How do we define what we need in a Head of Risk & Compliance if we don’t have internal expertise?
The Short Answer
When you lack internal expertise, start by looking at your firm’s 'friction points'. Are new matters taking too long to open? Are you worried about an upcoming SRA thematic review? Your need is defined by the gap between your current regulatory obligations and your internal capacity to meet them with confidence.
The Three Pillar Assessment
Break your needs into three buckets:
- Governance: Who handles the firm’s insurance, PII renewals, and internal audits?
- Operations: Who manages the day-to-day AML, CDD, and conflict checks?
- Advisory: Who gives the partners a definitive 'yes' or 'no' on complex ethics and sanctions issues?
Consulting the Market
If you are starting from zero, talk to a specialist recruiter or a consultant who understands the SRA landscape. They can help you benchmark what a firm of your size and sector (e.g., high-volume conveyancing vs. corporate M&A) actually requires to stay safe without over-hiring.
The Bottom Line
Don’t guess. Map out where your current risk is—whether it is technical, financial, or reputational—and hire a profile that has a track record of tackling those specific areas.
Want to know more?
Guide to Hiring Senior Risk & Compliance Professionals in UK Law Firms
What does a Head of Risk & Compliance typically cover in a law firm?
Why copying another law firm’s Risk & Compliance structure can lead to the wrong hire
