Where Law Firms Are Most Exposed to Operational Risk

Operational risk does not always appear where a law firm expects to find it.

When leaders think about risk, the first concerns are often obvious: missed deadlines, lost documents, confidentiality issues, technology failures, financial errors, or breakdowns in client service. These are important risks, but they are not the only forms of exposure a firm carries. Some operational risks develop much more quietly. They can exist inside processes that technically work, responsibilities that have never been clearly assigned, decisions that consistently return to leadership, or knowledge that lives primarily with one person. Because these conditions may not create an immediate crisis, they can become part of the way the firm operates without anyone recognizing them as risk.

This is where invisible risk becomes particularly important.

Risk Often Hides Inside What Already Works

A process does not have to be broken to create exposure.

A firm may consistently complete a particular task, meet its deadlines, and produce the expected result. Yet the process may depend on one employee remembering several undocumented steps, a partner providing approval at a particular point, or someone knowing which exception applies in a particular situation.

The outcome may be fine. The structure supporting that outcome may not be. This distinction matters because organizations tend to evaluate processes based on whether they produce the expected result. If something gets done, it is easy to assume the process is working well. But a stronger operational question is: What does it take for this process to work?

If the answer includes constant follow-up, individual memory, leadership intervention, informal communication, or one person's unique knowledge, the firm may be carrying more operational risk than the outcome suggests.

1. Dependency on Individuals

One of the clearest places operational risk hides is dependency.

Every organization has people with experience, institutional knowledge, specialized skills, and relationships that make them valuable. The risk begins when the organization depends on one person's knowledge or judgment without having a structure that allows that responsibility to be understood, transferred, or supported.

Maybe there is one person who knows how a particular client prefers to communicate. Someone else knows which reports need to be pulled before a partner meeting. A staff member knows how to handle an unusual filing issue. A partner knows which decisions always come back to them because no one else has been given authority to make them.

None of these situations automatically indicate a problem.

The question is whether the firm has intentionally decided to depend on that person or simply evolved into dependence because no structure was created around the responsibility.

When knowledge leaves with a person, when a person's absence creates immediate uncertainty, or when work cannot move forward without asking a particular individual, dependency has become an operational condition. And operational conditions deserve examination.

2. Responsibility Without Clear Authority

Another area of exposure appears when someone is responsible for an outcome but does not have the authority required to manage it.

A person may technically own a process while still needing permission for routine decisions. A manager may be expected to keep work moving but lack the authority to resolve recurring issues. A staff member may be told to take ownership while important decisions continue returning to a partner.

This creates a gap between responsibility and authority.

When that gap exists, people compensate for it. They ask for approval, escalate decisions, wait for direction, or develop workarounds to keep things moving.

Over time, the firm may interpret these behaviors as a delegation problem or an accountability problem.

Sometimes they are.

But sometimes the deeper issue is that the structure never gave the person enough authority to actually own what they were assigned.

That is an operational risk because the firm becomes dependent on escalation rather than enabling decisions to happen at the appropriate level.

3. Communication That Depends on Memory

Communication can also become a hidden source of risk when important information moves primarily through people instead of reliable processes.

Consider how often someone says: “Just ask them.” “They'll know what to do.” “That's how we've always handled that client.” “Let me check with the partner.”

These statements may seem harmless. In many firms, they are simply part of getting work done. But when important information repeatedly depends on knowing who to ask, remembering what happened previously, or finding the person who has the answer, communication itself becomes dependent on institutional memory.

That creates exposure. People leave. Responsibilities change. Teams grow. New employees join. Work gets redistributed.

A communication system that works because everyone currently knows who to ask may become much less reliable as the firm changes.

The issue is not that every communication needs to be documented or formalized. It is that the firm should know which information is important enough that its availability should not depend entirely on individual memory.

4. Processes Built Around Exceptions

Exceptions are another place where operational risk can hide.

Every firm has exceptions. A client needs something handled differently. A particular matter follows a different process. A partner has a preference that requires an additional step. A system does not quite accommodate a particular situation.

That is normal.

The problem begins when the exception becomes so common that it is effectively part of the process, but the firm's structure never changes to reflect it.

