top of page
Search

Follow one payment: a 30-minute client money check for your firm

Writer: Ashley Barwick
Ashley Barwick
1 day ago
4 min read

Most small firms have a written process for paying money out of the client account. Most of those processes look sensible on paper. The trouble tends to start in the gaps between the steps.


That is the argument made in a Legal Futures piece published on 16 October by Samantha Griffin of the Institute of Legal Finance and Management. She notes that the SRA accounts rules require firms to have systems and controls appropriate to the nature and volume of client transactions and the amount of client money they hold. The challenge, she says, is whether the process stays effective when the people involved work in different places. Her suggested test is simple. Take a real transaction and follow it from instruction to completion.


Here is how to do that in 30 minutes.


Follow the money trail
Follow the money trail

Why now


There is a second reason to look. On 15 October, Solicitors Journal reported the Legal Aid Agency's latest update on the cyber-attack it detected on 23 April 2025. The LAA said that practitioner data affected could include banking details and access information, and urged anyone who might be affected to stay vigilant against suspicious communications. It also said it has no evidence that the stolen data has been shared or published.


If you do legal aid work, that is a prompt to check how your firm handles a request to change bank details. If you do not, it is still a good reminder of what a convincing fake request looks like.


The 30-minute check


Choose one recent payment out of your client account. Not the oddest one, and not the tidiest. Take whichever comes next in the ledger. Then answer seven questions.


  1. Where did the instruction start? Is there a record of who asked for the payment, and by what route?

  2. What authority was there? Can you see the client's instruction or the underlying reason for the payment, without asking anyone?

  3. Who entered it? Name the person who put the payment into the banking system.

  4. Who authorised it? Name the person, and ask what they could see at the point of approval. The ILFM piece makes a pointed observation: approval can become habitual, a notification arrives, the details look familiar, and someone clicks. Could the authoriser see the client ledger and the purpose of the payment?

  5. Were any bank details changed or new? If yes, how were they independently verified? A call to a number you already held is a different thing from a reply to the email that requested the change.

  6. Did anything go through an exception route? An urgent payment, a colleague unable to log in from home, an approval given by message instead of through the usual system. Was the exception recorded, and does anyone see a pattern?

  7. Who else has access? Look at who can initiate and who can approve. Are any permissions left over from cover, absence or a former member of staff?


If there is only one of you


In a sole practitioner firm, the same person may enter and authorise. I am not going to tell you that is automatically a breach, because it depends on the rules and your arrangements. What I will say is that you should be able to describe, in writing, how you challenge your own payments. A second look the next morning, a check against the ledger before release, a phone call to verify new details. Whatever you do, write it down and be consistent.


Record what you find


Keep a one-page note of the payment you traced, what you found and what you changed. It becomes evidence that your COFA oversight works in practice, which is the thing an assessor or the SRA actually wants to see.


Then put a repeat in the diary. I suggest doing this once before the year-end and again in January, using a different payment each time. If your firm works hybrid, include one payment that was handled by people in different places.


What this does not replace


This test does not replace your accounts rules procedures or your regular reconciliations. It sits alongside them. Its value is that it tests the whole chain, not just individual steps.


Not sure where to start?


If you would like an independent view of where your firm stands on compliance, I offer a free health check, with no obligation. Get in touch and we can arrange a time to talk it through.


The contact page is an enquiry form, so please put "free health check" in the message subject and I will pick it up straight away.


Ashley Barwick, Fraxinus Business Associates. This post is general information and does not constitute legal advice. Fraxinus Business Associates is not authorised to provide legal advice.


Sources

 
 
 

Comments

Rated 0 out of 5 stars.
No ratings yet
Add a rating
bottom of page