Colp & Cofa

Originally published 17 June 2013. Updated 8 October 2026.

SRA compliance culture is about more than knowing the rules or having a policy folder. It includes how people respond to difficult instructions, whether they raise concerns and how the firm checks that its procedures work.

The original version of this article asked which regulatory “pigeonhole” a firm might occupy. That remains a useful discussion for COLPs, COFAs and managing partners: does the practice comply through understanding and effective controls, or does it depend on habit, individual goodwill and the fear of inspection?

What did the historical research explore?

The article drew on SRA research into attitudes to regulation and compliance. The research considered differences between those who understood the rules, those who followed or breached them without sufficient awareness, and those influenced by the prospect of enforcement.

The SRA’s executive summary of its 2011 research findings provides the historical background.

These categories help explain motivations. They should not be treated as a current formal rating assigned to every firm, or as evidence that most firms today fall into any particular group.

The five attitudes discussed in the original article

The original post highlighted five broad attitudes. Expressed in practical terms, they were:

• Unconsciously compliant: following compliant practices without fully understanding the underlying requirements.
• Unconsciously non-compliant: breaching requirements because they are not sufficiently understood.
• Spontaneously compliant: understanding and following the rules because compliance aligns with professional values.
• Spontaneously non-compliant: knowingly disregarding requirements despite the prospect of enforcement.
• Calculatingly compliant: complying principally because the perceived consequences of enforcement outweigh the benefits of non-compliance.

A firm may display different attitudes across departments, roles or activities. The value of the exercise is in identifying weaknesses that management can address.

Good intentions need reliable procedures

A conscientious fee-earner can still miss a requirement. A familiar process may become unsuitable after a change in the law, the firm’s services or its staffing.

Similarly, a procedure followed by one experienced member of staff may fail when that person is absent. The firm needs to understand what makes the process work and how it will continue when circumstances change.

Our article on integrating risk management and SRA compliance explains why compliance should connect with the way the business operates.

What do today’s SRA requirements emphasise?

The SRA Code of Conduct for Firms requires effective governance, systems and controls, records demonstrating compliance, and the identification, monitoring and management of material business risks.

The firm remains accountable when work is carried out through others. Appointing compliance officers therefore needs to be supported by arrangements that enable them to discharge their responsibilities.

The practical questions include who owns a process, who supervises it, what evidence is retained and how management learns when something has gone wrong.

Five questions to test your SRA compliance culture

1. Can staff explain the procedure? Ask why a check is required and what should happen if the result raises a concern.
2. Does practice match the policy? Compare written procedures with a sample of completed work.
3. Can staff raise concerns? Check whether escalation works when a senior colleague or valuable client is involved.
4. Does management act on findings? Look for named owners, deadlines and follow-up when reviews identify weaknesses.
5. Would the process survive an absence? Establish whether important controls depend on one person’s memory or availability.

These are management prompts rather than a formal regulatory scoring system. Use the answers to decide where further investigation or improvement is needed.

Connect supervision with learning

The SRA’s effective supervision guidance describes a risk-based approach. Appropriate arrangements depend on the work, its risks and the competence and experience of those carrying it out.

Supervision should help identify recurring weaknesses and learning needs. If several files show the same misunderstanding, consider whether the procedure, training or allocation of work needs to change.

Our guide to continuing competence for solicitors and COLPs explains how identifying learning needs and evaluating training can support that process.

Make responsibility visible

Staff need to know who makes decisions, who reviews concerns and who checks that corrective action has been completed. Responsibilities should reflect the firm’s actual management structure.

For CQS firms documenting these arrangements, Lexsure’s suggested policy wording on risk roles and responsibilities provides a starting point for defining accountability.

Maintain an accurate record of material risks and the action being taken. Our earlier article on keeping a living and breathing risk register explains why that record should develop with the practice.

Use the pigeonhole question to start a useful discussion

Ask colleagues what would change if the firm expected no inspection. Would its checks, supervision and willingness to challenge difficult instructions remain the same?

The answer may reveal where compliance is embedded and where it depends on external pressure. Use that discussion to strengthen the firm’s processes, then review whether the changes have improved the work.