I'm a COLP. What should I do if there's a compliance breach at my firm?

I’m a compliance officer for legal practice (COLP). There has been a serious breach of compliance that should be reported to the SRA. What is the timeframe for reporting and is there a form I should use?

Any serious breach must be reported to the Solicitors Regulation Authority (SRA) as soon as reasonably practicable.

The SRA has indicated that, in most cases, that should mean immediately.

Although there is no prescribed form of report, it’s advisable to report the breach in writing.

You can use the SRA's online reporting form or email report@sra.org.uk.

It’s not recommended that you make your report solely by telephone.

However, it may be useful to call the SRA if there is likelihood that the written report will be delayed for any reason, or if you need advice about making the report.

Within your written report, you should:

• explain that you are making the report as the firm's COLP under paragraph 9.1 of the SRA Code of Conduct for Firms
• refer to the particular requirement/s that has/have been breached – for example, by reference to particular SRA Principles and/or paragraphs in the SRA Code of Conduct for Solicitors and for Firms
• explain the nature of the breach and why you consider it to be serious – for example, by referring to:
  • the detriment or risk of detriment to a client
  • the extent of any risk of loss of confidence in the practice or in the provision of legal services
  • the scale of the issue and/or the overall impact on the practice, its clients and third parties
• (alternatively, you may consider that a series of individually trivial breaches amounts to a serious breach, in which case you should explain that reasoning)
• explain when the breach occurred and when it was discovered, its cause and any recompense given to the client
• explain any disciplinary or remedial action taken or lessons learned from the breach – for example, changes to systems or procedures or identification of additional training needs to reduce the risk of the same happening again

You should also record the breach on your own internal register of breaches and consider reviewing that on a regular basis with a view to learning from it.

For more information, see our:

• practice note on compliance officers
• COLPs Toolkit (3rd edition), which contains a draft letter of report to the SRA as well as other useful precedents

The SRA also provides information on:

• its enforcement strategy
• reporting notification obligations
• reporting notification guidance