By Carolyn Beal, Legal Compliance Consultant, Beal Cooper Compliance Ltd
There’s something about the end of a calendar year that makes it a good time to carry out a review. That includes compliance.
A focused review will help firms start 2027 with a clearer understanding of risks, controls and priorities.
Here are some practical actions to consider.
1. Update the risk register
A risk register should be a working management tool. It makes life so much easier if and when a risk materialises, providing a framework for response.
Look at regulatory, operational, financial and technological risks, as well as risks arising from particular work types or clients. What has changed within the firm this year? What about the regulatory changes on the horizon? Are there any wider economic risks to consider? How will these affect the firm and how can you plan for, and mitigate, the impact?
2. Review money laundering and all economic crime requirements
For firms undertaking work within scope of the Money Laundering Regulations, there has been significant change in this area during 2026, including an updated SRA sectoral risk assessment in September. Firms must make sure the changes are considered and recorded within the AML firm wide risk assessment, policies and procedures.
Are client and matter risk assessments relevant, rather than treated as a quick tick-box exercise? Check that the reasons for decisions in risk assessments are properly evidenced.
Firms should also consider whether they have implemented any recommendations from a recent independent Regulation 21 anti-money laundering audit.
All firms must consider their sanctions compliance and other non-AML economic crime provisions such as prevention of the facilitation of tax evasion. They are often forgotten. Do you have the procedures you need, and are they effective?
3. Carry out a ‘focused’ file review
Pick a few high risk areas and review files based on those. Risks could include delay, inactivity, client identity checks or keeping clear records of advice. Consider areas where there have been themes in complaints received. Don’t forget compliance with the Accounts Rules. Financial controls on files should regularly be checked for effectiveness.
4. Put appropriate controls around the use of AI
The use of artificial intelligence within legal services and by clients has increased rapidly. Firms without controls around AI often find that employees are using some sort of AI tool, even if managers believe they aren’t. Without appropriate controls, the firm is at a much higher risk of negligence claims and regulatory action.
The SRA published its Misuse of AI warning notice on 17 August 2026. It highlighted concerns about inaccurate information, false citations and risks to client confidentiality. Using AI does not change the professional standards expected of law firms.
5. Create a compliance plan for 2027
Planning compliance work across the year means it is more likely to happen. No last minute scrabbles before SRA or Lexcel audits, and a reduced risk of other regulatory intervention.
Create a calendar for 2027 and group compliance areas together so that reviews are effective and any changes can be implemented together. Establish how progress will be reviewed. The plan should be proportionate to the size and nature of the firm, but enough to help manage expectations.
A short, structured review before the end of the year can provide managers and COLPs/COFAs with a clear picture of the firm’s position. It can also turn compliance from a collection of policies into something that really supports the firm’s performance and growth.
I work with law firms of all sizes and specialisms to help with their compliance requirements, so please contact me for a discussion if you would like support for your firm.
www.bealcoopercompliance.co.uk