One of the key duties faced by all Compliance Officers for Legal Practice (COLPs) and Compliance Officers for Finance and Administration (COFAs) is the need to make a prompt report to the SRA as to “any facts or matters that you reasonably believe are capable of amounting to a serious breach of the terms and conditions of your firm’s authorisation, or the SRA’s regulatory arrangements which apply to your firm, managers or employees” (paragraph 9.1(d) and 9.2(b) of the SRA Code of Conduct for Firms).
This requirement first arose in sections 91 and 92 of the Legal Services Act 2007 and was first incorporated into the rules in the form of the “material breach”, transforming into the “serious breach” with the introduction of the 2019 Standards and Regulations.
It is a fact of life in practice today that the majority of firms could easily find themselves subject to a breach of the SRA’s regulatory arrangements. Some breaches are so minor that provided they are rectified immediately, no harm is done. Others, however, may be a little more critical. Whether the breach be from a slip up with client account, inadvertently breaching confidentiality, not following the Transparency Rules to the letter or failing to advise a client as to all aspects of costs, breaches occur in the best run of firms. How you deal with those breaches, and the follow up that you put in place, is what can make the difference between serious consequences and a slap on the wrist.
Only breaches that are deemed to be “serious” need to be reported to the SRA. There continues to be a duty for you to “keep and maintain records to demonstrate compliance with your obligations under the SRA’s regulatory arrangements”, which implies the need to keep records of all potential breaches, however it is only the serious breaches that need to be reported.
That of course begs the question as to what amounts to a serious breach.
As was the case previously with material breaches, there is little to be found in terms of guidance from the SRA as to what constitutes a “serious” breach for the purposes pf paragraph 9.1(d) or 9.2(b) of the Code of Conduct for Firms. It is not defined in the Glossary to the Standards and Regulations. This is not withstanding that there is also a duty upon all solicitors to “report promptly to the SRA or another approved regulator, as appropriate, any facts or matters that you reasonably believe are capable of amounting to a serious breach of their regulatory arrangements by any person regulated by them (including you)”.
To find out what constitutes a serious breach, a little detective work is required.
Note (x) to Rule 8 of the Authorisation Rules 2011 did provide some guidance as to what constituted a material breach and this is still useful in determining what might amount to a serious breach. This provided that:
“In considering whether a failure is “material” [or “serious” in current rule terminology], the COLP or COFA, as appropriate, will need to take account of various factors, such as:
Thi is not necessarily that helpful a definition in practice and is further complicated by the fact that a material breach could be a breach which, on its own, would not have been material, but which might become material if it forms part of a series of breaches.
The Law Society, in guidance since updated, commented at the time that “Compliance officers must remember that the SRA Code covers a wide range of issues including business management and financial stability and notify the SRA if they believe the practice is in serious financial difficulty” whilst in their practice advice FAQs from around the same time they stated:
“What is ‘material’ will depend on the firm and the circumstances around possible failures to comply with the SRA Authorisation Rules, and the SRA will judge each case on its own merits. As set out above, factors such as the detriment or risk of detriment to clients, the scale of the issue and overall impact on the firm will need to be considered in deciding whether a failure is ‘material’.”
Fortunately, however, there is some guidance to be had.
This is to be found in the SRA Enforcement Strategy (not part of the Standards and Regulations). The Strategy provides information on the reporting of concerns at paragraph 1.2. where it states that:
“Reporting behaviour that presents a risk to clients, the public or the wider public interest, goes to the core of the professional principles of trust and integrity. It is important that solicitors and firms let us know about serious concerns promptly, where this may result in us taking regulatory action. We do not want to receive reports or allegations that are without merit, frivolous or of breaches that are minor or technical in nature – that is not in anyone’s interest. We do want to receive reports where it is possible that a serious breach of our standards or requirements has occurred and where we may wish to take regulatory action”.
The Strategy goes on to set out when a report should be made. In a nutshell this is:
“where a serious breach is indicated, we are keen for firms to engage with us at an early stage in their internal investigative process and to keep us updated on progress and outcomes. And, we may nonetheless wish to investigate the matter, or an aspect of a matter, ourselves – for example because our focus is different, or because we need to gather evidence from elsewhere”.
It also sets out who should make the report, where the preference is for reports to be made through the firm’s compliance officer so as to avoid “multiple or duplicate reports being made” and so as to allow “compliance officers to use their expertise to make professional judgments in light of the facts (and following investigation, where appropriate)”.
The assessment as to seriousness that the SRA will make involves a number of factors including past conduct and behaviour and mitigating factors such as a low likelihood of future risk or repetition of the behaviour. The key factors that the SRA will take into account include:
Do bear in mind, however, that these are the factors that are applied after a matter has been reported or come to light. It is the job of the COLP or COFA (as relevant) to interpret these and apply them to the breach in question. Thus, if it is likely that the SRA will take a serious view of the breach, then it is reportable whereas if the breach is minor, unlikely to be repeated and with negligible effect on clients or their interests, then it may not need to be.
