Closed Consultation

19. We regulate in the public interest: to protect the users of legal services, and to uphold the rule of law and administration of justice.
20. Through the SRA Principles and Codes of Conduct, we set out what our regulation stands for and what a competent, ethical legal profession looks like. The public and the profession have a right to expect that conduct or behaviour that falls below those standards will be met by robust and proportionate enforcement action.
21. We place an obligation on those we regulate to report wrongdoing either by themselves or others. In our new Codes of Conduct, we have described this as a "serious breach" of our regulatory arrangements – our regulatory rules, standards and requirements.
22. This reporting obligation is critically important in a profession founded on trust and integrity; for the development of personal accountability for shared values, and a culture of openness which allows for learning from mistakes. It is also important to ensure effective regulation, enabling us to have timely receipt of potential risks and issues and to identify whether any action may be necessary to protect the public interest.
23. Further, our new draft Enforcement Strategy¹ sets out the importance of solicitors and firms engaging constructively with us. It also makes clear that timely reporting is likely to influence our decision about the risks and issues and what action to take. This is because it can show that the firm has insight into any failings and gives us confidence that the firm has an ethical culture and the ability to manage risk appropriately.
24. Firms that we regulate will have in place approved compliance officers with express responsibility for reporting serious breaches to us (a COLP, or compliance officer for legal practice, and COFA, or compliance officer for finance and administration, with specific responsibility for our accounting requirements).
25. This obligation sits side by side with the parallel reporting obligation on solicitors and firms referred to above. However, as stated in our new Code of Conduct for solicitors, solicitors will satisfy their individual obligations if they report matters to their firm’s compliance officer on the understanding they will do so.
26. We therefore consider it to be of critical importance that firms and those leading and managing firms provide their compliance officers with the support and freedom they need to exercise their independent judgment about what and when to report. We recognise that this may require compliance officers in some circumstances to conduct an internal investigation (either before or continuing after reporting matters to us). We discuss this further below.
27. Our new code for firms underpins the importance of compliance officers being given this support by requiring firms to have effective governance structures, arrangements, systems and controls in place to ensure their compliance officers are able to discharge their duties.²
28. The question of what kinds of issues are reportable (and more specifically, what is a "serious" breach) is set out in our Enforcement Strategy and underpinning guidance, which we consulted on as part of Phase 2 of our Looking to the Future reform programme. This consultation does not revisit that issue - it is focused on the tricky practical judgments that face compliance officers, solicitors and firms about what evidence or information is sufficient for them to report a matter that does – or might - reach that threshold.
29. We want to ensure that our obligations are clear, certain and operate effectively to protect the public, whilst allowing firms to investigate and resolve concerns locally where appropriate. We believe that our current rules are open to interpretation and further clarity may help those who are involved in making these difficult judgments often in sensitive situations.

Our current reporting obligation

30. The reporting obligation in the SRA Code of Conduct 2011 is as follows:

    Outcome 10.3 you notify the SRA promptly of any material changes to relevant information about you including serious financial difficulty, action taken against you by another regulator and serious failure to comply with or achieve the Principles, rules, outcomes and other requirements of the Handbook.

    Outcome 10.4 you report to the SRA promptly serious misconduct by any person or firm authorised by the SRA, or any employee, manager or owner of any such firm (taking into account, where necessary, your duty of confidentiality to your client).

31. The new Codes of conduct, which we consulted on at the end of last year, include revised reporting obligations as follows:

    Code of Conduct for Firms – Co-operation and information requirements (3.9) SRA Code of Conduct for Solicitors, RELs and RFLs (7.7)

    You ensure that a prompt report is made to the SRA, or another approved regulator, as appropriate, of any serious breach of their regulatory arrangements by any person regulated by them (including you) of which you are aware. If requested to do so by the SRA, you investigate whether there have been any serious breaches that should be reported to the SRA.

