How to Conduct a File Audit in Your Own Firm

Sep 2

12 min read

A law firm file audit is a structured review of a sample of the firm's matter files against a defined standard, carried out by someone other than the fee earner who handled the matter. Its purpose is to discover, before a client, a regulator or an insurer does, whether the firm's files show that work was properly authorised, competently performed, correctly recorded and lawfully closed. It is among the most economical forms of risk management available to a practice, because it uses the firm's own records, requires no external expertise beyond the discipline to do it, and reveals weaknesses while they can still be corrected.

Many firms assume that supervision of the day-to-day work makes an audit unnecessary. Supervision and audit are different. Supervision examines the matter as it proceeds and is directed at the outcome for the client. An audit examines the record after the event and is directed at whether the firm's systems are working. A supervising attorney-at-law may be fully satisfied with the substance of a file and yet fail to notice that the engagement letter was never signed, that the conflict check was not recorded, or that a client identification document is missing. A file audit looks for exactly those gaps.

This article explains how to plan and carry out a file audit in a small or medium firm. It addresses the objectives, the selection of files, the design of a checklist, the conduct of the review, the treatment of findings, the correction of defects and the means of ensuring that the audit leads to improvement. The standards against which files are measured depend on the rules of the practitioner's jurisdiction, the requirements of the firm's professional indemnity insurer and any applicable anti-money-laundering and data protection obligations, and so each firm must tailor the checklist accordingly.

Why a law firm file audit is worth the effort

The justification rests on four considerations. The first is professional risk. Most negligence claims and regulatory complaints can be traced to a small number of failures: missed deadlines, inadequate advice on scope, poor communication, mishandled money and absent records. A file audit tests the controls designed to prevent those failures. The second is regulatory expectation. Regulators in many jurisdictions expect a firm to be able to demonstrate that it supervises its work and maintains proper records, and some require periodic reviews. An audit supplies evidence that the firm does so. The third is insurance. Insurers commonly ask about a firm's risk management, and a documented audit programme supports renewal. The fourth is commercial. Files that are well organised are cheaper to work on, easier to bill from, easier to hand over and more valuable if the practice is sold.

There is also a cultural benefit. A firm that audits its files regularly signals that records matter, and fee earners adjust their habits accordingly, usually before the auditor arrives. The audit then becomes less an inspection than a routine check on standards everyone understands.

Deciding the objectives and scope

Before selecting any file, the firm should decide what the audit is intended to establish. Common objectives include confirming compliance with client care and engagement requirements, testing client money handling, checking client identification and conflict procedures, assessing the quality of supervision, verifying that deadlines are diarised and met, and checking that files are closed and retained correctly. A single audit may cover all of these, but for a first exercise it is often wiser to concentrate on a limited set of high-risk questions and do them well.

The firm should also decide who will conduct the audit. The ideal reviewer is independent of the matter, senior enough to command respect, and familiar with the standards. In a firm with several partners, partners can review one another's files, and no one should audit their own. A sole practitioner has no colleague to turn to and may arrange a reciprocal review with a trusted practitioner in another firm, taking care that client confidentiality is protected, for example by agreeing the arrangement in advance with clients where necessary, by anonymising material or by limiting the review to the administrative features of the file and not its substance. Alternatively, a sole practitioner can conduct a self-audit using a strict checklist and a pause between preparation and review, accepting that it is less rigorous than an independent one.

Selecting the sample

Sample size and method

The sample must be large enough to reveal patterns but small enough to be reviewed in the time available. There is no universal figure, and the firm should choose a sample proportionate to its size and the number of fee earners, ensuring that every fee earner and every principal practice area is represented. A sole practitioner might review a handful of files; a firm of several fee earners might review a few from each. The firm should record how it selected the sample so that the process can be repeated.

Random selection avoids the criticism that files were chosen to show the firm in a good light. A common method is to take a list of all matters opened or closed within a period, number them, and select at intervals. Purely random selection can miss risks, so many firms use a stratified approach: a random element, together with files chosen deliberately because they carry heightened risk.

Risk-based selection

The deliberately chosen files should reflect the firm's own risk profile. The following categories are commonly included.

Matters in which client money has been held or moved.
Matters involving high-value transactions or clients who present elevated money-laundering risk.
Contentious matters with approaching or recent limitation or procedural deadlines.
Matters handled by newly qualified or recently joined fee earners.
Matters that have been dormant for an extended period.
Matters that gave rise to a complaint, a fee dispute or a near miss.
Files closed recently, to test closure and retention procedures.

The audit should state how many files came from each category, so that findings can be read in context. A high rate of defects in the files selected for risk should be treated differently from a high rate in the random files.

