Category: Enterprise Legal Management

You’ve built a solid business case, and the benefits of digitalizing your legal processes are clear in efficiency gains and even cost savings (if you’re implementing a legal spend management solution). Not only will the business benefit, but the day-to-day legal operations and processes be simplified so your team is more productive and spends less time on admin. The new legal software is a “no-brainer.” Despite this, you have user adoption and acceptance challenges. Many members of your team are still using the old processes. Why, when are the benefits obvious, and how can you encourage your colleagues to use the new system?

Many change management blogs concentrate on the build-up to implementation and how to get buy-in from stakeholders and users at all levels and around the business. These include ensuring that the project team is diverse, documenting the business need before looking at the legal tech solutions, that requirements are reflective of those that will be using it, that scope doesn’t deviate too much from the initial business need, and that team members get to demo potential systems. All of this is important and contributes to a successful rollout. Regardless of how your pre-implementation project went, you can’t turn back the clock, so advice focusing on the project planning is of little use if you’ve already started rollout. This article focuses on the natural human behaviors that prevent user acceptance and adoption, along with advice and tactics to overcome the challenges so the software you have invested in achieves its expected benefits.

WHY USER ADOPTION CHALLENGES ARE SO COMMON

Firstly, you are not alone, so take some solace in that. Nor is user adoption a challenge specific to legal; ask around the business, and you will find other departments that feel your pain. Forming new habits is the key to success in using a new tool. Individuals will already have habitual, efficient routines, and moving to a new process is disruptive. To form a new habit, you must use the latest software often, requiring as little mental energy as the current process. However, getting to the point of it being routine involves effort, and there will be a temporary reduction in productivity and frustrations. It’s this hurdle that causes most of the issues.

The new software delivers unquestionable efficiency benefits on paper, but these will only come once it becomes the new normal. The key to successful user adoption is making learning the new process as easy as possible and for the new system to deliver benefits and rewards that drive the individual to want to repeat the process. At the same time, you need to manage the negative impact if some system features don’t quite work as intended and the confirmation bias at work in negative echo chambers. Bear all this in mind when using tactics to address user acceptance challenges.

TRAINING AND SUPPORT

Even the most intuitive software will require training to use the tool effectively. For example, there are often multiple paths to achieve desired actions, and team members may not be aware of certain shortcuts. Across the user base, you will have those that find learning new software easy and some that find it very difficult, regardless of its usability. Most training should come from the vendor itself during in-person or online onboarding. Still, provide ongoing training and support as usage ramps up or new employees join the company.

Train-the-trainer programs ensure an internal champion can quickly scale training throughout the business. Internal champions have a broad understanding of the software and the role the system plays in the business structure and processes. This knowledge means they play an essential role beyond training, supporting the team by managing stakeholders, and troubleshooting. Taking an e-billing implementation as an example, they could be responsible for liaising between accounting and law firms and managing difficult conversations in the case of unpaid invoices (in-house counsel can feel overwhelmed if they don’t fully understand the system while law firms grow impatient waiting for unpaid bills).

In-application support documents, videos, or interactive, guided walkthroughs can help address “how-to” questions. For those trickier use cases, utilize 24/7 support via the application, phone, or e-mail. Ensure external users of the system, for example, law firms using your e-billing system, are adequately trained and supported by the vendor to support external user adoption and avoid them directing technical queries to your team. The training addresses the “making the tool as easy to use as possible” part of the user adoption challenge. However, as mentioned above, other factors are at play, and relying solely on training may not improve usage.

WHAT’S IN IT FOR THEM?

People need to be motivated to repeatedly use the new system to the point where it becomes routine. One way to ensure repetition is to motivate the individual to repeat the process because they personally benefit. What this is will depend on the user. For a C-level executive, it might be how easily they can generate their weekly report. For a junior lawyer, they might save time because manual steps in their daily processes are now automated. The full spectrum of benefits should be communicated clearly, from legal spend reduction to day-to-day efficiency gains. These benefits will not appear immediately – due to the learning curve, there may be a perception of it taking longer – so set expectations. Use different methods of communicating; 1-2-1s, town halls, internal newsletters, etc., as individuals prefer to receive information in different ways. Share company progress towards these goals regularly, and it helps to show employees how their system usage and data input is contributing to transformation, perhaps through reports on their dashboard. Regardless of your benefits, how you communicate them, and how you measure progress towards them, the message needs to come from the board (top-down communication) to hammer home the strategic significance of the technology investment.

