What Your COLP Needs From Your IT: A Guide for Law Firms

Your Compliance Officer for Legal Practice (COLP) is responsible for making sure the firm keeps to the SRA’s rules. Much of what those rules ask for, from confidentiality to keeping client money safe, now depends on your IT. This guide sets out what the SRA expects, where IT comes in, and what your COLP should be able to get from whoever looks after your systems.

It’s written for solicitors’ firms in England and Wales, and it isn’t legal advice: for the rules themselves, the SRA Code of Conduct for Firms is the source.

What a COLP is responsible for

Paragraph 9.1 of the SRA Code of Conduct for Firms says a COLP “must take all reasonable steps” to make sure the firm complies with the terms of its authorisation and with the SRA’s regulatory arrangements, that its managers and staff don’t cause or substantially contribute to a breach, and that “a prompt report is made to the SRA” of anything they reasonably believe could amount to a serious breach.

The SRA’s guidance on the responsibilities of COLPs and COFAs adds that it expects compliance officers “to keep a record of all breaches that occur”.

Why IT is part of the job

The same Code asks every firm for things that, in practice, your IT either delivers or undermines:

• Systems and controls (2.1). “Effective governance structures, arrangements, systems and controls” that make sure the firm complies, and that let its compliance officers carry out their duties.
• Records (2.2). Records that show the firm complies with its obligations.
• Work done through others (2.3). The firm stays accountable for compliance when work is carried out through people it employs or contracts with. That includes an outside IT provider.
• Risk (2.5). The firm identifies, monitors and manages all material risks to the business.
• Client money (5.2). The firm safeguards money and assets entrusted to it.
• Confidentiality (6.3). The firm keeps the affairs of current and former clients confidential.

The SRA has said plainly that outsourcing IT doesn’t outsource the responsibility. In its cybersecurity advice, it notes that “Seventy five percent of the firms we saw used third-party IT professionals”, that “Two of the firms we visited were exposed to successful cyberattacks as a result of failings by their IT providers”, and that “firms remain responsible for oversight of their cybersecurity.”

What your COLP needs from your IT

None of the SRA’s pages lists exactly what a COLP needs from IT. The list below is our advice, built from what the Code and the guidance ask for.

1. A clear picture of your systems

Your COLP can’t manage risks nobody has written down. They should be able to see what systems the firm runs, where client data is held, who has access to what, and who looks after each part. That’s documentation your IT provider should keep up to date, and give you on request.

2. Records you can show

Keep a log of IT incidents and personal data breaches, with what happened, what was affected and what was done. The ICO’s guide says to “record all breaches, regardless of whether or not they need to be reported”, and the SRA’s reporting guidance says you should be prepared to show how you decided whether to report.

3. Quick warning when something goes wrong

Your COLP can only report promptly if they hear promptly. Agree with your IT provider what they’ll tell you, and how fast, when they find a security incident. Under UK GDPR, a processor such as an IT provider “must inform you without undue delay as soon as it becomes aware” of a breach (ICO guide).

4. Protection against payment fraud

The SRA warns that “Email modification fraud is a common method of diverting client funds to fraudsters”, and advises firms to “Tell your clients that you would never change your bank details by email” (cybersecurity advice). In its 2020 thematic review, “23 of the 30 cases in which firms were directly targeted saw a total of more than £4m of client money stolen.” Multi-factor authentication, email protection and DMARC on your domain make it much harder to impersonate your firm. Our email security check shows where your domain stands.

5. A recovery plan that works

The SRA recommends “A well-rehearsed disaster recovery plan which sets out contingencies, roles and responsibilities” (cybersecurity advice). In its thematic review, 15 firms admitted their plan “was stored on the same system that would be the target of any attack.” Keep a copy away from your systems, and test your backups by actually restoring them.

6. Training your people

“Most firms told us that their staff were the main vulnerability in any system,” the SRA reported, and “Eight firms (20%) we visited had never provided specific cybersecurity training to their staff” (thematic review). Regular training, with a record of who has done it, is evidence your COLP can point to.

7. Evidence of a recognised standard

The SRA doesn’t require Cyber Essentials. The Law Society’s guidance suggests Cyber Essentials, Lexcel or ISO 27001, and the NCSC’s legal sector report recommends assessing your organisation against Cyber Essentials. Certification gives your COLP something independent to show clients and insurers.

When to report, and to whom

• The SRA. Its cybersecurity advice says it expects firms to report attacks, “even if there are no concerns about personal conduct or systems”, though it doesn’t expect every unsuccessful attempt to be reported “unless it is particularly significant.” Paragraph 3.9 of the Code asks you to report promptly anything that may amount to a serious breach.
• Client money. The SRA says you must promptly tell it about “any lost or stolen money belonging to a client or third party, even where the money has been replaced” (Risk Outlook 2020/21).
• The ICO. If a personal data breach is likely to put people at risk, “you must notify us, as soon as possible, and where feasible within 72 hours” (ICO). If the risk is high, tell the people affected too.

The SRA says its reporting guidance is under review after a High Court decision in September 2026, so check the current version before you rely on it.

Questions to ask your IT provider

• Can you give us up-to-date documentation of our systems, data and who has access?
• What will you tell us when you find a security incident, and how quickly?
• Do you keep a record of incidents we can see?
• Is multi-factor authentication on for every account, and DMARC set to enforce on our domain?
• When did you last restore our backups as a test, and where is our recovery plan kept?
• How do our staff get security training, and how is it recorded?
• Do you hold Cyber Essentials Plus, ISO 27001 or similar yourselves?

How we help

We’re an IT company, not a compliance consultancy: we don’t audit your firm for the SRA. What we do is make sure your IT gives your COLP what they need. Our support team works from full documentation of your systems, MYLE Premium monitors your computers and Microsoft 365 sign-ins around the clock, and email protection with DMARC, cloud backups and security awareness training are all part of the plan. We hold Cyber Essentials Plus, ISO 9001 and ISO 27001 ourselves, and we’re independently audited every year.

From our work

A member of staff at a law firm we look after fell for a phishing email, before multi-factor authentication had been rolled out across the firm. The firm’s COLP needed to understand exactly what had happened, so we put together a full incident report for them: a timeline, the sequence of events and the impact on the firm.

David Gilbey, Just Gilbey IT Solutions

See IT support for solicitors, or start with our two-minute IT Assessment.