The scapegoat for the two huge data breaches revealed by Yahoo in 2016 turned out to be the legal department. The company’s general counsel (GC), Ron Bell, received no severance on his departure. His termination was widely heralded as a wake-up call for in-house counsel generally.
By all appearances, it has been. Most major surveys identify cybersecurity concerns as among the top, and often the top concern of in-house counsel around the world. In the UK, for example, research for the GC Futures Summit revealed that 62% of GCs worried about data security and cyber crime. Cyber concerns, including protection, security, threat response, privacy and piracy, were also among the top two issues identified by Edge International’s Leigh Dance in a blind survey of legal and compliance heads in large global organizations based in North America, Europe, the Middle East and Asia.
Similarly, a report from ALM Intelligence and Morrison & Foerster, General Counsel Up-at-Night, found that 65% of respondents cited privacy and data security as among their most pressing challenges, second only to regulation and enforcement. But cybersecurity threats were also the concern most frequently particularized by the 63% of respondents who saw risk and crisis management as a primary issue.
“Security and privacy are definite concerns for any company with a website,” says Stephen Rotstein, past chair of the Canadian Corporate Counsel Association (CCCA) and Vice-President, Policy & Regulatory Affairs and General Counsel with the Financial Planning Standards Council.
The problem is a particularly acute one for companies who handle data from their clients. “Because we implement devices in information technology (IT) environments across Canada, we’re the stewards of information that comes not only from our own confidential data but also that of our customers and their customers as well,” says Daniel Bourque, Senior Corporate Counsel and Chief Privacy Officer at Xerox Canada Ltd. “It’s a big concern from a technical standpoint.”
Some 87% of respondents in the Up-at-Night study who cited privacy and data security as a concern were worried about hacking, phishing, malware and ransomware; 62% feared employee mistakes; and 50% pointed to breaches originating with non-law firm vendors.
It’s not that law firms are off the hook. Daniella Isaacson. a senior analyst at ALM Intelligence, cites a recent report from that organization, Survey, Cybersecurity & Law Firms, and concludes that “there is little to no indication that law firm cybersecurity has meaningfully improved” in the last two years. She notes that while 77% of law firms have done a formal security assessment, just 66% have a data breach plan in place, and a mere 46% do regular testing.
Isaacson suggests, however, that some of the fault must lie with the clients and their law departments. “Interviews with law firm and law department leaders in the preparation of our research revealed that law departments often wanted law firms to check the boxes and did not routinely ask for a more detailed assessment or test of firm practices,” she writes.
Data from the Up-at-Night report corroborates Isaacson’s conclusion. The study found a 22 percentage point difference between the importance in-house counsel assigned to privacy and data security and the proportion of their time they dedicated to the issue. The gap was the largest among all areas of concern among respondents.
But things are changing as GCs start to insist that their external law firms up the cybersecurity ante. In the US, for example, Marsh & McLennan has demanded that 12 of its largest firms encrypt communications with the company using technology known as transport layer security (TLS). At press time, Cravath, Swaine & Moore, Davis Polk & Wardwell, and Gibson Dunn & Crutcher had responded by implementing TLS.
So what can GCs do to deal with the fragile cybersecurity environment?
“The key is to understand the specific risk and work with a cross-functional team that includes IT and human resources [HR] personnel to ensure that the risk is properly managed,” says Gennady Ferenbok, Vice-President, Legal at the Kilmer Group.
Ari Kaplan, a legal technology expert, told Legaltech News that he is seeing an “extraordinary level of interdependence and collaboration and participation” in the shift towards threat prevention. “Each group, each division needs to know what the other is doing so that there is an awareness, and that awareness will itself help with prevention and help with identifying potential issues earlier, which is the ultimate goal,” he said.
As well, Kaplan adds, corporations are trying to leverage technology for more than one purpose. By way of example, he cites e-discovery software. “Corporations are starting to realize they can use this e-discovery software for information governance and risk management and record management, and all of a sudden you see this tool being deployed enterprise-wide as opposed to within a specific division,” he says.
Concerns about regulation, it seems, always rank near the top of the nightmare list for in-house counsel. And while that continues to be true in a general way, the specifics are shifting.
“Those concerned about regulation generally describe it in three ways: increasing volume and complexity, effect of political uncertainty on regulation, and specific areas of regulation or ongoing investigations (antitrust/competition, anti-bribery, financial services sector),” Dance writes. “This is also different than two years ago.”