INCENTIVES/GAMIFICATION

Gamification uses game-like elements to generate positive emotions and user experiences. It’s widely used by brands (such as loyalty cards, online training courses, or fitness apps) as such tactics harness our instincts of competition and curiosity, rewarding behavior and motivating us to repeat it. Because of the positive experience, the individual is suddenly in control rather than being forced to use the software, which also contributes to habit forming. The most modern tools in the market have borrowed gamification elements to improve the user experience. For example, in-app interactive walkthroughs allow you to choose your journey through the software, your speed of progress and show you how far from the end you are.

Some software tools give you badges based on your time logged in and as you progress from beginner to expert. It might sound patronizing, but it’s human psychology. It works, which is one of the reasons why modern software has a better user experience and, therefore, the adoption rate. You can use competition to incentivize your team to use the new software by creating leaderboards and prizes – for example, the number of new matters created in the system per month. The tool itself will hold this data, encouraging them to become familiar with reporting and dashboards to keep track of the scores. You should also encourage your legal software vendor to hold ‘user experience/UX’ days with groups of users and work with them to incorporate elements of gaming and competition into the session, as this will improve the speed of education as well as make the sessions more enjoyable!

PEER CHAMPIONS AND PHASED ROLLOUTS

Within your organization, you will have people that are positive and determined to see the project succeed and people that will cling to every negative experience. Both types of people will share their experiences with their colleagues. You want to make the positive people “champions.” They may be responsible for training, being a port of call for issues, liaison between stakeholders, and being trusted by their colleagues to address these issues with the project leads.

Ideally, you will have included stakeholder representatives throughout the project to ensure software workflows accurately reflect real life, as the more accurate the workflows are, the easier adoption is. However, there may still be issues despite your best efforts, so if it’s not too late, phase your rollout so these issues are ironed out early on and impact as few people as possible. Your champions should be included in these rollout groups, but you want to keep complainers in a later rollout where possible! If a skeptical person has an unpleasant experience, this will confirm their fears. Likewise, the champion seeing benefits will have their positivity confirmed. Controlling the positive and negative experiences, and therefore peer-to-peer communication will give you better user acceptance rates.

LISTEN TO FEEDBACK

Schedule regular feedback sessions with your legal software provider to update them on what is working, not working, feature requests, etc. These should continue for as long as you use the product. A good vendor will take the initiative on this process (at Onit’s European legal spend management solution BusyLamp eBilling.Space, we also send out surveys to get feedback on user experience, bottlenecks, helpdesk support, feature functionality, etc.), but to get the maximum benefit, you need to listen and document internal feedback to report back to the legal tech vendor. In collecting negative feedback, there must be a balance. Make sure you have early-adopter power users who are detailed, fair, and critical in their feedback while weeding out those prone to complain about complaining’s sake. But nevertheless, document ALL complaints (perhaps by using the champion), see if they can be fixed internally, and escalate to the software provider if this is not possible. Close the loop by letting users know how you addressed their issue and what the resolution is. It’s important to know the shortcomings of the system and how it’s failing to meet requirements – if these are genuine and can’t be resolved, then it’s a valid cause of frustration for the team.

LEARN FROM OTHER DEPARTMENTS

While digitalization is new for many legal departments, your colleagues in other departments may be quite advanced in their technology journey. However, while the legal technology itself may be unique to the business, the user adoption challenges will likely not be. Ask around the business (a good starting point is HR) to benefit from existing change management tools and strategies. Ask them what they have tried and what worked and failed. The IT department may have been involved in multiple rollouts of new software. Learn from your colleagues across the business.