Firms wishing to apply some degree of uniformity to the process of whether or not a breach is serious may like to think ahead as to the types of issues that might give rise to a report and those that will not. This will have the added benefit that steps may be able to be taken in order to prevent or ameliorate the effects of such a breach – which if nothing else will place the firm in a better position with the SRA.
The process might be assisted by the use of a risk grid where the firm can plot the likelihood of the breach arising or being repeated or whether there is any element of dishonesty or intent on the part of the person committing the breach against the effect the breach will have, or is likely to have, on clients, their interests, the firm, the reputation of the profession, etc.
For each breach you give a figure from 1 to 5 as to the likelihood of the breach occurring or being repeated/the culpability of the person concerned against the extent of the impact that breach would be likely to have, were it to occur. Breaches that are unlikely to re-occur, have been committed without intent or blame and will have little effect need to be given less prominence in terms of prevention than breaches that are either more likely to happen again, are as a result of dishonesty or, were they to occur, likely to have damaging consequences for clients, the firm, the profession, and so forth. See figure 1.
When looking at putting in place processes to avoid those breaches, high-risk potential breaches need to have robust solutions put in place to prevent them from occurring. Low risk breaches need to be given lesser prominence. The closer to the top right hand corner of the grid, the more important it is that the firm take preventative steps where possible.
Bear in mind that the aim is to have a manageable plan for preventing breaches that is not so complex or time-consuming as to damage the ability of the firm to function.
As already pointed out, there is very little guidance from the SRA as to what in practice constitutes a serious breach and with legal practice being as complex as it is, it would be almost impossible to provide a definitive list of the types of situation that should be reported. Bear in mind that often the circumstances of a breach can be as important as the nature of the breach itself. Thus, a minor breach that occurs regularly because of a systemic failure on the part of the firm may need to be reported (together with the firm’s plans for addressing the issue going forward) whereas that same breach that occurs as a one-off and is unlikely to occur again may not need to be.
Purely as an aide to making your own decision, the following are examples of what could constitute a serious breach. As said earlier, do not assume that this is an exhaustive list or that the absence from this list means that you do not need to make a report. They include:
If a serious breach does occur then the firm, through the COLP or COFA, should make a report to the SRA as soon as possible. Failure to make reports promptly can also lead to further harm or loss and carries a risk that regulatory action will be taken against the firm for not giving the SRA the information that it requires in a timely manner.
For these purposes, the definition of “prompt” in terms of the report can present COLPs and COFAs with a somewhat thorny problem. The SRA currently take the view that it should be as soon as possible after the breach has been discovered. However, this does not take account of the fact that it may not be possible to make an adequate report until further investigation has taken place or until the facts are known. Perhaps the best advice is to say that it should be reported at the first opportunity to do so after it is discovered. This may mean not waiting until steps to remedy the breach have been taken or it may mean, in circumstances where remedy is more important than report, taking steps to remedy the problem first. As with so much else in this area, the circumstances will dictate when it is appropriate to do so.
Wherever possible the firm should take all reasonable steps to correct the breach – whether or not it is a serious one – and should also take steps to ensure that procedures are put in place to prevent such a breach arising in the future. Clearly this will not always be possible. Note that taking such steps may well make the SRA look more favourably on the firm.
Not all reported serious breaches will necessarily result in any action being taken by the SRA towards the firm. Again it depends upon the nature of the breach and the outcomes that arise from it.
When making the report, the factors used by the SRA in determining a breach and which are set out in the SRA Enforcement Strategy should always be borne in mind. Thus, the report should not only state the factual surrounding the breach but should also contain:
Should further steps, including disciplinary steps, be required then these should also be referred to.
It may also be beneficial to include any “mitigating circumstances” by way of an explanation as to why the breach occurred. This might include what the SRA refer to as ‘contextual’ mitigation – i.e. the events surrounding the breach – or personal mitigation such as the background, character and circumstances of the individual or firm, the relative inexperience of the individual or other personal factors.
Finally, consideration should be given in the report to other factors including:
Bear in mind at all times that committing a breach of the rules is rarely going to produce as serious an outcome for the firm as trying to hide the breach with it then being discovered at a later stage.
Finally, the report should be in writing and may be made either to the SRA at its offices in Birmingham or to the email address report@sra.org.uk. Although there is no particular format in which a report needs to be made the SRA encourage you to make use of their reporting form which can be found at (https://www.sra.org.uk/consumers/problems/report-solicitor). In practice this form is more suited to reports from members of the public, so you would be better in most cases reporting by letter or email.
