How to Audit Your Firm's Technology Stack

Jul 20

12 min read

A law firm technology audit is a structured review of every system, subscription, device and integration that the firm uses to hold client information, record time, produce documents, communicate and get paid. Most firms have never carried one out. Their technology grew by accretion: a word processor chosen years ago, an accounting package recommended by an accountant, a file-sharing account opened by one fee earner for one client, a messaging application that became the default channel for urgent instructions. Each decision was reasonable when made. Taken together, they form a stack that nobody has examined as a whole.

The consequences are practical rather than abstract. Client confidential information may sit in places the firm cannot list. Subscriptions may be paid for by people who left long ago. Two systems may hold different versions of the same matter record, so that a conflict check, a limitation diary or a trust ledger depends on which one somebody happened to open. A law firm technology audit brings these facts to the surface, tests them against the firm's professional obligations, and produces a short, ranked list of decisions.

This article sets out a method that a managing partner, a practice manager or a sole practitioner can follow without specialist assistance. It is organised as a sequence: define the scope, build an inventory, map the data, assess the stack against professional duties, review security, measure cost and usage, evaluate integration, and then convert findings into a plan. The method is deliberately neutral as to product. It asks what the firm has and whether it is fit for the firm's purpose, not which product the firm ought to buy.

Why a law firm technology audit is a professional obligation as well as good housekeeping

An attorney-at-law owes duties of confidentiality, competence and diligent handling of client money and documents. None of those duties is suspended because the relevant information lives in a cloud account rather than a filing cabinet. A practitioner who cannot say where client files are stored, who can open them, and how they would be recovered after a device failure is not in a strong position if a client, a regulator or a professional indemnity insurer asks the question.

Data protection law adds a further layer in many jurisdictions. Where the firm acts as a controller of personal data, it will ordinarily need to know what personal data it holds, where it is processed, which suppliers act as processors on its behalf, and whether any data leaves the jurisdiction. The UK GDPR is the best-known example of a regime that expects this knowledge as a matter of record, and some other jurisdictions, including in the Caribbean, have enacted or are developing their own data protection legislation. The detail differs; the underlying expectation that the firm can account for its processing does not. Practitioners should consult the data protection law and the regulator applicable in their own jurisdiction.

Competence also has a technological dimension. Professional conduct rules in a number of jurisdictions have been read, or expressly amended, to recognise that an attorney should understand the benefits and risks of the technology used in practice. Whether or not the rules of a given jurisdiction say so in terms, a firm that adopts a tool it does not understand, or retains one that no longer works as intended, is exposed to the criticism that it has not exercised reasonable care.

Defining the scope and appointing an owner

An audit that attempts to cover everything at once usually stalls. Before collecting any information, the firm should settle three matters: what is in scope, who owns the exercise, and what the output is to look like.

Scope

The scope should include four categories. The first is applications, meaning every piece of software the firm uses, whether licensed, subscribed to or free. The second is infrastructure, meaning computers, mobile devices, networks, printers, scanners, servers and storage. The third is services, meaning internet access, telephony, domain names, email hosting and any managed IT support. The fourth is the arrangements around them, meaning contracts, licence terms, renewal dates, user accounts and administrator rights.

Personal devices and personal accounts used for firm business belong within the scope. A fee earner who photographs a document on a private phone, or who forwards a draft to a personal email address to work on it at home, has created a data location the firm must know about.

Ownership and output

One person should own the audit and report to the partners. In a small firm that may be the managing partner; in a larger one, a practice manager or operations lead. The owner needs authority to ask every fee earner and member of staff for information, and to require an honest answer even where the honest answer is that someone has been using an unapproved tool.

The output should be a written report with three components: an inventory, a findings list ranked by risk, and a remediation plan with owners and dates. Decide at the outset that the exercise is about the firm's systems and not about individuals. Staff who fear blame will understate their use of workarounds, and the workarounds are precisely what the audit needs to find.

Building the inventory

The inventory is the foundation. It should record, for each system, enough information to support every later step. The following fields are a sensible minimum.

Name of the system and its supplier, and the contract holder within the firm.
Purpose: the task the system performs and the practice area or function that relies on it.
Users: who has access, at what permission level, and whether any account is shared between individuals.
Data held: categories such as client identity documents, matter files, financial records, employee records, or none of these.
Location of data: the supplier's hosting arrangement where known, and whether any copy is held locally.
Cost: the amount, the billing interval, the renewal date and the notice period for cancellation.
Integrations: other systems it exchanges data with, and the method of exchange.
Backup and export: whether data can be exported in a usable format, and who has tested it.

Sources for the inventory

Do not rely on memory. Compile the list from several independent sources, because each will reveal something the others miss. The firm's bank and card statements show recurring payments to software suppliers, including those paid by individuals and reimbursed through expenses. The accounts payable ledger shows contracted suppliers. Email searches for terms such as subscription, invoice, renewal and welcome often surface forgotten accounts. The administrator consoles of the firm's email and file-storage systems typically list connected applications and the permissions each was granted. Finally, a short questionnaire to every member of staff, asking what they use to do their work, will identify tools that appear in none of the other sources.