MAKE IT PERSONAL

Who are the people behind “the system,” both internally and working for the software provider? Show employees that rather than just being a piece of technology, there are real people behind the system who can advise and support them. If necessary, organize video meetings to get to know each other or implement user days with your tech vendor. While the in-app help documents and support functions are useful and should be encouraged, getting to know and building a relationship with the people managing the tool will aid adoption by improving perception. Plus, it’s harder to push back and reject other humans than it is a faceless piece of tech!

MAKE IT MANDATORY

Being forced to use a system means not being in control, not being motivated for any perceived reason, and being prone to friction. However, the fact you have invested in legal technology means usage is mandatory, and our experience is that user adoption is improved when there is a clear message from the start that usage is not optional. Used in conjunction with the techniques above, you can create a positive, motivating environment instead of a forceful, heavy-handed approach to mandatory adoption.

Request a demo of eBilling.Space today and see our RFP functionality for yourself.

In aviation, a pre-flight checklist lists tasks that pilots and aircrew should perform before takeoff. It aims to improve flight safety by ensuring there are no forgotten essential tasks. Failure to correctly conduct a pre-flight check using a checklist significantly contributes to aircraft accidents.

Although nowhere near as critical as air safety, several law firms have established the principle of running “pre-flight checks” on their e-Bills before submitting them to a legal spend management or e-Billing system such as BusyLamp eBilling.Space. This is to correct any obvious errors on the e-Bill and reduce the % of invoices rejected in the first stage of the validation process. This leads to invoices being accepted and paid by the client faster. Over time, you can identify common errors and make processes at the firm can be more accurate and efficient. It also improves customer satisfaction, as it’s frustrating for in-house clients to receive non-compliant invoices.

One useful tool to support such “pre-flight checks” is an e-Billing Operating Procedures (e-Billing OP) document. Usually, one exists for each e-Billed client entity, covering the key validation rules for each e-Bill and the broader policies and protocols for working with that specific client and legal e-billing software.

Such documents are becoming more common at law firms. Billing Standard Operating Procedure documents come widely mandated in financial and government organizations. Several law firms have adopted and tweaked the idea to have something specific to legal e-Billing. With the increase in corporate counsel buying legal e-Billing software comes an increase in the number of clients that need billing in this way. It also adds to the volume and variety of billing guidelines that firms must remember. Operating Procedures documents allow these to be easily recalled and accessed and help prevent simple mistakes.

In this blog post, we’ll cover how to create and maintain your e-Billing OP document, sample “pre-flight checks,” and how to deal with billing errors.

DOCUMENTING THE E-BILLING OPERATING PROCEDURES

Many law firms have either written or are developing e-Billing OPs for every e-Billing client and/or generic e-billing tool. In order to gain the maximum benefit from this exercise, you need a consistent template against which to write all the e-Billing OPs. Your e-Billing OPs should include the following:

• The overall client e-Billing process flow and project scope.
• Timescales for valid billing, e.g., within xx days of the work.
• How to submit WIP and invoice data?
• How to use/invoice alternative fee arrangements?
• What data validation rules apply?
• How are disputed invoices/time entries handled?
• What is the escalation process for correcting rejections within the law firm?
• When will the valid invoices be paid?
• What expenses/activities may get disallowed?
• What UTBMS codes are required?
• How to amend/resubmit invalid data?
• Are any statutory/regulatory statements required?
• Are there any budgets set/how are they handled?
• Who to contact for queries?

The Operating Procedure may include the non-e-Billing agreed Protocols and Policies governing the client/law firm commercial relationship. Edit these if access to sensitive data is to be restricted.

PRE-FLIGHT CHECKLIST: VALIDATION OF E-BILLS

In addition to the policies mentioned above, your Operating Procedure document must include the checklist of validation criteria to avoid unnecessary invoice rejections. These cover quite basic e-Billing criteria for common and avoidable oversights. Taking the time to do these checks will save time in the long run. Some validation checks typically covered in the pre-flight checklist include the following:

• Are the hourly rates correct and as agreed?
• Are the timekeepers valid, and if required, are they pre-approved?
• Is the time being billed within the agreed time limits?
• Is there evidence of block billing?
• Are the narratives clear? Is there a minimum number of words required?
• If required, are there UTBMS codes for tasks/activities/expenses?
• Are there any disallowed expenses (e.g., Online Research, Local Travel), activities (e.g., Reviewing Files), or timekeeper classifications (e.g., Intern or Trainee) on the e-Bill?
• Are there any budgets or caps on this matter? Are we still within these limits with this bill included?