32. It has become clear to us that the duty to report is being construed in different ways – so we are concerned that it is insufficiently clear. We know that it is interpreted by some as an obligation that only arises if they decide that regulatory misconduct has been conclusively determined. Some firms, including some large firms where there are dedicated compliance lawyers, suggest that the obligation to report is one that only arises when any misconduct or breach has been investigated internally and proven to their satisfaction. To do otherwise, it is argued, is to act on mere rumour or suspicion.
33. Others believe that the obligation is triggered earlier, where there is sufficient information to suggest that a serious breach may have occurred. However, we believe there are a variety of views about what this means in practice with many compliance officers taking a risk-based approach in each case depending on the severity of the issue. This leaves them open to the risk of criticism and challenge, either for failing to meet their regulatory obligations to us, or their responsibilities to the subject of the report, for example under employment or privacy/information law

34. The reporting obligation is one which inherently requires the exercise of judgment. This touches on two separate areas.
35. Firstly, on what type of concern or problem is reportable. As stated above, we will not expect a concern to be reported to us if it does not or could not amount to a serious breach of our regulatory arrangements: namely that it is capable if proved of amounting to a serious breach. In reaching this decision, those we regulate should take into account our Enforcement Strategy and other guidance and case studies which help to explain our approach to assessing whether certain types of conduct and behaviour are "serious".

Example 1: non-reportable event

The head of finance in a firm brings to the COFA's attention that, for a period of three months, a series of payments to settle counsel's fee notes amounting to £32,000 (for which money had been received from the client and held in office account) have not been made.

This happened when the practice was moving to a new computer system and not all of the information was transferred. The computer error has been remedied and plans are in place immediately to pay the barristers, with interest.

Although there has been a breach of rule 17.1(b) of the SRA Accounts Rules 2011, and rule 2.3 of the new SRA Accounts Rules, this will not be reportable. The problem arose solely due to a system error, which was short term and contained, and has been remedied. There is no ongoing harm or risk of repetition.

36. Secondly, a judgment needs to be made about when to report a concern or problem. This consultation is focused on addressing that second question.

When to report a concern or problem

37. It is important for us, as the regulator, to receive information at an early stage. Often we will receive reports from solicitors, clients and the public, with little if any evidence in support. Our job is to investigate those concerns that are capable, if proved, of amounting to a serious breach of our regulatory arrangements.
38. This decision may be informed by information we already hold such as evidence or reports of misconduct that touch on the concerns or are related in some way. We will take witness statements or inspect files and documents, using statutory powers to compel evidence where necessary.
39. We then need to reach an independent decision as to whether there has been a serious breach or misconduct. We have procedures designed to determine the facts (following due process and, sometimes, oral evidence tested at a hearing).
40. Early reporting means we can identify what concerns engage us, to decide how to investigate the issues most effectively. Importantly, we can consider whether it is necessary to take early protective action, such as imposing practice conditions or, in serious cases, using our intervention powers.
41. Therefore, we believe that the key question for those considering making a report to us is whether the alleged facts or matters indicate a serious breach of our regulatory arrangements.
42. That said, it is not in the interests of the public or profession for those we regulate to report allegations or complaints which are unmeritorious or frivolous. Such an approach would increase costs for firms and the SRA (and, in the long run, consumers) and put unwarranted pressure on those persons that are reported. It is essential therefore that we are clear about our expectations and can work openly and collaboratively with those that we regulate. This means we are aware quickly of cases that raise issues that could lead to regulatory action, but that neither we nor the firms are burdened with regulatory consideration of those that do not.

Evidential threshold for reporting

43. That raises the question of what degree of information or certainty is required. We recognise that there is a spectrum - from suspicion to proof. A sample of examples from other regulatory models is attached at Annex A. This demonstrates the range of approaches taken, and that some seek to introduce an objective element and expressly require decisions to report to be made on "reasonable grounds" (Bar Standards Board) or where there is a "reasonable" suggestion of a reportable matter (Financial Conduct Authority).
44. Our initial view is that mere suggestion or suspicion is too low a threshold and would result in overreporting of matters that are not capable of proof.