At that point, people are no longer simply handling an occasional exception. They are compensating for a recurring structural gap. This can create additional work, inconsistent outcomes, confusion about responsibility, and increased reliance on the people who know how to navigate the exception.

A useful question is not simply, “Do we have exceptions?”

It is: “Which exceptions happen often enough that they are telling us something about the way the process was designed?”

5. Decisions That Keep Returning to Leadership

Leadership dependency is another significant source of operational exposure.

Managing partners and firm owners should absolutely be involved in important decisions. The goal of good structure is not to remove leadership from the organization.

The question is whether leadership is involved because a decision genuinely requires leadership judgment or because the organization has never established who else has the authority to decide.

When the same categories of decisions repeatedly return to the managing partner, the firm can become dependent on leadership intervention to keep ordinary operations moving.

That creates a bottleneck. It also creates a capacity problem that may look like a staffing problem.

The firm may respond by hiring another person, adding another meeting, implementing another technology tool, or asking leadership to delegate more.

But if the underlying issue is unclear decision ownership or authority, adding capacity does not necessarily resolve the exposure. The organization may simply create more people working around the same structural gap.

6. Work That Requires More Effort Than It Should

Some operational risk shows up not as failure, but as unnecessary effort.

A team may spend time searching for information, confirming something that should already be clear, following up on the same request, checking work that another person already completed, or scheduling meetings to resolve questions that could have been answered through a clearer process.

Individually, these tasks may seem insignificant. Collectively, they become an operating cost.

More importantly, they can indicate that the firm's structure is requiring people to compensate for something that has not been clearly designed.

This is why efficiency should not be measured only by whether work gets completed. A process can produce the right result while consuming unnecessary time, attention, and leadership capacity. That difference matters.

The Common Thread

Dependency, unclear authority, communication gaps, recurring exceptions, leadership bottlenecks, and silent inefficiencies may appear to be separate issues.

Often, they are connected.

They can all develop when a firm continues operating on structures that were created informally, inherited from an earlier stage, or never intentionally established in the first place.

As the firm changes, those structures may no longer match the organization that exists today.

Yet because people have learned how to work around the gaps, the underlying exposure can remain invisible. That is what makes operational risk difficult to identify. The firm may not look like it has a problem. People are working. Clients are being served. Matters are moving. Revenue is coming in. But the organization may be relying on a collection of informal systems, individual knowledge, and leadership intervention to make all of that happen.

The question is not whether the firm is functioning. The question is how much invisible effort and dependency are required for it to function?

Making Exposure Visible

You do not need to examine every process in your firm at once.

Start with the areas where the organization appears to work, but where the work depends heavily on particular people, repeated intervention, or informal knowledge.

Ask:

What would become difficult if this person were unavailable tomorrow?

Which responsibilities exist without clearly defined authority?

What decisions repeatedly return to leadership?

Where does the team rely on “just ask” instead of a reliable source of information?

Which exceptions happen often enough to reveal a structural issue?

Where is the firm spending time compensating for a lack of clarity?

These questions are not designed to uncover everything that is wrong with the firm. They are designed to identify where the organization may be carrying exposure without recognizing it.

Because operational risk does not always announce itself as failure. Sometimes it looks like a person everyone depends on. Sometimes it looks like a decision that always comes back to the partner. Sometimes it looks like a process that works, but only because everyone knows the unwritten rules. And sometimes it simply looks like the amount of effort everyone has accepted as normal.

What is your firm relying on today that would become a problem if the person, knowledge, or workaround supporting it were suddenly unavailable?

That is often where invisible operational risk begins to become visible.

How Legacy Can Help

The first step in reducing operational risk is not adding more rules, procedures, or approvals. It is understanding where the organization is currently exposed and why those conditions exist.

A Firm Structure Assessment gives leadership the opportunity to step back from daily operations and examine how responsibility, authority, decision-making, communication, and workflow are actually functioning inside the firm.

The goal is not to find everything wrong. The goal is to identify what is happening, understand the patterns behind it, and determine where clearer structure could reduce unnecessary dependency, friction, and exposure.

Because what you do not structure does not simply disappear. Someone, somewhere, is usually compensating for it. And that is where operational risk begins to accumulate.