Subject to a few exceptions, most of the errors detected at this stage can be easily corrected. Some errors can be resolved by the e-Billing team, for example, missing timekeepers or incorrect rates. Other more significant errors, i.e., missing activity codes, vague narratives, block billing issues, tax errors, or other billing guideline breaches, must be referred to the revenue controllers or the firm’s legal team. This may inevitably delay the submission of the e-Bill. It’s important to note that the client would reject the invoice anyway, so it’s still faster to catch the error before submission.

Regardless of the type of error, they should get documented and their resolution communicated to the legal team. This helps your firm identify common errors and improve the billing accuracy (and, therefore, the processes’ efficiency) in the future.

Many law firms have implemented additional processes upon matter opening and will set an e-Bill indicator or flag in their Time and Billing system to show that this matter must be e-Billed. This will notify the matter partner/lawyers and e-Billing coordinator that crucial data items are required to stop the matter from being billed if missing. The firm’s e-Billing team can then run audit reports on a client-by-client basis to check that the expected data is present before the matter gets billed. (As noted above, you should have processes to refer many of these issues back to the business to resolve.)

COLLECTING CLIENT REQUIREMENTS FOR E-BILLING OPERATING PROCEDURES DOCUMENTATION

Now that you have the template for building your operating procedures document, you may still be wondering how to identify the clients’ e-Billing requirements in the first place! Ideally, the in-house client will have supplied you with a billing guidelines document signed off by both parties. You then use this to populate a “client matrix,” which includes the client’s data and billing requirements, your law firm’s data requirements, and any administration and special installation guidelines. In the interest of centralization, we recommend that the client billing guidelines and other specific e-billing requirements are in the e-Billing OP documentation. They must be visible to the relevant parties and adhered to by the legal team and the firm’s e-Billing/finance function.

THE CLIENT MATRIX IS PRIMARILY A SERIES OF TASKS WITH DATES FOR COMPLETION. THE MAIN SECTIONS ARE:

• New Client setup – includes client ID, e-Billing software vendor details, bill format, contact details, timekeeper types, and entities in scope.
• New Client Implementation Checklist – includes UTBMS codes, invoice template details, login, and password details, validation lists, expense codes, testing requirements, and go-live dates.
• Portal set- up – includes client and law firm data setup, user setup, rates and timekeepers, and reporting metrics.

THE INFORMATION FROM THIS CHECKLIST IS CROSS-REFERENCED AND INCLUDED IN THE E-BILLING OPS. COMPLETING THE CHECKLIST WILL HIGHLIGHT OTHER TASKS TO FOR COMPLETION FOR A GIVEN CLIENT, SUCH AS:

• Is any timekeeper mapping required? – Typically, from the law firm’s system to the client timekeeper classification.
• Are any data extracts needed? – e.g., existing open matters, timekeeper uploads, agreed rates, etc.
• Communications to the legal team – mandatory task/activity codes/Narratives etc.
• Client work types, is a PO number needed?

As with the Operating Procedures, the data-gathering checklist comes from the law firm’s e-Billing coordinator/team. Although these main sections refer to “new clients,” the client matrix should be updated if billing guidelines, or any other procedures from the client, change.

OPERATING PROCEDURES MAKE E-BILLING EASIER

There is no “one way” to do e-Billing, which is different in many law firms. One core difference is whether e-Billing is centralized or decentralized and the associated consequences of that approach. What seems consistent (and works) is when firms create a dedicated e-Billing specialist team. These carry various names but are essentially a team responsible for successfully uploading e-Bill files to the e-Billing vendor/client portal. This team can be in-house, near-shored, or offshore but will need clear Operating Procedures for each client with all possible outcomes and options documented and a clear escalation path for all unresolved queries. They will also require a general support model covering other non-client-specific scenarios. This level of documented support may be more important if the team is working offshore or remotely.

