What would you do if your partner stole from your firm?

How would you investigate the allegations? What's your plan to keep your firm up and running and minimise disruption?

What are your professional obligations? How do you get your firm’s/client’s money back? What about the police?

Read on and see if your response plan matches our suggested best practice.

• Initial investigation
• Privilege
• Strategy
• Regulatory responsibilities
• Insurers
• Criminal or civil recovery?
• So what should you do?

Initial investigation

Your first port of call is to notify the firm’s compliance officers for:

• legal practice (COLP)
• finance and administration (COFA)

They can then help investigate and verify the whistleblower's concerns.

If help is required from other employees, only inform them of the concerns on a need-to-know basis.

Whatever you do, do not tell the potential fraudster that they are under investigation or call the police. These steps come later.

You should conclude the initial stage of the investigation quickly.

It should not be extensive: you need only do the absolute minimum level of investigation to establish that the concerns are potentially valid.

Check that the unauthorised payments have occurred and that it's not obvious why the payments have been made (for example, by briefly reviewing the electronic files).

Once you have validated the whistleblower’s concerns, you should engage external solicitors.

Your external solicitors should be a full-service firm. You are going to need advice arising out of multiple legal disciplines.

Choose a firm with experts in each of the fields discussed below. This is about the survival of your business.

So why do you need to instruct solicitors at such an early stage? One of the key reasons is privilege.

Privilege

Appointing external solicitors maximises the chances that the next steps of your investigation will be protected by legal professional privilege.

Getting it wrong regarding privilege at an early stage can have disastrous and potentially unforeseeable consequences.

You have to remember that although your firm is a victim of the fraud, there is a real risk that the firm could be sued by its clients if client funds have been taken.

The firm may also be investigated by the Solicitors Regulation Authority (SRA) or HM Revenue and Customs.

Such investigations can have extremely serious consequences, both for individuals and the firm.

One potential outcome of an SRA investigation is an intervention, where the SRA closes down the firm.

Given the risks, you want to make sure that you do the right thing and the firm has as many options as possible regarding what documents it discloses to third parties.

Bear in mind that legal advice privilege does not apply to advice given by accountants.

Any report or analysis prepared by an accountant could be disclosable to third parties during the course of any proceedings.

Best practice is to use your external solicitors to instruct accountants. Doing so maximises the likelihood that litigation privilege will bite.

Do not use your existing auditors to review the accounts, as you may have a direct action against them.

In circumstances where the law firm is the victim of the fraud, it should be straightforward to demonstrate that litigation is in reasonable contemplation.

However, you should get your external solicitors to record why they consider that litigation privilege is engaged.

This note would be helpful evidence if the privileged status of a document is challenged at a later stage.

Documents created during the course of your investigation are also likely to contain confidential and privileged client information.

Such privilege will belong to each client in respect of its matter and is something that you, as a firm (even if affected by an internal or external fraud) cannot waive without potentially facing claims or SRA conduct issues.

You have duties to protect clients' confidentiality and privilege in their information and should not disclose it to third parties unless (and only to the extent) required by law.

While the SRA and other regulators have certain powers to access privileged client information, you should consider requests for client information carefully and ensure that the appropriate formal procedure is used.

Strategy

Your external solicitors will assist in preparing your strategy for resolving the problem.

Your objective is to identify as much information about the fraud as quickly as possible. This maximises the chances of recovering any misappropriated funds from the fraudster.

It may be appropriate to apply to the court for interim remedies, such as freezing orders and search and seize orders.

You may wish to apply for disclosure orders without notice to the suspected fraudster to identify, for example, cash flows through various accounts, to ensure a freezing order is effective in freezing a sum of cash in an account.

It's important to consider the benefits of a covert investigation carefully.

It will also be important to consider whether legal counsel from other jurisdictions ought to be brought on board to advise on obtaining interim relief in other jurisdictions at the same time.

The same is true of forensic accountants if you need help following the money.

As a victim of a fraud, it's also important to obtain a proprietary freezing order, if possible.

The benefit of a proprietary freezing order, as opposed to a 'normal' freezing order, is that the stolen monies, in the main, cannot be used by the partner to fund their defence against the firm.

In many instances, it's better to delay going to court until the evidence is so compelling that a proprietary freezing injunction will be granted for this very reason.

Specialist lawyers will be able to advise you on the best course of action.

Regulatory responsibilities

Formal reporting

You need to carefully consider your professional obligations.

In particular, you will have specific reporting obligations to the SRA in the event of misconduct by partners or staff, and in the event of financial assurance concerns that may have been caused by the fraudster's actions.