Example 2: no requirement to report

A partner supervising personal injury work at a firm receives a complaint from a client about the work done by a solicitor in their team. The client suggests that the solicitor's advice on recoverable damages for pain and suffering was too low and that this must be because relevant documentation was concealed from the medical expert. She says this is because of discrimination as she has an Asian/Muslim name.

We would not expect a report in this case unless the partner had reviewed the file, and any other relevant information about the solicitor's work, and found evidence of a concerning lack of judgment or pattern of incompetence - or of discrimination.

45. At a higher threshold, matters could be reported where an allegation of a serious breach is made and the information or evidence supporting the allegation leads the person to 'believe' there could be a serious breach.
46. It may be appropriate to seek further evidence or corroboration - however, we do not suggest that matters will always require corroboration before they should be reported. This may not be practicable, and indeed certain allegations will turn on the complainant's account of events, which may be sufficient to indicate that the relevant matters may have occurred.

Example 3: indication of a serious breach

An associate who is leaving the property team of a large firm reports to the firm's COLP that her supervising partner is guilty of widescale overbilling of clients, by charging a 'full menu' of disbursements as standard, regardless of whether or not they were incurred.

She mentions three particular matters on which environmental searches were billed but not carried out. Having checked the files the COLP notes that on each matter the client was billed for environmental searches but in no case was a search indicated, and nor does one appear on file. The files do each contain a letter stating that all searches (including environmental searches) are clear.

The COLP believes that a serious breach is indicated and reports the matter immediately

47. This is a subjective test. In reaching any belief, we would however expect the person to act reasonably and responsibly based on the information available to them. This derives from their obligation under the SRA Principles to act with integrity.
48. We are, however, keen to seek views from consultees on whether an additional test of "reasonableness" would assist those in making such reports. The reporting obligation could therefore, instead, refer to the need to act on 'reasonable belief' or where there are 'reasonable grounds' for belief, and so expressly add that objective element.
49. Another option is to introduce a specific standard of proof: for example requiring the person to consider whether they believe "it is more likely than not" that the matters indicate a serious breach. This introduction of a test of "likelihood" is similar to the evidential test generally applied by police and the Crown Prosecution Service when deciding whether to charge a person with a criminal offence: namely, whether "an objective, impartial and reasonable jury or bench of magistrates or judge hearing a case alone, properly directed and acting in accordance with the law, is more likely than not to convict the defendant of the charge alleged."³
50. However, this is generally applied at the end of an investigation and on assessment of all the evidence. And a similar test is applied by us at the end of an investigation when considering whether to prosecute a case before the Solicitors Disciplinary Tribunal.⁴
51. Whilst this may add greater certainty, a counter argument is that this would unnecessarily hamper the person's flexibility to exercise their judgment appropriately in the light of the individual circumstances. For example, where there is room for doubt, we would expect the person to err on the side of reporting. This will be particularly important in cases which turn on the personal account or memory of witnesses - which may well be imperfect or contested.
52. Also, the more serious a matter the more care will be needed in deciding whether the test is met, and again, where appropriate, erring on the side of reporting at an early stage. In appropriate cases we may agree to wait for the outcome of a firm investigation, or we may ask or agree with the firm that it should suspend its own investigation whilst the SRA's investigation is underway.
53. We understand that in many cases firms will wish to carry out their own investigation into any concerns or complaints, to understand any issues arising and take any local action they consider necessary. It may be appropriate for the firm to consider seeking views on the underlying issues from the person(s) involved.
54. However, in such circumstances we are not delegating our role to the firm but are simply recognising that in some cases it is appropriate for the firm to investigate the issue first, as they may be best placed to gather first-hand evidence. This also allows those involved to take any appropriate remedial action and thereby demonstrate that they are taking a responsible approach to handling the issue as well as for managing risk and future compliance.