The scope of e-Billing is changing and is far from the original concept of loading e-Bills into a portal, handling the rejections, resolving issues, and getting the bills accepted. Evolving from this original requirement came the addition of matter budgets to the portal and the law firm’s responsibility to maintain them and ensure they are adhered to. More recently, we have seen clients make “added value” requests, such as adding client-only data to the e-Bill (such as their work types) and unbilled time and WIP uploaded to the e-Billing portal. This extension to the scope will only increase as the adoption of “beyond e-Billing” legal spend management technology, such as AI and machine learning, is spread wider. These requests are all helping in-house clients better understand their matter budgets and legal spend, and your law firm is a vital partner in assisting them to achieve these goals. But with this additional service comes complexity, making the need for clear e-Billing documentation at your firm even more critical.

Written by Bryan King

Before looking at UTBMS issues affecting law firms and in-house departments, we first need to distinguish between ”full” e-billing compared to the uploading of a copy of a paper bill or the keying of invoice details to a client or third-party web site. Full e-billing involves the production of an electronic file, usually in one of the LEDES formats (Legal Electronic Data Exchange Standards), which contains not just the invoice header, matter information and bill totals but a detailed breakdown of timelines and expenses. This detail is coded using the Uniform Task-Based Management System (UTBMS), also known as ABA task codes, which is comprised of sets of codes that help breakdown legal work and expenses across a timeline of activity to a fine level of detail. The codes were designed to provide clients and law firms with a common method for identifying the work breakdown and cost information of legal services.

There are legal task code sets for different types of legal work (e.g., Litigation, Bankruptcy, Trademark, Project/Transactional and Counseling) and a set of activity codes to categorise “how” the work on the matter is being done. For every matter, the in-house client receives an itemised bill with full transparency of the outside counsel fee earners who worked on the account, what tasks (e.g., taking a witness statement) and activities (e.g., drafting a letter) they undertook, and the time taken, the rate and cost of the item of work. Once the e-bill is generated, the information is validated against client guidelines held in the e-billing solution.

The e-bill passes various levels of validation before being uploaded to the client’s systems where it is then authorised and paid. The in-house legal team is then able to use legal spend management software to analyse the billing data using the UTBMS code detail and compare like-with-like information across all their outside counsel submitting e-bills.

The benefits of this approach are many. Corporate legal operations teams can easily compare and contrast the cost and efficiency with which different law firms execute similar matters. Such insight allows in-house lawyers to have intelligent and well-informed conversations during law firm reviews and re-negotiations. Over time, this enables the corporate legal department and law firm to become smarter in the way they execute matters.
THE IMPORTANCE OF ACCURATE LEGAL TIME RECORDING

It is outside counsel’s responsibility to maintain accurate time records, detailing the time spent on each item of work throughout the day. Without proper time records, the billing entries must be reconstructed from memory and the time spent on each task could be based on nothing more than a guess. This practice could ultimately lead to overbilling. Therefore, it is imperative that bills are based on accurately documented time records that detail each task and activity performed. However, daily time records are not enough if the entries are recorded in a block billed format.

BREAKING THE BLOCK BILLING PRACTICE

Block billing occurs when several discrete tasks or activities are recorded under a single time unit, rather than itemising the time spent on each separate activity. In-house clients usually prohibit this practice because it makes it difficult, if not impossible, to determine whether the work performed and the fees incurred are reasonable. Although most examples of outside counsel billing guidelines prohibit attorneys from submitting invoices that are block billed, clients typically allow their attorneys to correct such entries without penalty.

POSITIVES OF USING UTBMS CODES

As noted above, the UTBMS codes are a powerful tool for analysing patterns and comparing performance.

UTBMS information is, of course, useful to compare how law firms deploy their resources for work on similar phases/tasks/activities of like matters (e.g., percent of partner, associate or paralegal time and fees) but also reveals the average and median rates, as well as by level of resource for that legal work. Examining activity at this level across firms invariably reveals diverse practices with the best and worst practices being immediately apparent. When addressing such issues with firms, the client has the data, and the data is based upon that firm’s actual invoice entries.

