What we changed after February 2025

A year after one of our message houses was published by a newsletter, the findings of our review of document handling, and what we have done about each.

In February last year a trade newsletter published a message house we had written for a client, and Margaret Halden wrote in the Journal about what had happened. She said that I would lead a review of how we hold and share client material, and that we would report on what it found. This is that report.

The review made twenty-one recommendations. The partners accepted all of them. Nineteen have been completed; two are in progress.

What we found

Client documents were held in four different systems, three of which allowed a document to be shared by link without a passphrase. Nobody had decided this; it had accumulated. Forty-two people outside the firm held links to client folders, some of them for matters closed years earlier. And a small number of shared accounts, used by the duty partners out of hours, had passphrases known to more people than needed them.

What we changed

Every client document is now held in the client extranet, introduced in April 2025, with a named account for each person who needs access. Nothing is shared by link.
Every document carries its matter’s codename rather than the client’s name.
Accounts are reviewed every quarter and closed when a matter closes.
Passphrases follow the three-random-words rule and are changed every quarter.
The shared duty accounts have been reduced from six to two, one for each office, and will be retired when the duty rota moves to named accounts. This is one of the two recommendations still in progress.
Every new joiner is trained on document handling in their first week, and every member of staff once a year.
The narrative risk files kept by the Desk are now reviewed every six months and closed with the matters they support.

The second recommendation still in progress concerns the archive of closed matters before 2019, which is being reviewed file by file and will take until the end of this year.

None of this guarantees that a document will never again leave the firm without our agreement. It does mean that if one does, we will know which account it left from, which we did not last time.