Example 3: internal investigation and early report to the SRA

A firm's email account has been hacked by a third party who contacted a large number of their clients impersonating a member of the firm - and took payment for services amounting to more than £750,000 - which was directed into the hands of the hacker.

The firm has commissioned an independent report to identify the root cause and any improvements to the systems in place that should be made.

Our Enforcement Strategy makes it clear that where a firm has been a victim of cybercrime, our primary focus would not be to penalise them for any adverse outcomes arising. However, we will want to have early notice of the issue, in light of the impact (the number of clients and harm arising from the breach of the firm's systems) - and as this allows us to keep track of the threats to firms of cyber-attacks and give the best advice on how to avoid them.

We will also want to keep the matter under review until the investigation has concluded, and to have sight of the report so we can understand whether:

• systems and procedures were robust enough
• reasonable protective measures were in place
• the firm is taking a responsible approach to putting in place any recommended corrective measures.

55. It is important to note at this stage that it is not the role of the SRA to second guess a careful and rational judgement made on the basis of the facts reasonably available. And we accept that, in some cases, a compliance officer may take a careful and rational decision not to report while their initial investigation is underway, perhaps because they do not initially know enough to reach a decision whether the reporting test is met.
56. In such cases we will not allege failure to report simply because we would have exercised such judgement differently. To make such an allegation we would need to be satisfied, for example, that the compliance officer has not acted with integrity or honesty in considering whether to report the matter, perhaps because they took into account irrelevant factors such as whether their decision would be unpopular with the person involved or the owners of the business.

Confidential or privileged material

57. We recognise that firms or solicitors may face a difficult decision when considering reporting concerns of possible misconduct, or a risk to the public, if doing so may involve disclosing confidential or privileged material, or risk being challenged for breach of employment obligations or defamation. We believe that a proper approach to reporting in accordance with the principles should not give rise to successful challenge.⁵
58. Further, we consider that in serious cases, the public interest in reporting concerns to us will outweigh the interest in protecting confidentiality, although a balancing exercise is needed in every case. We have a statutory power to require the production of documents and can use information that is privileged, provided to us in compliance with a production notice for the purpose of our proceedings. If you have any concerns about making a report and wish to discuss these, please get in touch via our confidential reporting helpline.⁶

59. We would welcome your views as to whether amending the reporting obligation set out in the Codes of Conduct would help to clarify our expectations, ensure that the reporting obligation operates effectively in the public interest and support those reporting concerns in exercising their judgment. The wording could be amended along the following lines:

    Option 1

    You must promptly report to the SRA or another approved regulator, as appropriate, any facts of matters that you believe are capable of resulting in a finding of a serious breach of their regulatory arrangements by any person regulated by them (including you).

    Option 2

    You must promptly report to the SRA or another approved regulator, as appropriate, any facts of matters that you have reasonable grounds to believe are capable of amounting to serious breach of their regulatory arrangements by any person regulated by them (including you).

    Option 3

    You must promptly report to the SRA or another approved regulator, as appropriate, any facts of matters that you believe indicate a serious breach of their regulatory arrangements by any person regulated by them (including you) is likely to have occurred.

    Option 4

    You must promptly report to the SRA or another approved regulator, as appropriate, any facts of matters that you reasonably believe indicate a serious breach of their regulatory arrangements by any person regulated by them (including you) is likely to have occurred.

60. We will consider consultation responses in deciding the preferred option and, if appropriate, update the reporting requirement in the Codes of Conduct. We will adopt a similar approach and wording for the obligations for firms and individuals that we regulate, and for compliance officers, so there is a consistent test and threshold across the board.

Question 1

Do you agree that a person should report facts and matter that are capable of resulting in a finding by the SRA, rather than decide whether a breach has occurred?

