Most firms review files. The exposure is what a process that's been running quietly for years has started to miss. Sometimes the audit needs an audit.
Eloise Butterworth · 16 September 2026 · a five-minute read
Most law firms already do file reviews. Ask a COLP or a Compliance Manager whether they audit files, and the answer is almost always yes. Some will even have parallel processes - one to audit compliance requirements and another to audit technical advice, ensuring they cover both bases.
So the exposure isn't that firms aren't reviewing files. It's what a process that's been running quietly in the background for a few years has started to miss.
Sometimes, the audit needs an audit. Here are the common gaps I see.
One gets amended but the other doesn't, and before you know it you have some quite serious misalignment. Most file review templates were built once (often taken from a template stemming from somewhere else), then left alone. Meanwhile your firm-wide risk assessment and your AML policy - the documents your review is meant to be testing you against - get updated. If they've drifted apart, you're marking current files against an out-of-date standard, and that's not going to hold up if a regulator asks how your review methodology gives you comfort as to the effectiveness of your policies, controls and procedures.
Two outcome options - compliant, non-compliant - feels efficient. It's also where the useful information goes missing. There's a third category that matters just as much: compliant, but could be better. That's the category where patterns show up before they become problems - a file handler who's technically ticking the box but consistently cutting it fine, a matter type where the paperwork is thin even though nothing's actually wrong yet, the files which might trigger some uncomfortable questions in an audit.
If your data can't show you that middle ground, you're only finding out about issues once they've already become a non-compliance.
It's sensible to focus file reviews on your highest-risk work. It's a mistake to focus on it exclusively. If your audits concentrate mostly on purchase files because that's where the perceived risk sits, your sale files can go years without proper scrutiny - and that's exactly where things get missed, precisely because nobody's looking. How do you select your files, and would that methodology stand up to scrutiny? Perhaps it needs revisiting.
"File review" gets used as a catch-all, but there are at least three distinct things hiding under that label, and they need different content:
AML file reviews - testing client and matter risk assessments, CDD, source of funds and wealth, ongoing monitoring, and escalation against your specific AML policy.
Accreditation checks - Lexcel or CQS requirements, tested against the standard's own criteria.
Technical file reviews - checking for negligence risk, which needs someone with real subject-matter knowledge of the work being reviewed, not just a compliance generalist.
If your process treats these as one review with one checklist, you're probably doing all three badly rather than one of them well.
Most reviews ask: is there a letter of engagement on file? Fewer ask whether it was scoped correctly, whether your regulatory obligations were actually met in it, or whether it includes a liability cap. That last one especially gets overlooked - and it's one of the more consequential things to get wrong.
Same pattern with conflicts. It's easy to confirm a conflict check was run. It's a different question - and a more important one - whether it was run against the right person, in accordance with your policy, and whether the internal escalation processes were actually followed when required. A tick confirming "conflict check: yes" tells you almost nothing about either.
This is the one that quietly undermines everything else. Firms collect file review data diligently, then it sits in a spreadsheet. No written analysis, no prioritised remedial action, no sign-off trail. When it matters - a PII renewal, a Reg 21 audit, a regulator asking questions - raw data with no analysis behind it isn't going to give you, or them, much confidence.
And underneath all of this sits a harder question: is your review marking harshly enough to mean anything? An easy pass doesn't tell you whether your files would stand up to scrutiny when it actually counts. It just tells you that nobody looked very hard.
None of these gaps show up as a dramatic failure. They show up as a review process that looks thorough - because it exists, because it's been running for years, because there's a spreadsheet to point to - while quietly not testing the things that would actually catch a problem before it becomes serious.
If any of the above made you pause, that's the value of asking the question about your existing process. It's also, broadly, how I structure the file reviews I run at All Things Risk - individual, matter-specific review forms rather than a flat compliant/non-compliant column, data that rolls up into something you can actually use, and a written report that tells you where your priorities are rather than just handing back the raw numbers. Happy to talk through what that would look like against your own process, or help you improve the one you have.
No pitch, no jargon, nothing open-ended. Email eloise@itsallthingsrisk.com, find All Things Risk on LinkedIn, or start with a fifteen-minute call.
Let's talk