The SRA will take a hard line on firms or individuals who fail to self-report material issues promptly.

Whilst it's a daunting prospect to make an initial self-report to the SRA, it's key that you consult with your external professional advisers.

They will have experience on drafting these reports, and making sure the right messages are being sent. This will help paint the full picture and provide the SRA with suitable reassurance that the issue is being professionally managed in a compliant way.

The SRA are likely to take comfort from seeing names of leading individuals on the investigation and regulatory responsibilities team.

Your chosen firm of external solicitors should have significant regulatory experience and hold the SRA's confidence.

The importance of this working relationship cannot be overstated.

If the SRA has confidence in the professional advisers’ team, it will likely allow the team to get on with the investigation to a greater extent.

Keeping the SRA regularly up to date on progress and responding to its queries promptly are also key to continuing to provide that essential regulatory reassurance.

Remedy any deficiency in client account

Moving quickly to replenish any deficits in client funds must be a primary focus. In our experience, this is the SRA's key concern.

All partners in the firm will be aware of their duties to rectify any shortfall "promptly upon discovery", as defined in the SRA Accounts Rules, and all partners are jointly and severally liable for any breaches of the rules.

This means that if a shortfall is identified in your client account and not replaced immediately (using all necessary means, which includes exhausting partners' personal resources), the SRA may take regulatory action against all partners.

The duty to replace client monies promptly applies regardless of whether you have yet (or ever will) recover that money either from the partner responsible or from insurers.

Duties to notify clients

As discussed below, you have a professional obligation to inform current clients if you discover an act or omission (including a fraud) which could give rise to a claim by them against the firm.

Your professional advisers may draft these essential client communications on your behalf which will also support the critical client protection steps that you have put in place.

Insurers

Get in touch with your insurers on day one of the investigation as you will have to comply with the notification requirements set out in your policy.

From a cash flow perspective, it's clearly beneficial if insurers are prepared to replenish any client account deficit at the outset, rather than the firm having to do this out of its own funds and then look to insurers for reimbursement.

However, this depends on the timescales of the insurer making funds available and your regulatory duties to replenish promptly upon discovery.

You may not continue to operate a client account with any shortage.

To enable the firm to continue to provide reserved legal activities and service its clients, you will appreciate that speed is of the essence in remedying any client account shortage.

You may wish to involve your broker who will be able to advise which insurance policies to claim against and assist you with this process.

The sooner insurers confirm coverage, the sooner you will be able to sleep a little easier.

However, experience dictates that insurers can take some time to confirm that the firm is insured for the loss.

This is particularly the case in relation to professional indemnity insurance for law firms which is written on the minimum terms and conditions.

Insurers will wish to be satisfied that there are "innocent" partners involved, so the fraud exclusion in that cover does not come into play.

In most frauds committed within large law firms, this should not be an issue.

You might be tempted to manage the insurance claim yourself. This often happens when firms consider that they have a good relationship with their insurer or broker.

However, you should consider using your external solicitors' specialist contentious insurance team to liaise with the insurer. This is because an insured firm's relationship with its insurer can change when the firm needs to make a significant claim.

You should always be aware that it is possible that the insurer may refuse to confirm coverage and take adverse positions to the insured firm and/or other insurers.

Your external solicitors should carefully consider your insurance coverage.

They should identify whether your policies have any gaps in cover which may potentially expose your firm. They will be able to advise you of the scope of your cover, such as the extent to which you are or are not covered for (for example) internal investigation costs.

And they should tell you what you need to do to maximise the likelihood that coverage will be confirmed. You should also be made aware of the obligations which continue after notification to insurers.

Your insurer might try and persuade you to use one of its panel-approved solicitors firms. This is a critical situation for you and your firm.

It is important that you instruct who you think has the relevant expertise to rescue you and advise you in this business critical situation and not necessarily just a firm that has agreed panel rates with insurers.

Many policies will allow the insured firm's managing partner to determine the firm that is instructed.

The objective is obviously to get coverage confirmed as quickly as possible. This is easier said than done.

However, once the insurer confirms coverage, you should seek an interim payment from them in respect of any client funds you may already have had to replenish.

Criminal or civil recovery?

Your first instinct might be to report the fraudster to the police and let justice take its course.

Unfortunately, due to police resourcing issues and the police's priorities focusing on other types of crime, corporate victims of fraud may be underwhelmed by the police response to a crime report.

If the police do take an interest in your case, it's likely that the response time will be measurable in months and weeks rather than hours and days.

By that time, the fraudster will have probably dissipated the money ruining your chance for a recovery.

So what should you do?

