering appointing a CRO will have to get their heads around the role and how it will work, Graham says CROs coming into a firm also need to understand the unique culture of the legal world. “The big key with law firms is understanding how they work,” she says. “If you’re not a bit of a chameleon and you’re not able to take on the guise and the knowledge and the culture of the sector that you are in, then it’s not going to work.”Graham actually prefers working in a partnership model “because people are very engaged because it’s their business”. While it is important for managing partners and their executive teams to empower a CRO, it is a two-way street. “It’s something you give, but it’s also something you earn,” Graham says.While she is a great advocate for her profession, Graham reaffirms the point that not all firms or businesses will need a CRO. It should be part of an evolutionary process as the firm grows.“It really depends on your business. There can often be a temptation or vogue with the latest craze because it sounds like the right thing to do. Personally I think you should only have this role if you really understand what it is and if it’s right for your business.”

• Articles