The information is also useful for examining billing on diverse matters, as the UTBMS information can be used to compare the performance of multiple firms working on the same matter as well as compare individuals within the same firm working on the same matter.

In the past 20 or so years, there has been a shift. Clients are now requiring their outside counsel to conform to billing practices that provide more than just a basic level of standardisation. These standards are designed to make non-compliant charges stand out where they may have been buried previously.

PROBLEMS WITH UTBMS CODES

On the one hand, the standardisation offered by the Uniform Task-Based Management System (UTBMS) and Legal Electronic Data Exchange Standard (LEDES) codes have created a path towards greater transparency in legal spend management. Their implementation, however, created issues of their own.

UTBMS codes are problematic for several reasons but primarily because they can be unreliable and the system is totally reliant on each timekeeper to provide accurate data, which they often fail to do. Firstly, timekeepers must be trained and become familiar with the expansive list of codes – a large undertaking. For instance, the Litigation Task Codes (one of several such code sets) has close to 30 legal task codes, each of which rolls up to one of five phases. Adding to the complexity, there are nearly 30 activity codes that may also be applied and many more expense codes.

Secondly, this complexity can cause confusion as to which UTBMS code to apply to which task/activity. In addition, timekeepers may intentionally assign incorrect codes because they are either too busy to search for the correct code or are indifferent to how these codes may benefit them or their clients. One common action is that a timekeeper will select the first legal task code or a commonly used code from the UTBMS drop-down list in their billing software. This saves them time, and they do not see a negative impact from doing so. Other mistakes might be unintentional, involving issues with the billing software or accidental errors that can occur from a user typing or using a drop-down menu to input one of 30 codes. All these errors affect the integrity of the data, making the codes unusable for analytics and therefore frustrating the in-house client.

In truth, the framework of legal task codes was a great achievement for the industry and while it may be possible to refine the UTBMS codes it may not be feasible to make them any simpler. Solving this problem requires being active, adaptive, and creative with the data that is available.

USE OF AI (ARTIFICIAL INTELLIGENCE) IN LAW FIRM TIMEKEEPING

At a law firm, manual time and task logging is a time-consuming, error-prone process that does not benefit itself from being billable. Adding UTBMS or LEDES billing coding to the mix slows the process even further. On top of that, coding mistakes can lead to invoice rejections, while compromising collection rates along the way.

However, new AI (Artificial Intelligence) and machine learning applications can offer solutions to these problems. Instead of submitting bills without review and hoping the client does not dispute the charges, or manually reviewing billing entries prior to submission in order to comply with the client billing rules, new applications are being used to automate the process at law firms.

With previous e-billing solutions, lawyers and other timekeepers would have to manually look up the corresponding UTBMS code for each specific task or expense. With the new artificial intelligence applications, the software will automatically determine the correct code from the task, activity, or expense description. The code selection process uses the law firm’s own data to make sure the codes are accurate and uses machine learning to adjust to any changes. The outside counsel saves valuable time – addressing the issues mentioned above – and the in-house client receives accurate legal bills that have the level of data necessary for analysis of their matters, legal spend, and law firms.

Features and benefits of a legal spend management product like BusyLamp include:

• Easy to use and configure, and use intelligent defaults and data driven user set-up.
• Use text recognition software to read/convert the data from the e-bills or from pdf documents.
• Automate manual, low-skilled processes so both the in-house team and the law firm can spend more time on high value work instead of admin.
• Take advantage of the latest developments in AI (Artificial Intelligence) to automate the bill review process, categorise narratives and provide pricing analytics.
• Combine the above with machine learning to enhance the data mining possibilities of the invoice information for the client to make better and informed decisions.
• Offer a low cost of ownership as they require no on-site installation and are delivered as web services.
• Easily integrated with other client applications such as document/knowledge management, project management, calendaring, and the standard desktop – thus reducing costs for corporate legal IT.
• Cover a wide range of the business processes – from Requests for Proposals and Procurement, matter budgeting, resource planning, project management, through e-billing to a reporting and management information suite with easy-to-understand metrics for corporate legal departments and the law firms.
• They facilitate collaborative working between the client and their outside counsel and allow the client to review WIP and expenses in the pre-billing stages of each matter.