As mentioned earlier, the Up-at-Night survey identified regulation and enforcement as the top concern of respondents, with 74% citing this issue. Among this group, changes in regulations (65) and differences in regulations across jurisdictions (64) were most frequently specified.
In Canada, changes to the North American Free Trade Agreement (NAFTA), the Canada-European Union (EU) Comprehensive Economic and Trade Agreement (CETA), and Brexit are the primary sources of uncertainty in the regulatory landscape. “Just a little while ago, I think everyone believed we would have NAFTA in its current incarnation forever,” said one senior in-house counsel in the financial services industry who spoke on condition of anonymity. “And just a year or so ago, no one thought that Europe would not be Europe anymore.”
Jonathan Cullen, Vice-President, Legal Affairs and General Counsel at Pfizer Canada Inc., says that heads of legal departments — especially those in regulated industries — ought not to be satisfied with mere compliance. “The challenge is turning compliance into a strategic advantage,” he says. “To do that, what’s absolutely required is to turn compliance into something people want to do, partly by using words and language to characterize integrity in a positive way. In-house counsel who just become the police put themselves in a bad spot.”
Nick Slonosky, Director and Legal Counsel at Investors Group Financial Services Inc., is of similar mind. “It’s true that many aspects of regulation are very complicated and offer more than a few challenges,” he says. “But if you’ve been around for a while and are used to seeing these changes — whatever their origins, be they the political climate, attitudes to social issues like diversity, First Nations issues, or addressing the special needs of the handicapped — you start to view them as opportunities.”
According to Slonosky, it’s the velocity of change, rather than any specific change or changes, that presents the greatest challenge. “There was a time when people were fond of saying that legislation takes forever, but these days things can change very quickly,” he says.
For David Hanick, General Counsel at Starlight Investments, a company that focuses on investment and active asset management of North American multi-family and commercial real estate, changes in the tax and securities arenas present the most formidable regulatory challenges.
“Changes in securities law in particular have accelerated as we move towards harmonization and perhaps a single regulator,” he says. “Understanding the implications of the recent changes to the hostile bid regime, for example, can be quite an undertaking if you’re not practising in the nuts and bolts of securities law every day.”
“More with less” continues to resound. “For most legal departments, there’s more and more work coming in and they’re not always growing in proportion to the increased workload,” Rotstein says.
There are of course the usual two components of doing more with less: getting more productivity from the in-house department and getting more value from external legal providers.
(a) Internal Resources
On the internal side, the laws of supply and demand may be working out well for organizations hiring lawyers, but there’s a downside. “On the one hand, pay and benefits packages are declining as the number of lawyers available continues to exceed the jobs that are around,” says David Avren, General Counsel & Corporate Secretary at Coast Capital Savings. “On the other hand, GCs want a certain level of experience and background while the company’s instinct is for the cheaper option. The pressure is on legal departments to run like mills.”
But Avren says the tendency to hire junior lawyers because they’re cheaper is not good for the lawyers or the company. “An approach that says ‘just hire the cheaper lawyers who will have to move because we won’t increase their compensation’ is not a healthy one,” he says. “It ignores the fact that the legal department has considerable value as a repository of institutional knowledge that can be very stabilizing for an organization.”
In today’s environment, then, recruiting isn’t the problem. “It’s recruiting calibre that’s the issue,” Avren says.
According to Andrea Fellows, Vice-President, Corporate Legal, at Oxford Properties Group, one of the keys to cost saving is to have high-calibre people in-house. “You have to be diligent about where to spend and where to save, but in the end, it’s worth paying more for good internal lawyers to lessen the company’s dependence on external resources,” she says.
For those already on the job, time allocation looms large. “We’re always trying to balance the demand for traditional legal advice by internal clients and management’s growing desire that lawyers operate more as strategic counsellors and leaders in the enterprise instead of confining themselves to giving pointed reactive legal counsel,” Cullen says. “So where do I put my time? Is it looking across the horizon at policy changes or mopping up the contract that’s sitting on my desk?”
Legal departments, as Dance points out, clearly have more stakeholders, many of whom demand more from their lawyers than they did five or 10 years ago. These stakeholders include the C-suite, the in-house department itself, the board of directors, audit committee, shareholders, customers and regulators.
The point is that growing demands conflict with budget constraints. “So how do we answer that?” Cullen asks. “The truth is that there’s only one answer, and that is to do what makes the most business sense.”