The questionnaire should ask in neutral terms and should state plainly that the purpose is to understand how work is actually done. Asking where the fee earner keeps the documents they are currently drafting is more productive than asking whether they use any unauthorised software.

Mapping the data flow of a single matter

An inventory lists systems; it does not show how information moves between them. The most reliable way to see the real stack is to trace one matter from first contact to closure and record every place its information is touched. Choose a typical matter in the firm's main practice area and, if the firm has more than one, repeat the exercise for the second.

Enquiry: where does the first contact arrive, and where is the record of it kept?
Conflict check: against what data is the check performed, and is that data complete?
Engagement: how is the engagement letter prepared, sent, signed and stored?
Client identification: where are identity documents received and held, and for how long?
Work in progress: where are drafts created, versioned and shared with the client or counterparties?
Communication: through which channels does the client instruct the firm, and are those instructions captured on the matter file?
Time and expenses: how is time recorded, and how are disbursements captured and attributed to the matter?
Billing and collection: how are invoices produced, delivered and reconciled to payments?
Client money: how are receipts, holdings and transfers recorded, and by whom?
Closure: how is the file closed, archived, retained and, in due course, destroyed?

At each step, note the system used, the person who operates it, and whether information is re-keyed by hand from one system to another. Manual re-keying is both an efficiency cost and a source of error. The map frequently reveals points at which the same information is entered twice, and points at which the only record is an email thread or a message in a chat application.

Assessing the stack against professional duties

With the inventory and the data map in hand, the firm can test the stack against the obligations that matter most. A simple matrix helps: list the duties down one side and the systems across the top, and mark where a system supports, undermines or is irrelevant to each duty.

Duty or requirement	Question for the audit	Typical warning sign
Confidentiality	Can only authorised persons reach each matter's information?	Shared logins; folders open to the whole firm by default
Competence and supervision	Can a supervising attorney see the state of a matter without asking?	Status held in individual inboxes
Client money and records	Is there a complete, contemporaneous record of receipts and payments per client?	Client funds tracked in a general spreadsheet
Limitation and deadline control	Is there a single, reliable diary that nobody maintains privately?	Personal calendars as the only reminder
Conflict checking	Does the search cover all current and former clients and related parties?	Client lists split across several systems
Retention and destruction	Can the firm identify and securely remove files due for disposal?	No retention date recorded at closure
Data protection	Can the firm list processors and locations of personal data?	Unknown or undocumented suppliers
Business continuity	Can the firm operate within a short time after losing a device or a site?	Critical data on a single machine

The rules governing client money and records differ materially between jurisdictions. Some regulators prescribe the form of the accounts and the frequency of reconciliation; others leave more to the firm. The audit should record what the firm's own regulator requires and check whether the existing system can produce it on demand. Where the firm discovers that it cannot, that finding belongs at the top of the report.

Reviewing security and access

Security review is the part of a law firm technology audit that most often causes anxiety, and most often yields quick, inexpensive improvements. The questions are largely organisational rather than technical.

Identity and access

Check that every user has an individual account, that departed staff have been removed, and that administrator rights are held by as few people as practicable. Check whether multi-factor authentication is enabled on email, document storage, the practice management system and any banking or payment portal. Email is the most consequential single point of failure: control of a fee earner's mailbox allows an attacker to reset passwords elsewhere and to impersonate the firm in correspondence about payment instructions.

Review the permission structure within the main systems. A well-organised firm restricts access to sensitive matters, such as those involving a senior client or a conflict wall, and can show who has opened a file. A firm in which every user can see every matter should treat that as a finding even if no misuse has occurred.

Devices and networks

Establish which devices are used for firm work, whether they are encrypted, whether they receive security updates, and whether the firm can lock or wipe a lost device. Review the office network: whether the router has had its default credentials changed, whether visitors share the same network as staff, and who has the ability to change the configuration.

Suppliers

For each supplier that holds client data, ask what the firm has actually verified. Practitioners should read the supplier's terms on data location, sub-processors, breach notification, data return on termination, and liability. Do not accept a supplier's general assurances about security as a substitute for reading the contract. Where a supplier states that it holds an independent certification, ask for the evidence and note its scope; where it states nothing, record that as an open question rather than as a defect.

Backup and recovery

A backup that has never been restored is an assumption. For each critical system, record how data is backed up, where the copy is held, and when a restoration was last tested. Ask also how long it would take to resume work if the firm's main system were unavailable for a day, a week, or permanently. The answers shape the continuity plan.

Measuring cost, usage and overlap

A financial review often justifies the audit on its own. Total the annual cost of every system, including those paid by individuals and those bundled within other contracts. Then compare cost with usage.