Request a demo of BusyLamp eBilling.Space today.

The Panama papers and Paradise papers cyberattacks against law firms. The issues of data harvesting emerging from the Cambridge Analytica scandal. The volume of reported data breaches. Cyber-attacks and data breaches are becoming inevitable as increasingly high quantities of information are stored electronically. In addition, GDPR has introduced requirements to notify the relevant supervisory authorities and individuals who may be adversely impacted much more promptly (within 72 hours of becoming aware).

As a result, there is a greater need for stronger controls around data security, both within your organization and for companies holding your data. A robust records management policy is integral to your company’s ability to understand what information is available, where it is, and in what format. Most importantly, it sets a clear framework for handling, managing, and storing that data.

You may have agreements with your external partners on how they manage and handle your data; historically, companies may have relied on this with little further investigation.

However, if you have ever handled the fallout of a data breach by one of your suppliers, you will appreciate the pressures of trying to assess the potential risk and exposure the breach might have on your company. All of which must be done within very tight timescales if you need to notify the authorities and individuals concerned.

USING LEGAL SPEND MANAGEMENT SOFTWARE TO IMPROVE DATA SECURITY

One often-overlooked tool that can help (both with an immediate investigation and future risk assessments) is a legal spend management system (Onit’s European legal spend management solution BusyLamp eBilling.Space). Integrated legal spend and matter management software can provide a wealth of information to help legal operations understand and manage the data that the law firms hold for you and can support you in building a records inventory.

Legal spend management tools can provide clarity on the following:

• The external law firms used,
• What type of work outside counsel are undertaking, and
• Who at the law firms has worked on the matter and therefore had access to your data.

Knowing the data shared with your law firm is vital for an immediate investigation. Access to the matter details in your legal spend management system will provide you with a good starting point to gather information. Basic information will include the law firm’s name and the person(s) in your firm who may be working on the matter(s). It will also provide a contact point at the law firm. Finally, based on the work, you will have a rough idea of the documents shared with the firm.

If you are looking to assess the risks of sharing your data both now and in the future, legal spend management software will provide details of the number of times your company has used the firm. With this, you can assess the risks and controls in place with all your outside counsel and carry out appropriate system security assessments. You can also more easily check that the law firms have implemented and are complying with your records management and retention policies.

The amount and sensitivity of the data sent to your law firms comes from the type of work undertaken. Most companies will generally share similar types of data for specific categories of work with their external partners. As an example, for an employment issue, details about the employee and the grievance will be shared with the external counsel. Using the information in a legal spend management system about the types of work done by the law firms will help you assess the risks and controls each law firm has in place to protect your data and consider the best and most appropriate ways to transfer your data. Furthermore, it can help you build your records inventories.

Finally, as law firms record the time that a timekeeper spends working on a matter, invoice data captured by e-billing software will allow you to see who has access to your information at the firm.

Knowing and understanding the type and volume of data that your company has shared with your law firms will help you a) respond to and manage any data breach or data loss and b) understand the potential risks to your data. This knowledge will help you assess whether you are using the best legal technology for sharing your data and whether the processes you have in place to transfer your data are appropriate.

Learn more about BusyLamp from Onit, our end-to-end legal spend management solution built for European corporate legal departments. 

As legal data is highly sensitive, data privacy, cybersecurity, and compliance are the top corporate organizational focus areas. Yet despite the scrutiny in-house legal rightly applies to business activities and counsel, they are not necessarily applying this same focus when evaluating the legal technology, they use within their departments. The sensitive nature of the information that passes through legal systems means that data security should be paramount.

Anecdotally, we hear of legal tech projects where data security requirements are raised late in the game, sometimes after IT becomes involved in the project, and can result in the favourite vendor getting immediately disqualified from the selection because of weak security features and policies.

This is understandable. Most lawyers and even technology-savvy legal operations managers are not data security experts. The main focus when buying legal software are the features that assist in daily work and decision-making, so the “under the bonnet” functionality is not always front of mind, nor do in-house counsel necessarily know the right questions to ask.

