Guides, published writing and a running commentary on where risk is heading for law firms.
ID verification, screening, source of funds: every firm leans on RegTech, and in too many the only record of what it actually does is a salesperson's promise. Why each product needs its own risk assessment, the nine things a real one covers, and the one-product exercise to run this week. Read it →
The regulator’s annual report, visualised and annotated: only 13.4% of firms checked were fully compliant, supervision has more than tripled in five years, and a third of independent audits were not Reg 21-compliant. Updated the day each new report lands. See the numbers →
The SRA revealed half its post-audit involvement traces to control failures rather than policy gaps; privilege and AML still pull in opposite directions after Carter-Ruck; and one AML framework rarely survives two jurisdictions. Read it →
Most firms review files; few audit the audit. Six gaps that make a review process look thorough while quietly missing what matters. Read it →
Earlier: The SRA Sectoral Risk Assessment and the confidence gap I see
The questions people ask when they say they’ll only take five minutes. Proper answers, in about five. A new one lands fortnightly.
Lexcel and CQS are worth having and worth being proud of. Neither is an independent Regulation 21 audit, and the firms that file them in the same drawer find out at the worst moment. One is a badge. The other is a test. Read it →
The straight answer up front, what “where appropriate” really means, why independent does not mean external, and the haircut problem: you can cut your own fringe, and every hairdresser can spot the result from across the room. Read it →
The Law Society launched its Risk and Compliance Microcredential on 1 September 2026, the sector's first accreditation of its kind, with Eloise among the contributing authors. The course covers the discipline the way it is practised rather than the way textbooks imagine it. It launched the same day as All Things Risk, which was either an omen or excellent diary management. See the course
The Ministry of Justice proposed taking a share of the interest law firms earn on client account, and the sector responded with something close to uproar. Writing for the Law Society, Eloise set out what the proposals actually say, who would bear the cost, and what firms should do while the argument runs. Plenty shouted; this one explains. Read the feature
Nineteen years in risk and compliance, compressed into nine lessons. They cover the craft, the politics, and the survival skills the job descriptions never mention. The tenth lesson, presumably, was knowing what to leave out. Read the feature
Six comments compliance officers hear on repeat, and why each one deserves a second look. Her myth-busting instinct given the Law Society treatment, for the Risk and Compliance Section. The comments will keep coming; now there is a canonical rebuttal to point at. Read the feature
Compliance has an image problem: necessary, worthy, and about as inviting as a fire door. On this episode Eloise talks about making the discipline sound human, and how she built one of legal LinkedIn's most-followed compliance voices by writing like a person. The algorithm, for once, rewarded plain English. Listen
Recorded during her years as compliance manager at Lester Aldridge: what the job actually involves, as opposed to what the job description claims. Due diligence, file reviews, training, and a steady supply of awkward conversations. Reassuringly little of it happens in binders. Listen
A walk through the working week of a senior risk and compliance associate, recorded during her time at Foot Anstey. The route in, the shape of the days, and what the role looks like from inside a substantial firm. Useful reading for anyone considering the career, and for anyone about to hire for it. Read it
When the Angela Rayner story broke, the Gazette asked the question most firms preferred not to: what would that media frenzy mean for the firm holding the file? The answer takes in reputational exposure, confidentiality under siege, and the distance between doing the work properly and being seen to. Worth reading before your firm's name is the one in the headline. Read it
The Gazette reports from the Law Society's risk and compliance conference, where the message was blunt: put AI on your risk agenda, formally and now. Not because the robots are coming, but because your fee earners are already using them. The SRA's updated sectoral risk assessment says the same, at greater length. Read it
The Next 100 Years project's Women Who Will report tracks where women in law have got to and where the ceilings still sit, a century on from the first women entering the profession. Data first, stories alongside. Progress, measured rather than assumed. Read the report
No pitch, no jargon, nothing open-ended. Email eloise@itsallthingsrisk.com, find All Things Risk on LinkedIn, or start with a fifteen-minute call.
Let's talk