Question 2

Where do you think the evidential threshold for reporting should lie?

1. Belief (See option 1)
2. Likelihood (See option 3)
3. Any other options (please specify)

Question 3

Do you think that an objective element - such as "reasonable belief" or "reasonable grounds" would assist decision makers, or unnecessarily hamper their discretion. If you have a view, please explain why. (See Options 2 and 4)

Question 4

Do you have a preferred drafting option - and if so which option is it?

Question 5

What else can the SRA do to help those we regulate to report matters in a way that allows us to act appropriately in the public interest?

Bar Standards Board

BSB Handbook

Reporting serious misconduct by others

rC66 Subject to your duty to keep the affairs of each client confidential and subject also to Rules rC67 and rC68, you must report to the Bar Standards Board if you have reasonable grounds to believe that there has been serious misconduct by a barrister or a registered European lawyer, a BSB entity, manager of a BSB entity or an authorised (non-BSB) individual who is working as a manager or an employee of a BSB entity.

rC67 You must never make, or threaten to make, a report under Rule rC66 without a genuine and reasonably held belief that Rule rC66 applies.

rC68 You are not under a duty to report serious misconduct by others if:

1. you become aware of the facts giving rise to the belief that there has serious misconduct from matters that are in the public domain and the circumstances are such that you reasonably consider it likely that the facts will have come to the attention of the Bar Standards Board; or
2. you are aware that the person that committed the serious misconduct has already reported the serious misconduct to the Bar Standards Board; or
3. the information or documents which led to you becoming aware of that other person’s serious misconduct are subject to legal professional privilege; or
4. you become aware of such serious misconduct as a result of your work on a Bar Council advice line.

rC69 You must not victimise anyone for making in good faith a report under Rule C66.

Financial Conduct Authority

PRIN 2.1 Principles for Business

11. Relations with regulators

A firm must deal with its regulators in an open and cooperative way, and must disclose to the FCA appropriately anything relating to the firm of which that regulator would reasonably expect notice.

SUP 15.3 General notification requirements

15.3.1 Matters having a serious regulatory impact

A firm must notify the FCA immediately it becomes aware, or has information which reasonably suggests, that any of the following has occurred, may have occurred or may occur in the foreseeable future:

1. the firm failing to satisfy one or more of the threshold conditions; or
2. any matter which could have a significant adverse impact on the firm's reputation; or
3. any matter which could affect the firm's ability to continue to provide adequate services to its customers and which could result in serious detriment to a customer of the firm; or
4. any matter in respect of the firm which could result in serious financial consequences to the UK financial system or to other firms.

General Medical Council

Good Medical Practice, paragraph 25(c)

If you have concerns that a colleague may not be fit to practise and may be putting patients at risk, you must ask for advice from a colleague, your defence body or us. If you are still concerned you must report this, in line with our guidance and your workplace policy, and make a record of the steps you have taken.

Institute of Chartered Accountants of England and Wales

Guidance on 'Reporting Misconduct'

Disciplinary Bye-laws 9.1 and 9.2 provide that,

It shall be the duty of every member where it is in the public interest to do so to report any facts or matters indicating that a member and/or firm or provisional member may have become liable to disciplinary action. In determining whether it is in the public interest to report such facts or matters regard shall be had to such guidance as the Council shall give from time to time.

It is important to understand that the reporting member does not have to conduct any investigations or to take a decision as to whether a member or provisional member has been guilty of misconduct. What they are required to report are facts or matters indicating that a member or provisional member may have become liable to disciplinary action. It is not enough merely to have a suspicion that a member or provisional member has committed misconduct; nor is there any duty to report unsupported speculation or vexatious comment.

Royal Institution of Chartered Surveyors

If you think something is not right, be prepared to question it and raise the matter as appropriate with your colleagues, within your firm or the organisation that you work for, with RICS or with any other appropriate body or organisation.