Safety Norms: Corporate and Commercial Law Practice

1Purpose, Scope, and Safety Principles

These norms protect clients, colleagues, the public, and the firm from harm arising from corporate and commercial legal work. Harm in this field is usually financial, reputational, or legal rather than physical, but it can be severe: a leaked term sheet can move a share price, and an unrecorded conflict can disqualify a firm from a transaction. The scope covers lawyers, paralegals, trainees, legal secretaries, contract managers, and temporary staff, whether they work in an office, at a client site, in a virtual data room, or remotely.

Clients rely on the firm to keep deal information, board discussions, and negotiation strategy confidential. Most failures come from ordinary habits such as forwarding the wrong attachment, leaving a printed draft in a meeting room, or naming a target company during an open office call.

This document is educational guidance only. It does not replace professional authorization, formal training, supervision, approved firm procedures, or advice from qualified professionals. Professional conduct rules, privacy laws, sanctions regimes, and anti-money-laundering obligations are jurisdiction-dependent and must be verified with the relevant bar, regulator, or counsel.

• Mandatory: no substantive work starts on a matter until conflicts clearance is recorded.
• Mandatory: client information is shared only on a need-to-know basis.
• Recommended: hold a short safety briefing at the start of each large transaction.

2Roles, Competence, and Accountability

The responsible lawyer owns the matter and its risks. They approve the engagement scope, confirm conflicts clearance, and sign off on material advice. The conflicts officer maintains the conflicts register and can place a hold on new work. The information security lead sets data handling rules and approves secure transfer tools. The records manager controls retention schedules and file access. Each individual remains accountable for following these norms and for raising concerns in writing.

Competence means the person holds the qualification, admission, training, and supervision needed for the task. Junior staff must not advise on a jurisdiction, regulatory regime, or transaction type outside their experience without documented review. Anyone without authority to sign or certify a document must decline, even when a client asks informally.

Accountability should be visible. Each matter file names its responsible lawyer, conflicts reviewer, and information handling lead. Where two people share a task, the file records who does what. Supervisors must confirm that staff have the training and access they need before they handle live client work, and they must step in when workload pressure starts to erode checks.

• Responsible lawyer: approves engagement scope, conflicts clearance, and final advice.
• Conflicts officer: maintains the register and can stop a matter pending review.
• Records manager: applies retention schedules and reviews matter file access.
• Individual: declines tasks outside competence and escalates in writing.

3Realistic Hazards and Risk Assessment

The main hazards in corporate and commercial practice fall into five groups: confidentiality breaches, conflicts of interest, information security failures, financial and transactional errors, and deadline or quality failures. Physical hazards also exist in offices and meeting rooms, including trips over cables, overloaded power strips, and fire risk in records or server rooms.

Each matter needs a short written risk assessment at opening and whenever scope changes. Rate each hazard as low, medium, or high using the firm's approved scale, based on likelihood and consequence, and record the person responsible for the control. A cross-border acquisition involving personal data, sanctions exposure, and a short signing window carries far more risk than a routine supply agreement, and the controls should reflect that difference.

• Confidentiality leak: high. Examples include discussing a target by name in a lift or sending a draft to the wrong recipient.
• Undisclosed conflict: high. Example: acting for a buyer while a related entity is an existing client.
• Cyber intrusion or business email compromise: high. Fake payment instructions are a common method.
• Misdirected funds in escrow or completion payments: high. Requires independent verification by telephone on a known number.
• Missed deadline on filings, notices, or exclusivity periods: medium to high. Requires a diarized calendar checked by two reviewers.
• Ergonomic strain during long document review: medium. Requires workstation setup and regular breaks.

4Preventive Controls and Safe Working Practices

Preventive controls work best when built into routine steps rather than left to memory. Conflicts clearance must be completed and recorded before the firm receives confidential information, issues an engagement letter, or attends a meeting on the matter. Where a conflict is identified, the matter stops until the responsible lawyer and conflicts officer decide whether information barriers, client consent, or withdrawal is required under the applicable rules.

Payment and document control follows a dual control model. No single person may both prepare and release a payment instruction. Changes to bank details must be confirmed by a call to a number already held on file, never a number supplied in the change request. Signature pages are collected only from authorized signatories and checked against the authority documents.

Safe practice also includes declining work. A lawyer must not accept an instruction where clearance, a license to practice in the relevant jurisdiction, or specialist input is missing. Where timing pressure pushes a team to skip a step, the rule is to pause and escalate rather than proceed on informal assurance.

