The Risks Hiding in Plain Sight
20 October 2026

Risk does not always arrive as a major incident. More often, it starts with something small. A deadline is missed. A task is left incomplete. A client update is not recorded, or an important piece of information sits somewhere that nobody else can see.

On its own, any one of these things may seem minor. Across hundreds or thousands of matters, however, small gaps become much harder to spot and can quickly develop into something more serious.

Risk often sits in the gap between the process a firm believes it has and what is actually happening in practice.

Most law firms have policies, procedures and experienced people who know how matters should be handled. The challenge is not always knowing what should happen. It is being able to see whether it is happening consistently across the firm.

Legal work will always require judgement. People adapt to the circumstances of an individual matter and make decisions based on their experience. That flexibility is important, but it can also mean that the same process is followed differently depending on who is dealing with the work.

A process can look perfectly sound on paper while steps are being missed, changed or worked around in practice. Without a clear view across matters, those differences may remain hidden until a client complains, a deadline is missed or somebody has to investigate what went wrong.

Technology should make it easier to manage risk, but having more systems does not automatically give a firm more control. A key date may sit in somebody’s personal diary, a client update may be held in an email inbox, and the latest task list may be maintained on a separate spreadsheet.

Each system or workaround may make sense on its own. The problem comes when nobody has a complete view of the matter, or when managers have to search across several places to understand what is happening.

This visibility matters long before a complaint, claim or regulatory issue arises. It affects client service, supervision and the firm’s ability to establish what happened, when it happened and who was responsible for the next step.

  • Which matters have important dates approaching?
  • Which required steps are overdue or have been missed?
  • Who is responsible for the next action on each matter?
  • Could another member of the team understand the position quickly if they had to take over?
  • Are the same issues appearing across several matters or teams?

If the answers rely on asking the right person, checking several systems or waiting for a problem to be reported, the firm may have a visibility gap.

Clear workflows can show people what needs to happen and when. Automated tasks and reminders can reduce the reliance on memory. Keeping matter information together makes it easier for everyone involved to find what they need, while a clear audit trail records what has happened.

Reporting can also help managers look beyond individual files. It can show where work is building up, where steps are regularly being delayed and whether the same problems are appearing across the firm. That gives people an opportunity to intervene before a small issue becomes a larger one.

AI may help teams find, review and summarise information more quickly. It should still sit within controlled processes, with appropriate permissions, clear records and human review. Used carefully, it can help people make better use of the information already available to them without replacing professional judgement.

“Risk often sits in the gap between the process a firm believes it has and what is actually happening in practice. Good technology should make those gaps visible early enough for someone to act. It should give people the information they need to make better decisions, without adding unnecessary complexity.”

Technology can support good risk management, but it cannot replace the people responsible for managing matters. It also cannot correct a process that is unclear or make poor information reliable.

People need to understand what is expected of them. Processes need to reflect how the firm actually works. Technology then needs to make those processes easier to follow and give the right people a clear view of progress.

No law firm can eliminate every risk. Matters change, clients change their instructions and people sometimes make mistakes. What a firm can do is make sure potential problems do not remain hidden until it is too late to deal with them properly.

Good risk management depends on more than having the right policies and processes in place. Firms also need to see whether those processes are working, where they are not and when somebody needs to act.