The cost review should look for four patterns. The first is dormant licences, where the firm pays for users who have left or who never log in. The second is functional overlap, where two or more systems perform the same task, such as separate tools for document signature, client portals and file sharing. The third is feature shortfall, where the firm pays for a system but works around it because a needed function is absent. The fourth is pricing structure: a per-user model grows in direct proportion to headcount, so that adding a paralegal, a secretary or a part-time associate raises the bill each time, whereas a per-firm model with unlimited users changes the arithmetic of staffing decisions.

The following is illustrative arithmetic only and not market data. Suppose a firm pays a monthly fee per user for three separate subscriptions, each used by the same eight people, at fees of 10, 15 and 20 currency units per user per month. The combined monthly cost is 8 multiplied by 45, which is 360 currency units, or 4,320 over twelve months. If one of the three is a duplicate of another and can be retired, the saving is the fee of the retired subscription across all eight users. The point of the exercise is the method: multiply by users, multiply by months, and compare against the value of the function actually used.

Usage data should be gathered from administrator consoles where available. If no usage data exists, ask the users. A system that nobody can explain is a candidate for retirement, subject to confirming that it does not hold data the firm must retain.

Evaluating integration and data quality

Return to the data map and examine the seams between systems. Every manual transfer is a risk to accuracy and a drain on fee earner time. Every export and import through a spreadsheet creates an uncontrolled copy of client data. Ask of each seam whether it can be eliminated by consolidating onto one system, automated through a supported integration, or at least controlled by a documented procedure.

Data quality deserves a separate check. Sample a number of matters across the firm and compare the records held in different places. Are client names and contact details consistent? Are matter numbers used uniformly across billing, documents and email? Is the status of each matter recorded in a place that a supervising attorney can find? Inconsistent records undermine conflict checks, reporting and billing, and no feature of any product will cure them unless the firm first agrees a standard for how matters and clients are named and numbered.

Lock-in and exit

For every significant system, ask what happens if the firm wishes to leave. Can all data, including documents, notes, time entries and audit history, be exported in an open or widely readable format? Is there a charge for doing so? Does the contract oblige the supplier to return or delete data at termination, and in what period? A system that holds the firm's records but offers no practical means of removing them is a dependency and should be recorded as such.

Prioritising findings and building the remediation plan

An audit that produces forty undifferentiated findings will not be acted upon. Classify each finding by two measures: the severity of the consequence if the risk materialises, and the effort required to address it. Then sort the findings into three groups.

Immediate: findings that expose client confidentiality, client money or limitation control, and findings that cost little to fix, such as removing departed users and enabling multi-factor authentication.
Planned: findings that require a decision and a budget, such as consolidating overlapping systems, adopting a single matter record, or replacing an unsupported platform.
Monitored: findings that carry low risk and low cost and can be revisited at the next review.

For each item in the plan, record an owner, a completion date and the evidence that will show the work is done. Present the plan to the partners with a short summary of what the audit found, what it recommends, and what it will cost. Partners are far more likely to approve a modest number of well-argued actions than a comprehensive programme.

Selecting replacements

Where the audit concludes that a system should be replaced, draw up requirements from the data map rather than from supplier brochures. List the functions the firm uses daily, the functions it needs but lacks, and the constraints it must respect, including data location, export capability, user numbers and budget. Trial a candidate system with a real, closed matter before committing. Plan the migration as a project in its own right, with a cut-off date, a reconciliation of migrated records and a period during which the old system remains available for reference.

Practical next steps

A firm that wishes to begin a law firm technology audit this quarter can proceed in the following order.

Appoint an owner and set a four to six week timetable, with a clear statement to staff that the purpose is improvement and not blame.
Compile the inventory from bank statements, the payables ledger, administrator consoles and a staff questionnaire.
Trace one live matter through every step of its lifecycle and record each system and manual hand-off.
Complete the duties matrix and flag any duty that no system reliably supports.
Carry out the quick security measures at once: individual accounts, removal of former users, multi-factor authentication on email and storage, and a test restoration of one critical backup.
Total the annual cost, identify dormant and overlapping subscriptions, and note the renewal and notice dates so that cancellation is not missed.
Write the findings report, rank the items, and obtain partner approval for a dated plan.
Diarise a lighter review every twelve months, and a targeted review whenever the firm adds a practice area, a new office or a significant supplier.

How practice management software supports the audit

The audit will usually show that a firm's difficulties arise from information being scattered across many tools. A single practice management platform that brings matters, clients, documents, contract records, e-signature, a client portal and billing into one record reduces the number of seams to examine and the number of suppliers to supervise. Legalytech is one such platform, offered to firms at a single price with unlimited users, which removes the incentive to ration access and so makes it easier to give every member of the team an individual, accountable account.

This article is provided for general information only and does not constitute legal advice. Practitioners should consult the rules of their own jurisdiction and regulator.