德勤全球-Legal-Risk-Management_ A-heightened-focus-for-the-General-Counsel_19页_5mb

Deloitte Legal Risk Management Summary

Core Content

Deloitte's document outlines the evolving role of in-house legal teams in managing legal risk within organizations, emphasizing the need for a proactive, comprehensive and integrated approach. It discusses the changing expectations of legal teams, the importance of defining legal risk, the three lines of defense model, the use of technology, and the interaction with regulators.

Main Points

What is Legal Risk?

• Legal risk is defined as the potential for financial, reputational, or operational losses due to legal issues.
• It includes both narrow (Legal operations) and broad (financial crime, conduct, intellectual property, etc.) components.
• A mind-set change is necessary, as Legal teams must go beyond their traditional "day job" to actively manage and mitigate legal risks.

Definition of Legal Risk

• Many organizations still lack a clear definition of legal risk, with 41% of non-banking and 14% of banking respondents not having one.
• A broad definition is increasingly adopted, encompassing all risks with a legal component.
• A narrow definition focuses only on risks directly related to Legal operations, such as resourcing decisions or legal advice quality.

Accountability and Ownership

• Accountability for legal risk is shared between Legal and other business functions.
• In the three lines of defense model, Legal is often the first line of risk management, while Risk and Compliance typically act as the second line.
• Business management owns legal risk (including legal operational risk) on a broader definition.
• Clear roles and responsibilities are essential to avoid gaps in risk management.

Risk Appetite

• Some organizations have developed legal risk appetite statements.
• Appetite should be nuanced, varying by risk type and jurisdiction.
• Risks can be eliminated, transferred, tolerated, or managed proactively.

Controls

• Controls for legal risk vary depending on the level of risk.
• For low legal risk, minimal investment may be acceptable.
• For high legal risk, more resources and controls (e.g., policy setting, training, active review) are required.
• Legal teams must ensure that controls are effective and appropriately monitored.

Strategy and Operating Model

• Legal risk assessment should be a key driver for legal strategy and operating model decisions.
• Legal functions are refining their models and increasing use of technology.
• A multidisciplinary approach is essential, involving risk experts, technologists, and compliance professionals.

Technology in Legal Risk Management

• Technology is being used to identify, assess, and report legal risks.
• Common tools include contract management systems, eDiscovery, predictive analytics, and chatbots.
• Data transparency and automation are critical for improving efficiency and visibility.

Monitoring and Reporting

• Monitoring and reporting are essential to ensure legal risk is managed effectively.
• Legal teams should identify what to monitor and use technology where possible.
• Key risk indicators (KRIs) help automate reporting and reduce reliance on subjective decisions.
• Real-time data access and analysis are key to effective monitoring.

Interaction with Regulators

• The GC typically has the primary role in regulatory interaction, although this may be shared with Compliance and Risk teams.
• Proactive engagement with regulators helps manage legal risk and secure pragmatic outcomes in the event of breaches.
• Horizon scanning is important to stay ahead of emerging regulations.

Key Information

• Legal risk is becoming a more prominent and explicit category in risk management frameworks.
• Technology is a growing enabler for legal risk management, offering tools for contract analysis, eDiscovery, and predictive analytics.
• Collaboration between Legal and other functions is crucial for a comprehensive risk management approach.
• Clear accountability and defined roles are necessary to avoid risk gaps.
• Data quality and access remain challenges in legal risk monitoring and reporting.

Technology Use Cases

• Contract extraction and review
• Assisted due diligence & remediation
• Contract drafting, negotiation & execution
• Contract analytics
• Blockchain/smart contracting
• Patent auto drafting & IP portfolio management
• Patent/copyright search & review
• Brand protection & anti-counterfeit
• Competition and antitrust monitoring
• Data privacy & regulatory compliance
• Litigation predictive analytics
• Legal hold management
• Voice and sentiment analytics
• Web crawling & risk sensing
• Sanctions monitoring
• eDiscovery tools
• Case management tooling
• Chatbots for legal policy areas
• Whistleblowing systems

Conclusion

Deloitte emphasizes that legal risk management is not just about legal compliance, but about strategic risk oversight. Legal teams must evolve to take a proactive role, leverage technology, and collaborate across functions to ensure effective risk management. The document highlights the importance of defining legal risk, establishing accountability, and using data and technology to enhance monitoring and reporting capabilities.