Improving the efficiency of internal procedures, of course, goes a long way here. According to Altman Weil’s 2016 Chief Legal Officer Survey, 62% of law departments are controlling costs by doing so. “Top efficiency initiatives are the greater use of technology tools, reported by 60% of departments, and restructuring internal resources, reported by 57% of departments,” Altman Weil reports.
So does allocating work to non-lawyers. The study reveals that the 81% of law departments who planned to reduce their external counsel spend in the next 12 months intended to bring some or all of that work in-house. But the survey also suggests that the inbound work won’t all fall on lawyers: 43% of respondents who planned to reduce legal spend said the work previously done by outside counsel was no longer required, and 42% intended to reassign the new inbound work to non-lawyers.
Not surprisingly, Dance’s 2016 research found that 75% of respondents’ jobs were more demanding or time consuming than in the previous year. Her 2015 survey yielded the same results over the 18 month period before that survey. She calls the situation “unsustainable”.
(b) External Resources
Although controlling external counsel’s fees has been on the table for at least a decade, the evidence that legal departments are succeeding in this endeavour are mixed.
The Altman Weil study notes that, in the 12 preceding months, “58% of law departments negotiated fee discounts; 48% asked for alternative fee arrangements [AFAs]; 40% reduced the total amount of work sent to law firms; and 36% shifted work to lower priced firms.”
Legal departments are also outsourcing work, most commonly litigation discovery and document review, to non-law firm vendors — and with increasing frequency. The number of respondents so doing rose from 43% in 2012 to 57% in 2016.
Further assisting the cause is the recent reluctance of law firm in this country to hike prices. Canadian Lawyer’s 2016 Legal Fees Survey concluded that 55% of respondents would freeze their prices over the next year while 3% intended to cut their rates. The 42% intending to raise fees represent the lowest proportion for that group in three years.
However that may be, the billable hour still rules. The Ninth Annual Law Department Operations Survey conducted by the Blickstein Group Inc. demonstrated that discounted hourly billing rates are still much more common than AFAs. Some 70% of respondents did between none and 30% of their outside legal work through AFAs. Conversely, less than 2% made AFA arrangements for between 71% and 100% of their outside legal mandates.
But in August 2017, Microsoft announced it would move 90% of the company’s legal work to AFAs within two years. The announcement has been widely hailed as signalling the beginning of the end for hourly billing.
Some companies, like GlaxoSmithKline (GSK), are ahead of the curve. Since 2008, the company has taken a hard line on the billable hour. Nowadays, virtually all the company's outside counsel work “almost exclusively” for flat fees. "And I don't mean caps or some other kind of hourly-based AFA — I mean literally flat fees," Justin Ergler, GSK’s director of alternative fee intelligence and analytics, told The Am Law Daily. "No hourly billing, no shadow invoices, no nothing." The company also requires that any matter with anticipated costs of more than US$250,000 be tendered by means of a reverse auction.
In Canada, a Deloitte study, Canadian Legal Landscape 2017, found that half of the chief legal officers (CLOs) interviewed were using AFAs and expected to increase their use over the next year. But a separate study found that AFAs were being used by legal departments in 2016 only 9.9% of the time, an increase of only 0.5% over 2015.
However that may be, what’s clear is that the move to AFAs — whatever it’s pace — isn’t grounded in creativity.
“Virtually none of the CLOs or law firms we interviewed offered any truly innovative approaches to AFAs, and fixed fee mandates continue to dominate,” the study states. “Law firms noted that AFAs were most commonly used for transactional work, though some were offering partial AFAs to large institutional clients for litigation matters on a phase-by-phase basis or as part of an annual retainer covering varying matters.”
Indeed, respondents to the Altman Weil study gave themselves a median rating of only five on a zero to ten scale in assessing their departments’ effectiveness in analyzing outside counsel cost data. It didn’t help that, as 73% of respondents reported, none of their top law firms provided data that would advance such efforts. That’s too bad, because the absence of reliable data is seen by many as impeding both the pace of movement away from hourly rates and the growth of innovation in the approach to AFAs.
Again, though, things may be changing. AdvanceLaw, a consultancy staffed by lawyers, economists and legal consultants, has initiated the GC Thought Leaders Experiment in which 30 GCs have agreed to participate in a global project aimed at finding what management methods and behaviours on both sides produce the best outcomes for companies and their outside counsel. The companies involved include Mastercard, Panasonic North America, Flex, PayPal, Petco, Keurig Green Mountain Inc., Sony Electronics, Rockwell Automation Inc., and Avaya Inc.