• Mandatory: complete the conflicts search and record clearance before substantive work.
• Mandatory: verify every bank detail change by callback to a previously recorded number.
• Mandatory: apply a two-person check to funds flows and closing sets before release.
• Mandatory: use the approved secure file transfer tool, never personal email or consumer file-sharing apps.
• Mandatory: mark privileged and confidential material and keep it away from shared printers and public areas.
• Recommended: circulate a closing checklist and a single version-controlled document index.
• Recommended: limit data room permissions to named users and review them at regular intervals during active deals.

5Equipment, Environment, and Information Safeguards

Equipment and environment controls protect people and information. Workstations should allow a neutral posture, with the screen at eye level and the keyboard positioned so the wrists stay straight during long review sessions. Laptops and mobile devices must be encrypted, protected by strong authentication, and locked when unattended. Removable media is not used for client data unless information security has approved it.

Ergonomic setup matters because corporate work often means long hours of reading and drafting. Adjust chair height, use a separate keyboard and monitor where a laptop is the only device, and take short breaks away from the screen at regular intervals. If a person reports persistent pain or symptoms, refer them to occupational health or a qualified clinician rather than offering self-treatment advice.

Meeting rooms and deal rooms need controls too. Whiteboards are cleaned after sessions, printed drafts are collected, and screens are angled away from windows and reception areas. Records and server rooms require clear access lists, working fire detection, and no stored combustibles. Data protection and privacy requirements, including breach notification timelines, depend on the jurisdiction and must be confirmed with qualified privacy counsel.

• Mandatory: lock screens whenever the desk is unattended.
• Mandatory: report lost or stolen devices to information security immediately.
• Mandatory: shred paper drafts through locked consoles; never place them in general waste.
• Recommended: keep walkways and cable runs clear and check power strips for overload before use.
• Recommended: adopt a clean desk approach during client visits.

6Incident Reporting, Emergency Response, and Escalation

Any confidentiality breach, suspected cyber incident, misdirected payment, missed deadline, regulatory inquiry, or near miss must be reported immediately to the responsible lawyer and the information security or risk lead. Reports are made in writing the same working day, even when the issue appears minor. Near misses are recorded because they reveal weak controls before harm occurs. Staff must not attempt to recall or correct misdirected material without instruction.

Emergency response covers physical and information events. For fire, injury, or a medical emergency, follow the building evacuation plan and call local emergency services; do not attempt rescue or first aid beyond your training. For suspected ransomware or account takeover, disconnect the device from the network only if information security instructs you to, do not power off devices without guidance, and preserve evidence. Notification duties to clients, regulators, insurers, and courts vary and must be assessed promptly with counsel.

Staff should also know who may speak to the press, regulators, or counterparties about an incident. Only the designated spokesperson or responsible partner does so, after counsel has reviewed the content. Informal comments can create legal exposure and worsen the situation.

• Mandatory: report any misdirected payment to the bank and the responsible lawyer at once, because delay reduces recovery options.
• Mandatory: notify professional indemnity insurers within the timeframe stated in the policy, as confirmed by the firm's risk team.
• Mandatory: escalate any threat, harassment, or pressure from a counterparty to the responsible lawyer.
• Recommended: keep a contact card listing the responsible partner, information security lead, and building emergency contacts.

7Records, Training, Monitoring, and Review

Records prove that controls operated. Keep conflicts clearance records, risk assessments, dual control logs, training records, incident reports, and access review results in the matter or governance file under the approved retention schedule. Retention periods depend on law and professional rules and must be confirmed by the records manager. A file note explaining why a conflict was cleared or a deadline was extended is as important as the decision itself.

Training is mandatory for all new staff before they access client data, and it is refreshed when systems, rules, or roles change. Monitoring includes periodic spot checks of matter files, regular access reviews, and analysis of incident and near miss trends. Findings lead to corrective actions with a named owner and a due date. This document should be reviewed at least annually and after any significant incident.

• Mandatory: complete information security and conflicts training before assignment to a matter.
• Mandatory: record each corrective action with an owner and evidence of completion.
• Recommended: run a tabletop exercise on a simulated wire fraud scenario at regular intervals.
• Recommended: compare near miss trends across matters to find recurring weak controls.

Implementation checklist

• Conflicts check recorded before substantive work begins.
• Scope and risk assessment on file and updated after any material change.
• Bank detail changes confirmed by callback to a number already on file.
• Funds release requires two independent approvers.
• Data room and file access limited to named users and reviewed during active deals.
• Laptops and phones encrypted, locked, and approved for client data.
• Incidents, near misses, and misdirected material reported in writing the same working day.
• Emergency contacts and evacuation route known to every team member.
• Training and retention records kept current and available for review.
• Local procedures and legal requirements verified with qualified professionals and regulators.