Legal and professional services

PRACTICAL GUIDANCE

The starting point

Make client work consistent, secure and traceable from acceptance to closure. Focus the audit on the firm’s actual service model, professional obligations and information flows, with a clear boundary between process assurance and legal or professional judgement.

Priorities to examine

• Clients want confidence in information security, service continuity and supplier oversight.
• Work passes between partners, employees, consultants and outsourced providers.
• Repeated service complaints or missed handovers indicate weaknesses in delivery controls.
• New technology, remote working or AI tools change how confidential information is used.

Standards to investigate

Evidence to consider

• Client acceptance, engagement and scope-change processes, using redacted examples.
• File review, supervision and competence records for the work in scope.
• Information classification, access control and secure-sharing arrangements.
• Cloud, outsourced-service and other critical-supplier assessments.
• Complaints, incidents, continuity exercises and resulting corrective actions.
• Retention decisions, processing records and evidence of privacy responsibilities.

Questions for your scope

• Which legal entities, practice areas and locations belong within the proposed scope?
• What assurance do clients request, and is the wording specific to ISO, Lexcel or another scheme?
• How will confidentiality and any privilege concerns be addressed before evidence is reviewed?
• Who approves technology and AI uses that may affect client information?
• Can the firm demonstrate that supervision and review happen in practice rather than only in its manual?

Related guidance and practical next steps