Among other things, the project hopes to collect data that will demonstrate which billing arrangements suit which types of matters best. In an open letter, the participating GCs declared that they hoped to answer questions such as whether provider panels achieve the results clients are seeking; what makes panels thrive; whether flat fee arrangements impact service quality or the level of talent assigned to the matter; whether firms that charge the most deliver better service and expertise; whether the in-house practice of sharing external firms’ performance evaluations yield meaningful benefits; and whether the trend to legal project management delivers better efficiency and results.
“What’s developing are new ways in which to measure the worth of external counsel,” Rotstein says.
General Electric (GE), for its part, has developed a program called Yelp for Lawyers. The company’s 800-strong legal department can now search an internal website to examine the track records of GE’s 200 preferred legal providers. The website, GE Select Connect, contains firm profiles via Facebook, features firm information that includes feedback the firms have received from GE lawyers, diversity staffing levels, hourly rates, and discounts rates the company has previously negotiated with particular providers.
Dan Hendy, associate general counsel at the company, told Bloomberg Law that the site will allow GE lawyers “to get a better handle on discounts they can negotiate with outside law firms” and “gain easy access to firms’ strengths and weaknesses.”
Perhaps no one has gone further in attempting to objectify value than Mark Smolik, GC of DHL’s US supply chain operations. Smolik is also the founder of Qualmet Legal, where he and his wife conceived a cloud-based platform that assesses and compares the performance of legal service providers. The platform computes value based on input from internal lawyers who need only about one minute to complete forms that produce a quantitative analysis of the provider’s understanding of the company’s business; the results achieved; the level of service; the appropriateness of the effort; resource management; and overall satisfaction. Once billings are added in to provide context, comparisons can be drawn between external counsel.
All this is undoubtedly welcome, if for no other reason than the fact that the latest Litigation Trends Survey from Norton Rose Fulbright, which includes data from 606 corporate counsel in 24 countries, suggests that the growth in litigation is far from over. Some 25% of GCs expected litigation volumes to increase in the year ahead with only 13% predicting a decline.
“There are always risks out there that you haven’t focused on,” Ferenbok says. “It’s a fast-moving world where what you don’t know is what is scary — and there are always a lot of things you don’t know.”
Still, there’s a considerable body of thought that believes the focus on reduced fees and innovative fee structures can be overrated.
“The most important part of the equation is the side that focuses on value creation for the business through the interaction of the law firm and the organization,” Cullen says. “When we talk about value, we’re not just talking about things like off-the-shelf legal education and seminars, but about strategic partners who understand us and tailor their programs to our lawyers and leaders.”
Nor does Cullen believe in a one-size-fits-all approach. “We’ve set up a plan that includes working in different ways with different law firms,” he says.
At Coast Capital, Avren’s six-lawyer law department is also looking to what he regards as more important priorities than squeezing external counsel. “We have established relationships with the firms we use,” he says. “What we look to them for are mutually supportive relationships, continuity and extra value.”
Working with new firms in this way, however, can be a problem. “Many are not willing to invest in the relationship and the learning curve,” Bourque says. “There’s a lot of talk about things like budgeting and project management, and I’m sure some law firms do it, but I’ve yet to see a convincing case.”
Still, Bourque says law firms are changing because they must. “The market is such that corporations are increasingly repatriating services and finding the information they need to get the right new providers,” he says. “There are more and more ways to keep your providers honest, keep them competitive, and challenge them.”
According to one veteran in-house lawyer in the financial services industry, technology is the most underestimated and potentially disruptive external challenge facing in-house counsel today. “Personally, I’m surprised by the new technological developments and potential I see on an almost daily basis,” the lawyer said. “But I still don’t think the legal community quite understands how all-encompassing technology is today.”
In its study of the Canadian legal landscape, Deloitte calls technology “the critical missing factor.” The authors argue that the “more for less” conundrum can be alleviated by prioritizing investment in technology that will “accelerate in-house departments from responsive, supporting functions to truly strategic, insight driven organizations.”
Sadly, only 15% of respondents listed technological improvements as a top priority. “Nearly 90 percent of CLOs surveyed have ultimate spending authority for technological investment, yet over 50 percent of respondents anticipated no change in technology investments in the coming year,” the study states.
