Four people, four postcodes, one payment
There is a particular kind of failure that only appears once the office goes quiet.
Twenty years ago, if a payment was about to go wrong, someone would hear it. A colleague would look up from a ledger, ask a question across the desk, and the matter would be caught before it left the building. That informal check appeared in no procedure, and nobody credited it with much. It was doing a great deal of work.
A piece for Legal Futures this month, by Samantha Griffin of the Institute of Legal Finance and Management, makes the point well. The SRA's accounts rules require systems and controls appropriate to the nature and volume of client transactions. The question is not whether you have documented processes. It is whether they still work when the people running them are in different places.
The chain of hand-offs
Take an ordinary client payment in a hybrid firm. The instruction starts with a fee earner, possibly at home, passes electronically to accounts, is entered into the banking system by one person and authorised by someone else in another location.
Every link is controlled. The chain is not.
Each person sees their own step; nobody sees the transaction whole. In an office, conversation fills the gaps between steps. Remotely, they stay gaps.
Approval is not the same as scrutiny
Separation of duties remains the central safeguard: whoever inputs should not authorise. But a second signature is worth little if the second person is signing to clear a queue.
Meaningful authorisation means checking the underlying authority for the payment, the client ledger and the purpose of the transaction. It means a clear process for verifying changed bank details, still one of the most reliable ways money leaves a firm for good. And knowing when to stop and ask, especially when a request is urgent and unusual.
Watch the exceptions
Non-routine events drive most of the risk: an urgent payment, an absent colleague, a system that will not let you in. Each is handled pragmatically on the day, usually rightly.
The difficulty is what happens next. The workaround gets repeated, becoming an unofficial process running alongside the real one, with lower standards and no documentation. Nobody decided this. It settled.
Recording exceptions is not bureaucracy. The pattern shows where your controls are thin.
Access grows quietly
Cover arrangements, new starters, outsourced support and long absences all expand access to systems, and rarely is any of it reviewed afterwards.
The SRA's framing is useful: too little access creates a resilience problem, too much an oversight problem. Review permissions on a schedule, and end temporary access when the reason for it ends.
Does your management information still tell the truth?
Here is the part that catches good firms. Senior finance staff can see every completed transaction and approval, and still miss the informal conversation and the workaround for a step that felt slow.
If communication is part of the control environment, the people closest to the friction, usually the finance team, need a route to raise it without it being read as complaint.
Test one transaction, end to end
The most useful thing a small firm can do takes an afternoon. Pick a real payment and follow it from instruction to bank statement, recording who touched it, what they checked and whether anyone raised a concern.
You will learn more from that one file than from a review of your written procedures. And when an assessor asks how your controls operate in practice, your answer will rest on evidence.
What this does not mean
I am not arguing that hybrid working is unsafe, or that firms should return to the office to be compliant. Plenty of remote firms run exemplary accounts, and plenty of office-based firms signed off payments on trust for years.
Nor does every exception need a form. The SRA asks for controls proportionate to the size and volume of your practice.
The point is that co-location was never a control. It was a habit that happened to work. Once it goes, something must replace it deliberately.
Start with a conversation
If you want an independent view of how your client money controls hold up across sites and home working, I offer a complimentary health check with no obligation. The contact page is an enquiry form. Put "complimentary health check" in the subject and I will pick it up straight away.
Ashley Barwick is a Fellow of the Chartered Institute of Legal Executives and a Law Society accredited Lexcel Consultant. This post is general information and does not constitute legal advice. Fraxinus Business Associates is not authorised to provide legal advice.
Sources
● Legal Futures, "Hybrid working and client money controls - be aware of the risks", Samantha Griffin (ILFM), 16 October 2026. https://www.legalfutures.co.uk/blog/hybrid-working-and-client-money-controls-be-aware-of-the-risks
● Solicitors Regulation Authority, SRA Accounts Rules and Standards and Regulations. https://www.sra.org.uk
Comments