Blogs

With the rise of cyber-attacks, international tension, and remote or hybrid work environments, clients want to ensure their data is properly handled and secured.  A popular method of ensuring the safety of their data is an audit.  With respect to this blog post, the term “audit” is used to refer to a process by which a law firm’s risks are identified and analyzed, and the information is used to minimize the firm’s risk going forward. Think of an audit as a law firm health check, which ensures the client’s data is safe and provides increased control. This control ensures that client audits are not going away anytime soon.  In fact, they most likely will never go away!  In this blog post, we will discuss a few ways to approach staying on top of client audits and provide some ideas on how to manage the ever-growing number of audits.

How do we prepare for the barrage of audits from clients today? Realistically, there is no correct answer; however, there are plenty of things that can help you take the edge off.  Taking the time to get familiar with your organization’s policies and procedures surrounding data collection, data handling and third-party management will likely outline the handling of data in your organization.  It’s impossible to remember every single policy or SOP, but knowing where these documents are located saves time and increases efficiency when the need arises.

Another way to prepare is to get familiar with your clients.  What kind of business does your client do?  Having an idea of the kinds of data most likely to be transferred will help with identifying what your client’s expectations and standards may resemble.  To be one-hundred percent sure of what your client’s expectations are, take a look at the Outside Counsel Guidelines, if there are any.  The OCG will likely outline what’s important to your client.

It is said that knowledge is power…but it can also help save your valuable time!  Identifying internal and external support early in the process that can address specific areas of client audits will minimize the time investment to search and locate these resources when you need them.  For instance, if a bank sends an audit, its very likely there is a large portion of that audit with questions that your financial team can be assigned to answer. Early identification of other departments and teams at your organization will make it much easier to complete long audits and questionnaires when the whole team gets involved.  There are also external resources that may be of assistance when drafting audit responses. Leverage service organization controls (SOC) reports and International Organization for Standardization (ISO) certifications from third party suppliers that provide services that help support your organization.

Another idea to consider is Audit Continuity, or keeping the information you glean along the way organized and in one key location. Logging your organization’s response to client audits is a good way to measure information security maturity and areas of improvement, while offering a point of reference for new and existing team members. Platforms like a document management system (NetDocuments, iManage, etc.) are perfect for the purpose of continuity!  Each client can have a dedicated and secured workspace that houses a record of each audit response from your organization to the client.  In the future, when new audits are requested, you will now have a database where you can cross reference information or quickly identify what has changed from the previous year.  There are also other platforms that cater specifically to organizing Request for Proposals (RFP) and audits.

Your audit tool kit should now be filled with all the right tools for the job. Client audits help to build trust and strengthen the relationship between the firm and its clients.  As confusing as it may be to manage client audits, with the right tools and audit continuity procedures in place, you can enjoy success for your firm and its clients no matter how many audits come along!