Why Law Firms Need Internal Controls

Most lawyers know how big a problem occupational fraud is in corporate America. They may even count as clients companies that have been defrauded and suffered significant losses. Yet a "not at my firm" attitude persists among many partners who take for granted the honesty and integrity of their colleagues and staff.

Unfortunately, given a strong motive and unchecked opportunity, even ethical people can be tempted to steal. Without comprehensive internal controls, your firm is providing just such an opportunity - and it's likely only a matter of time before someone exploits it. Even if you have internal controls, if you don't enforce and regularly update them your firm may be just as vulnerable to fraud as firms that have taken no precautionary measures.

Unique risks

While law firms enjoy certain protections from fraud, they also harbor specific risks. For example, on-site management by a team of professional owners can make it more difficult for thieves to carry out elaborate and costly schemes. But such owners also are more likely to override internal controls.

What's more, work environments where there's considerable pressure to meet ambitious financial and performance goals can turn normally upright employees into cheaters. And it doesn't help matters that law firms enjoy a reputation among experienced crooks for having lax controls or that many firms are unwilling to punish perpetrators because it could lead to bad publicity.

Assess and address

To prevent fraud risks from becoming reality, closely study your firm's policies, procedures and processes - including hiring, payroll, billing, collections and IT security - for potential vulnerabilities. Your financial advisor can help you perform a thorough initial risk assessment and use its findings to create a list of internal controls. This list may contain hundreds of items, but there are a few that belong in every firm's internal controls. For example, it's essential that you:

Screen employees. When you hire anyone - including lateral partners - perform credit and criminal background checks and verify résumé items related to past employment, education, military service and professional certification. Keep in mind that, according to the federal Fair Credit Reporting Act, you generally need a person's permission to run a credit check, and in some states credit checks are allowed only for positions with certain financial responsibilities.

Separate duties. No single employee should be in charge of purchasing and approving vendors or receive payments and deposit them. It can be difficult to spread duties among several employees in a smaller firm, so consider outsourcing some accounting functions. Also, never let a nonpartner sign checks: This is perhaps the easiest avenue for fraud. You may even want to require that two partners sign checks above a certain amount.

Reconcile regularly. Periodically reconcile overlapping financial records. For example, compare receipts that are recorded in your billing system to revenues recorded in your accounting system and then cross-check those numbers with your bank deposits. Review paper and online bank statements regularly, looking for inappropriate transactions.

Conduct surprise audits. Audits don't have to be top-to-bottom reviews of your firm's finances - they can focus more narrowly on areas of concern such as accounts payable. To discourage fraud, let employees know that unannounced audits are possible at any time, but don't let them know what data or records the auditors will review.

Training staff

To ensure internal controls are effective, make fraud education a priority. Clearly communicate to attorneys and staff what constitutes illegal and unethical behavior, and then explain how employees can help prevent and deter fraud by adhering to your firm's internal controls. Also specify the consequences of breaking the rules. For example, an employee who falsifies timesheets may be terminated on the spot.

Partners and managers should receive training in spotting potential perpetrators and suspicious behavior. People who commit occupational fraud often live beyond their means, are heavily in debt, or have gambling or substance abuse problems.

They may exhibit:

• Control issues, such as an unwillingness to share duties, files or billing records,
• Irritability or defensiveness when confronted about irregularities,
• A reluctance to take vacation or sick days, and
• Unusually close associations with vendors.

To ensure members of your firm speak up about suspicious activity, provide reporting guidelines and a process for investigating such suspicions.

Not optional

No matter how convinced you are of the integrity of your attorneys and staff, internal controls are a must for every law firm. By conducting a risk assessment, creating policies and procedures to address such risks, and enforcing the rules, you can prevent significant financial losses and public embarrassment.