An array of civil recovery options are available to target a fraudster.

The most draconian weapons in your arsenal are freezing orders and search and seize orders. However, a high evidential burden has to be discharged to obtain these orders.

Sometimes it's well worth biding your time and building up your evidence.

Investigate the fraudster's assets. Seek disclosure orders against third parties such as banks to find out where the fraudster has deposited your money to ensure the order bites as effectively as possible.

Maintaining the advantage of surprise is crucial at this stage. Otherwise, the fraudster could dissipate the cash and even flee the jurisdiction.

Maintaining the confidentiality of any civil court proceedings is also often necessary. This is because our courts operate in line with the principle of open justice.

You will therefore need to make sure that your external solicitors take the requisite steps to maintain your firm's confidentiality and indeed your clients' privilege. These steps can include:

• redacting client names in evidence
• having hearings heard in private
• getting the court file sealed
• obtaining press reporting restrictions

You won't be able to keep a lid on the fraud forever.

However, you should be able to buy enough time to make sure your strategy is effective and maximise the chances of recovering assets.

A further option is to bring a private criminal prosecution against the perpetrator of the fraud.

Advice from a specialist should be sought before embarking on this course of action.

Clients

Where client funds are affected, your firm must ensure clients are informed and then kept updated.

Your clients' trust in your firm will have been shaken. Demonstrate that you are treating the situation seriously and make sure that a person of requisite seniority informs clients as to what has happened.

Clients do not need to be informed of all the detailed findings of the investigation or the specific details of the action plan.

But they should be given sufficient information to enable them to appreciate that their concerns and assets are being safeguarded as best as possible.

Do whatever is necessary to start rebuilding trust.

Finally, where timetables for communications are set, regardless of the client in question, stick to the timetable.

Employees

Your employees are the most important asset of your firm.

Upon discovery of a fraud within the firm, employees will be concerned about their own positions and the future viability of the organisation.

Naturally, this has a negative impact on morale and productivity.

Clear, effective and regular communications with employees are key in rebuilding the trust and morale between the organisation and employees. This will also prevent false information and rumours from spreading which serve only to harm the firm.

Remind employees of their confidentiality obligations and instruct them to direct any queries from external parties to the relevant manager or PR agency contact.

Demonstrate strong leadership.

Conclusion

Act quickly

A failure to react quickly is likely to result in the organisation failing to contain and minimise the damage to the business.

Furthermore, the organisation will also be hindered in its ability to maximise the chances of recovering the misappropriated funds.

Speed of response is also particularly important in the context of interim applications for freezing orders and search and seize orders. These sorts of applications need to be made without undue delay.

Decisive action in a crisis can often be the difference between success and failure for the firm and the partners personally.

Seek and rely on specialist advice

Let your external solicitors walk you through the process. They are experts and this is their day job.

Manage regulatory risk

Ensure prompt reporting to the SRA and continue to provide regular updating regulatory reports that evidence the client protection steps you have in place and provide regulatory reassurance.

Manage your risks of regulatory action, including the risks of an intervention.

Demonstrate to the SRA that you have a plan, you are on top of the detail and you have the support of trusted professionals who are specialists in this field.

Keep the show on the road

Being able to successfully manage and deal with a crisis emanating from a fraud allows a firm to send a positive message to its clients, employees and the SRA.

It demonstrates the competence of the organisation's management and instils confidence in their future decisions.

A time of crisis is often an opportunity to demonstrate and reiterate the firm's positive attributes and values.

Identifying that fraud will not be tolerated, and that losses arising from a fraud will be recovered through all legal means possible is a reassuringly persuasive message to send.

It sets the tone of how the firm wants to operate and be seen to operate. It reinforces the firm's ethical values, something which is becoming more and more important in today's business environment.

This is also a message that is unlikely to be forgotten quickly.

Learn lessons

Reflect on whether changes to policies and procedures should be implemented to try to avoid similar situations arising again in future or put your firm in a better position to tackle them if they do.

For example, were there 'red flags' which should have alerted the firm that the partner in question was a fraud risk?

Was the partner highly protective of their work; did they take little annual leave? If so, do you need to change policies to address this, for example, by introducing mandatory annual leave or revisiting remuneration or supervision structures.

Do your financial systems need to be made more robust to make frauds harder to perpetrate or allow them to be detected more quickly?

Are there ways your investigation could have been made more effective?

Did you have adequate types and levels of insurance in place to cover this type of situation, or should you buy additional types of cover, such as crime cover, in future?

Reflecting in this way will ensure that your business is stronger in future as a result of the difficulties you have had to work through.