The following list of security considerations will aid you in asking pointed questions so you can address system safety at the same time as the ‘core’ functional requirements of the technology. This will save you time in the selection process and make picking the right solution for you that bit easier. There is already a lot of cyber risk that could be affecting your company, your legal technology should not be one of these worries.

ENCRYPTION (“AT-REST-ENCRYPTION”)
Legal documents contain sensitive data. Therefore, encrypt with a secure and up-to-date algorithm. Many legal tech vendors encrypt the hard disk while storing unencrypted data in the database. This interpretation of at-rest encryption is a measure that prevents data leaks in the unlikely event of the theft of a hard disk. Onit’s European legal spend management solution BusyLamp eBilling.Space takes at-rest encryption to the next level by using AES256 to store customer data (including backups) with individual keys securely on the hard disk and in the database. The latter means we apply an additional layer of security as a countermeasure for potential cyberattacks.

ENCRYPTED TRANSMISSION (“IN-TRANSIT-ENCRYPTION”)
The data must not only be stored in encrypted form but must also reach the user securely. Therefore, all communication should be encrypted. Since the methods are prone to attack, always use an up-to-date secure version. BusyLamp uses TLS with the version >= 1.2.

DATA SEPARATION
Especially with software as a Service (SaaS) offerings, it is common for an application to be used by several customers. In this scenario, store client data separately from that of other customers. This prevents access to your data by other users “by accident” (e.g., due to software programming errors). There are several ways to separate data, and BusyLamp offers the most secure options. We can provide physical separation, i.e., a customer has their own server, or the most effective logical separation, i.e., a customer owns its database on shared servers.

DATA ACCESS RIGHTS
GDPR and other internal and external regulations often require access rights to be set at a need-to-know level. Therefore, the legal software must allow data visibility to be set individually for each user. BusyLamp works according to the “principle of least privilege” – the normal user can initially see nothing. Then, specific data access for in-house and outside counsel users is activated on an individual or via group logic.

DATA LOCATION
Everyone is talking about the U.S. PATRIOT Act, CLOUD Act, CCPA, GDPR, and similar data security regulations that can have a massive impact on our client’s data hosting strategies. Onit’s BusyLamp legal spend management software is a German product and hence not subject to any potential claims by the U.S. government under such acts. We store data securely at your preferred geographical location.

FIREWALLS AND SERVERS
Any application is only as secure as the servers it runs on. Every application connected to the Internet becomes a daily victim of automatic or targeted attacks. Therefore, a well-thought-out strategy to defend against these attacks by the legal software operator is essential to ensure the protection and integrity of your legal data. This strategy should include several nested measures (the “onion technique”). First, a web application firewall protects the application itself. In addition, the server group gets protected by a firewall. The last link in the chain is an optimally configured server that fends off all unauthorized access. An independent service should monitor all components and actively report deviations from the norm. Regularly updating all systems involved should go without saying to guarantee up-to-date and optimal protection.

INDEPENDENT SYSTEM PENETRATION TESTS
Precautions taken always look good on paper. But is the vendor keeping their promises? To find out, the legal software provider should have their systems tested regularly by an independent third party. This “planned attack” attempts to remove all security measures before a malicious attacker does. All vulnerabilities found are documented and submitted to the vendor for an immediate fix. BusyLamp is tested at least once a quarter by a team of experts; we also allow all BusyLamp customers to view the corresponding test protocols.

SOFTWARE PASSWORD PROTECTION
Robust passwords are essential to prevent unwanted access to the legal system. BusyLamp has configurable password settings that administrators can set to ensure user passwords are sufficiently strong and meet your company’s password policies.

DATA SECURITY RIGHT FROM THE START
The ability to mitigate the impact of any security breaches is important, but security gaps should not arise in the first place. Therefore, your chosen legal tech vendor must deliver regular training to those involved in developing the software to maintain a consistently high level of data security. When testing the software, check the actual functions and search known security holes (e.g., OWASP Top 10).

Request a demo of BusyLamp eBilling.Space today.