You must have an Outsourcing Policy not just for legal activities but for any operational functions that are critical to the delivery of any legal activities e.g. IT, HR, Accounting, Marketing, etc. Even if your practice doesn’t outsource anything, you still need a policy stating that you don’t outsource. There is also an obvious operational risk in ensuring any outsourced work is of sufficient quality so your firm’s reputation isn’t damaged.

So, if you outsource, as a minimum your policy needs to cover:

Outcomes 4.1 and 4.5 together with IB 4.3 SRA Code of Conduct – client confidentiality:

All members of the Firm, including support staff, consultants, suppliers and temporary workers, owe a duty of confidentiality to your clients. This extends to outsourcing arrangements, so you must be able to demonstrate how you are satisfied that outsourcing Suppliers take all appropriate steps to ensure client confidentiality and that you have effective systems and controls in place to enable you to identify risks to client confidentiality and to mitigate those risks.

utcome 7.10 SRA Code of Conduct – outcomes a Firm needs to achieve if it outsources operational functions.

So, if you outsource, as a minimum your policy needs to cover:

• The procedure for completing new outsourcing agreements.
• Details of outsourced activities.
• Methods of monitoring the impact and risk of outsourcing in any particular operational function.
• A due diligence approval process for potential companies you outsource to.
• Provision for a Confidentiality Agreement signed by the Supplier accepting work from the firm.
• Accountability procedures to manage outsourced functions including supervision & review – a minimum annual review verifying Supplier compliance.
• Supplier consent to an SRA visit with access to documentation for the outsourced activities for you & your clients, including computer records.
• The person responsible for the policy within your firm.

Need more information, we regularly help with compliance issues like these – please get in touch.