Designing the audit checklist

The checklist converts the firm's standards into questions with clear answers. Each question should be capable of a yes, no or not applicable response, and should refer to evidence that the reviewer can find on the file. Vague questions, such as "was the file well managed?", produce subjective results and should be avoided. The checklist should be short enough to complete in a reasonable time but comprehensive enough to cover the firm's principal risks. It should be reviewed whenever the rules change.

The table below sets out the headings under which a firm might organise its checklist, with examples of questions. The content must be adapted to local requirements.

Area	Example questions
Opening and authority	Is there a signed engagement letter or equivalent record of terms? Does it state scope, fee basis and responsible persons? Is the client correctly identified?
Conflicts and identification	Is the conflict check recorded and dated before work began? Are client identification documents on file and in date? Is the source of funds recorded where required?
Supervision and competence	Is the responsible attorney-at-law named? Is there evidence of review of key documents and advice? Was the work within the fee earner's competence?
Communication and advice	Is advice confirmed in writing? Are client instructions recorded? Is correspondence up to date and are enquiries answered?
Deadlines and diary	Are limitation and procedural dates diarised, with a second check? Were any missed or extended, and was the reason recorded?
Client money and billing	Do ledger entries reconcile with supporting documents? Was money received and applied correctly and promptly? Do bills match the agreed basis, and were costs updates given?
File organisation	Are documents filed in a logical structure? Are drafts distinguishable from final versions? Is there a clear file note of key decisions?
Closure and retention	Was a closing letter sent? Are original documents returned or recorded? Is the retention period noted? Is the file marked for review or destruction?

The firm may add a short section on data protection, for example whether personal data is held only where necessary and whether the file contains material that should have been deleted. It should also include space for the reviewer's comments, since a numerical score alone does not capture the reasons for a defect.

Preparing for the review

Preparation determines whether the audit is accepted or resented. The partners should announce the audit in advance, explain its purpose as the testing of systems and not the blaming of individuals, and set out the timetable and standards. Fee earners should be told which categories of file may be selected, but not necessarily which individual files, to avoid last-minute tidying that defeats the purpose. The reviewer should understand the firm's procedures and the applicable rules, and should allocate sufficient uninterrupted time for the work, since a rushed audit is unlikely to be reliable.

Practical arrangements are needed for access. Electronic files should be available through the firm's system with appropriate permissions; paper files should be collected in a secure location. The reviewer must treat everything seen as confidential, and any file that is subject to particular sensitivity, such as one involving a close relation of the reviewer, should be reallocated. The firm should also decide where the findings will be recorded and who will have access to them, since a candid report on defects is itself a sensitive document.

Conducting the review

Work through the checklist file by file

The reviewer should take each file in turn, apply the checklist methodically, and record the evidence for each answer. Where an item is missing, the reviewer should distinguish between a document that was never created, one that was created but not filed, and one that is in the file but defective, for example unsigned or undated. The distinction matters, because the corrective action differs. Time should be given to the substance of the file, but the discipline of the audit is that the reviewer does not re-run the matter; the question is whether the file demonstrates that proper steps were taken.

Record observations neutrally and precisely

Observations should be factual. "The engagement letter is unsigned and no acceptance email appears on the file" is useful; "careless record keeping" is not. The reviewer should note good practice as well as defects, since the firm can use positive examples as models and fee earners will see the exercise as balanced. Where the reviewer identifies an issue that may affect the client immediately, such as a deadline that appears to have passed, a client money discrepancy or a probable conflict, it should be escalated to a partner at once, not held for the end of the exercise.

Interview where necessary

Some questions cannot be answered from the file alone. A brief, courteous conversation with the fee earner may reveal that a conversation took place but was not recorded, or that a document exists elsewhere. The reviewer should not accept oral explanations as a substitute for a record, but should note them and require the file to be corrected. The aim is to establish whether the underlying work was done and what needs to be recorded, and to identify any systemic reason why the record was not made.

Scoring and classifying findings

A consistent scale allows the firm to compare results over time and to focus on what matters most. Many firms classify each defect by severity. A critical defect is one that creates immediate risk to a client or to the firm, such as a missed limitation period, a client money shortfall, a conflict that was not identified or an absence of client identification where the law requires it. A significant defect is one that departs from a mandatory firm or regulatory standard but is not immediately harmful, such as an unsigned engagement letter or a missing file note of advice. A minor defect is one of housekeeping, such as unclear naming of documents.

The following arithmetic is illustrative only and is not market data. Suppose a firm reviews twenty files against a checklist of ten questions, producing two hundred possible answers. If the reviewer records fourteen defects, the firm can state that seven per cent of the answers were defects. The figure by itself is of limited use. It becomes useful when broken down by question, by fee earner, by practice area and by severity, and when compared with the figure from the next audit. The method, and not the number, is what the firm should carry forward.

