Is your management in control of the knowledge relating to the risk areas in your firm? And is it taking effective steps to manage those risks? Given recent events in the professional world, the answer for many firms is likely to be no.
I am speaking of knowledge and risk in the widest possible context. Knowledge in the sense of the sum of what is known about every aspect of a firm's business rather than the usual narrow use of the term 'knowledge management'. Risk as referring to all the major risks impacting on a firm, as opposed to just the risks associated with negligent advice, which is where most emphasis tends to be.
There are numerous areas of risk and all are dependent on managing the knowledge in your business, but a large area of risk is probably management, or rather management's failure to get to grips with knowing where their risks lie and then taking further steps to manage them.
Has your management put in place an integrated knowledge/risk management strategy to identify where the relevant knowledge resides and then taken steps to access/capture/maintain/upgrade that knowledge to manage the risks associated with it?
Failure to manage just one small area of risk in part of the organisation can have widespread implications on a firm's reputation. Knowledge and risk management are large issues which, if they are to be brought under control, require a great deal of management time and effort over long periods.
There is one area of a law firm that potentially poses the greatest risk – people. A firm is nothing without its people and people risks can touch every area of a business – client relationships, loss of staff and reputation to name but a few. How well do you know your people? Do you have in place effective vetting procedures? How tightly are your people, even your partners, supervised?
People risks can often be greater in satellite offices, whether domestic or foreign. Do you know everything about your satellite offices and what is going on in them? Are you really in control of them and everything that relates to them? I very much doubt it.
As law firms open more offices overseas, a growing burden and strain is put on management to fully understand and appreciate every area of risk in relation to those offices, and then to put in place an effective strategy to manage those risks. Inevitably, there will be greater risks with those offices because management, notwithstanding local delegation, will not have the in-depth knowledge to identify and take effective measures to prevent disasters occurring.
I was recently taken to task at a conference at which I spoke when I put forward this view. It was argued that firms have greatly improved their local management and so risk is not really any greater issue in such offices than at home. I would argue to the contrary, that even greater effort needs to be made in such offices because that is where recent experience has shown the incidence of risk can be greatest.
If you look at the problems which have brought down some well-known organisations in the recent past, they have often been caused by management's failure to know what was happening in the business, particularly as to what certain people in risk-prone positions were doing. These risks can be better managed if an integrated knowledge/risk management strategy is adopted and implemented throughout an organisation, through formal processes of diagnosis, mitigation, monitoring and limitation of risks, which introduces a structured approach focusing on key issues.
So where do you think the major risks to your organisation lie? Often the answer is in the most unlikely of places, but because every risk area can be inter-dependent with every other risk, the knock-on effect can have serious and wide-ranging consequences throughout a firm.
Firms must begin to manage the risks inherent in their business by ascertaining where knowledge is held in the firm in relation to every key area of operation. If you do not possess that knowledge then it is incumbent on you to do something about it. You will fail to do so at your own risk.