Ironically, the technology that many legal departments are using is “not impactful to their business, such as e-discovery and project management software”. It’s not that innovative solutions aren’t around, including the following suggested by Deloitte:
- A billing system with integrated departmental budgets and industry benchmarks to show what other legal departments are charging for similar types of work;
- A client portal that allows real time remote collaboration between a legal department and a law firm. “This can also allow the use of block-chain technology to automate execution of an agreement when required contract terms are fulfilled,” Deloitte writes; and
- A wireless dashboard that provides a high level summary of all pending matters for a legal department.
Whatever the tech-related failings of legal departments are to date, Dance’s research concludes that being tech-savvy is one of the competencies that many GCs want to focus on going forward. She defines tech-savvy as “a catch-all term for understanding new and developing technologies so legal can better meet your businesses' legal needs, and the ability to use diverse IT tools.”
Nonetheless, sorting out the balance between being leading edge and being left behind in the fast-moving technological labyrinth is not an easy task. “The industry is changing so rapidly that it takes a great deal of effort and knowledge to sit down and figure out if various automation options are trustworthy and efficient and easy to implement,” Ferenbok says. “Many times you find that there are very few mature options or standards to go by, and then you’re going to have to figure out what’s going to stick and what’s not going to stick.”
What’s obvious is that just knowing the law won’t do anymore. Leadership and tech-savvy (discussed earlier) are the new essential competencies. And they are “new”: “Two key competencies that showed up in open-ended answer to Global Counsel Leaders Circle 2017 Benchmark were words not mentioned by any respondents in the 2015 benchmark,” Dance writes. “These two competencies are: leadership and various words that can be paraphrased as tech-savvy.”
Dance goes so far as to say that substantive legal abilities are “nearly overshadowed” by the new competencies. She attributes this to the important role GCs can play in the protection of reputation.
More specifically, Dance references Egon Zehnder, a global executive search firm, which has formulated a list of core competencies for legal executives. The list embraces strong functional competence; results orientation; leadership and management strength; influencing and partnering skills; and strategic orientation. Dance boils these down to advocacy aptitude and experience; business acumen; calm temperament; communication skills; and corporate governance understanding.
From these competencies emerge best practices for law departments. At the most recent DLA Piper Global Women’s Leadership Summit, GCs were described as having evolved from “business stoppers” to “business enablers” whose best practices should include the following:
- Viewing themselves as core members of the corporate management team;
- Managing cybersecurity risk as a top priority;
- Understanding that the risk of not innovating is greater than remaining static; and
- Creating a culture of compliance and integrity.
It’s not that GCs aren’t expected to be lawyers anymore. As Fellowes puts it: “Today, in-house counsel have to know how far to push the management of risk while at the same time pushing the business forward.”
To be sure, the extent to which the legal department plays a strategic role varies within a wide range. But Fernando Garcia, writing in Canadian Lawyer In-House, says it’s critical that all in-house leaders think about how their departments add value for their clients and how their strategic plans align with and advance those of the client.
“At the end of the day, this strategic role is what gives in-house counsel job security,” Garcia adds. “Also, the fact that the department is able to deal with the day-to-day legal matters, but that it also understands the client, the business, the industry and helps advance the objectives of the client is what earns the legal department a seat at the boardroom table.”
To these ends, Garcia recommends the following strategies for all in-house counsel to consider:
- Every legal department should have client service standards;
- Share the objectives of the department’s business partners;
- Be realistic with budgetary assumptions;
- Conduct an annual SWOT analysis identifying the strengths, weaknesses, opportunities and threats that engage your legal team, an exercise that underlies the development of strategies to fill gaps and minimize risks; and
- Seek out impactful opportunities, particularly technology solutions that improve productivity.
These strategies and more, Garcia maintains, are likely in place at large departments. But they also apply to small and medium departments. “The strategies should not impose great constraints on your scarce resources, but the value derived from implementing these strategies are well worth the effort,” he writes.
The strategies, Garcia adds, will enhance the legal department’s clout with management at the Board. But as one senior in-house lawyer points out, influence can be a mixed bag. “Advising the CEO, after all, is both rewarding and risky at the same time,” the lawyer says.
So, after all this, where’s the upside for in-house counsel. Slonosky believes he has at least part of the answer: “I recently heard someone says the difference between in-house counsel and external counsel is that external lawyers are competitive while in-house lawyers are collaborative.”
That’s at least one challenge overcome.