Effective risk management is fundamental to the commercial success of law firms. To manage risk effectively you must first identify the risks that could impact on your business. This Practice Note identifies some common risks facing law firms to help you formulate a risk management policy. See also Practice Note: How to formulate a risk management policy—law firms. What is risk? There is a widely accepted definition of risk, ie: Risk = probability x impact So, for any given risk faced by your business, there are two questions: • how likely is it that the risk will materialise, ie what is the probability? • if the risk does materialise, how bad will it be, ie what is the impact? Categories of risk Risk is typically categorised, eg: • strategic risk—risks that could materially affect your firm’s survival or profitability • operational risk—risks that are associated with day-to-day activities and management • regulatory risk—the risks you face from non-compliance with your regulatory obligations Some risks may fall into more

This Checklist is designed to help you determine whether you have the systems in place to comply with regulatory requirements that apply to law firms in relation to risk management. It reflects SRA obligations and Lexcel requirements, which are compulsory for Lexcel accredited firms and otherwise recommended. It should be read in conjunction with subtopic: Risk management. Requirement Compulsory or recommended Comments (if any) ☐ Develop systems for identifying risks.See Precedents:—Risk management policy—Risk register, and—Internal risk report form Compulsory You must identify, monitor and manage all material risks to your business, including those which may arise from your connected practices.SRA Code for Firms, para 2.5 (Insert any comments you may wish to make regarding your firm’s arrangements) ☐ Develop a system for evaluating risks.See Precedent: Risk scorecard (matrix). Recommended (Insert any comments you may wish to make regarding your

ARCHIVED: This archived Practice Note is not being maintained. Repeal and transitional provisions Risk of Sexual Harm Orders have now been replaced by (a) sexual harm prevention orders (SHPOs) and (b) sexual risk orders (SROs). This is as a result of sections 123 to 129 of the Sexual Offences Act 2003 (SOA 2003) having been repealed by the Anti-social Behaviour, Crime and Policing Act 2014 (ABCPA 2014). See Practice Notes: Sexual harm prevention orders and Sexual risk orders. Practitioners should note the effect of the saving and transitional provisions: the repeal or amendment of SOA 2003, ss 123 to 129 (by ABCPA 2014) does not apply in relation to: • an application for a risk of sexual harm order made before 8 March 2015 • an existing order (whether made before or after 8 March 2015) which had been applied for before 8 March 2015, or • anything done in connection with such an application or order Since 8 March 2015 (when ABCPA 2014, s 114 came into force), there can be

The extra expected return over the risk-free rate demanded by investors to compensate them for the volatility of returns or the possibility of default of risky assets.

The purpose of this questionnaire is to identify potential business risks. Please spend no more than [insert time, eg 30 minutes] completing this questionnaire and return it to [insert email address]. [If you have any questions or are unsure whether to include something, please contact [insert name and email address].] 1 About you Your name [insert name] Your role [describe your role within the business] Your department [insert department] Briefly describe the function of your department [Please explain, in simple terms, what your department does] Any other relevant information [insert any other relevant information about your department, eg important major projects] 2 Previous incidents Please complete this section if any incidents set out in the table below have occurred in your department

A formal list of the risks to which the pension trustees are exposed to, and their degree of importance.

Please click for the Precedent risk register. Please note that this register has been prepared in Excel and it therefore cannot be downloaded to Word. What is a risk register? A risk register is a tool for collating and managing all your risk information in one place. To formulate an effective risk register, you must first identify the risks your organisation faces. It is also helpful to have an understanding of your organisation’s appetite for risk. The risk register then enables you to categorise each risk the organisation faces, score each risk and decide on your response to each risk, eg reject or accept, and if you accept, to control or mitigate the risk. Depending on the size and nature of your business, you may consider having a register for each department or type of risk, with the priority risks then rolling up into an overarching register. For a sample privacy risk register, see Precedent: Privacy risk register. For a sample legal risk register, see Precedent: Legal risk register. Identifying risks To formulate an effective risk register, you must first identify the risks your

1 General information Date of review [Insert date] Person(s) conducting review [Insert name(s)] 2 Review and findings Is your Risk register up to date? □ Yes□ No—ensure you set an action point at Section 3 to update the register Do any individual risks need to be reviewed further? □ Yes—please

Risk scorecard (matrix) Probability rating Score Likelihood of risk materialising Benchmark 1 Very low Only expected to occur in exceptional circumstances.[Up to [10]% chance of occurring.] 2 Low Not expected to occur within the next year in normal circumstances.[[10–35]%

The SRA's approach to regulation is risk-based.

An investment with no chance of default, and a known and certain rate of return. (Typically the yield on a government bond or cash.)

Risk-free rates measure secured or unsecured overnight borrowing costs in the financial markets. SONIA and similar benchmarks are described as almost risk-free because the overnight transactions that constitute the input data reflect minimal credit risk.