The firm should resist the temptation to rank fee earners by score. A league table encourages concealment. The better use of results is to identify patterns: if the same defect appears across many files and fee earners, the cause is probably a weak process, an unclear instruction or a missing template, rather than individual carelessness.

Reporting and acting on the findings

The audit report

The report should be brief and structured: the objectives and scope, the method and sample, a summary of results by area and severity, the principal findings, examples of good practice, and recommended actions with owners and dates. It should be presented to the partners and discussed with the team. Where findings concern an individual, they should be shared privately before any group discussion. The report should be retained as evidence of the firm's risk management.

Correct the files

Defects on individual files should be corrected where possible. A missing conflict check can be conducted now and recorded with the correct date and an explanation, never backdated. An unsigned engagement letter can be sent for signature with a covering explanation. Missing file notes can be written up and dated as late entries. Where a defect has potential consequences for a client, such as a missed step, the firm must consider its professional duties to inform the client, to notify its insurer where required and to seek advice. The reviewer and the partners should not hesitate over this. Early disclosure and remedy nearly always leave the firm in a better position than concealment.

Correct the system

Correcting files addresses past errors; correcting the system prevents future ones. For each recurring defect, the firm should ask why it occurred. If engagement letters are unsigned because there is no process to follow up, the remedy is a follow-up task generated when the letter is sent. If client identification is missing because the requirement was not clear, the remedy is a clearer procedure and a mandatory checklist at opening. If file notes are absent because fee earners do not know what is expected, the remedy is a short standard and an example. Remedial actions should be recorded in an action log, allocated to a named person, given a deadline and reviewed.

Frequency, follow-up and continuous improvement

A single audit gives a snapshot. The value accumulates when audits are repeated at regular intervals. Many firms review a sample annually, with more frequent targeted reviews of high-risk categories. A new fee earner's files might be reviewed more closely during the first months. Following a significant change, such as the introduction of a new system or a change in the rules, a short follow-up review is sensible.

The follow-up should test whether the corrective actions have worked. If the same defect recurs after a procedural change, the change was inadequate. The firm should compare successive results, report improvement to the team and celebrate progress. Over time the audit can be integrated with other controls, such as monthly supervision meetings, the annual review of templates, and training sessions informed by the audit findings.

Common pitfalls

Auditing only files that the fee earners themselves choose to present.
Using a checklist so long that the reviewer cannot complete it with care.
Failing to define the standard in advance, so that fee earners learn of the requirement only when they fail it.
Treating the audit as a disciplinary exercise, which discourages candour.
Backdating or altering records to cure defects, which converts an administrative lapse into a more serious matter.
Producing a report that is filed without any action being taken.
Neglecting to consider the effect of findings on clients who may need to be informed.
Allowing the audit to lapse after the first cycle.

Particular considerations for sole practitioners and small firms

Independence is the principal challenge. A sole practitioner who reviews personal files tends to excuse omissions as obvious oversights. Techniques that help include allowing a few weeks between the close of a matter and its review, using a rigid written checklist, and asking a trusted colleague in another firm to review a sample on a reciprocal basis, with attention to confidentiality. A small firm with one or two partners can allocate review responsibilities so that each reviews the other's files, supplemented by the practice manager's review of administrative items.

In a small firm, proportion matters. The audit need not be elaborate, but it must be real. A short checklist applied consistently to a modest sample, with results recorded and acted on, is far more valuable than an ambitious scheme that is abandoned. The firm should also take care that the audit process itself complies with data protection obligations, limiting access to what is needed and securing the audit record.

Practical next steps

State the objectives of the first audit and limit them to a small number of high-risk questions.
Nominate a reviewer who is independent of the files to be examined, or arrange a reciprocal review.
Decide the sample size and a selection method combining random and risk-based files, and record it.
Draft a checklist of yes or no questions drawn from your regulator's rules, your insurer's requirements and the firm's own procedures.
Brief the team on the purpose and timetable of the audit, emphasising that it tests systems.
Conduct the review, recording evidence and escalating any urgent client risk immediately.
Classify findings by severity and analyse them by question, practice area and file, not by league table.
Correct defective files honestly, without backdating, and consider whether any client or the insurer must be informed.
Record system improvements in an action log with owners and deadlines, and review them within a set period.
Schedule the next audit and compare its results with this one.

How practice management software supports the process

A file audit is considerably easier when matters are opened with mandatory fields, documents are stored in a consistent structure, deadlines are held in a shared diary and signed engagement letters are filed automatically. Legalytech provides a cloud practice management platform for solo and small firms that keeps matters, documents, tasks, signatures and billing in one place, which allows a reviewer to examine a file's record without searching across email and personal folders.

This article is provided for general information only and does not constitute legal advice. Practitioners should consult the rules of their own jurisdiction and regulator.