Home / Industries / Professional services
MyRISK · legal, accounting, advisory and consulting
Clients expect proof of the discipline we recommend to them.
Firms handle sensitive client information across partner-led workflows, while AI-assisted work changes what quality control, confidentiality and defensibility have to mean.
Why now
AI makes the review trail more important, not less.
Partner-led work is judgement-led by design, and that is the firm's value. The difficulty is that judgement leaves a thin trail: an acceptance call made on a phone conversation, a conflict cleared on someone's recollection, a confidentiality boundary agreed and never written down.
AI-assisted drafting raises the stakes rather than lowering them. A client asking how work was produced, reviewed and checked is asking about a process you almost certainly follow and probably cannot evidence.
Clients increasingly ask advisers to demonstrate the governance they advise on.
What usually starts the conversation
- A client assurance request, or a panel or procurement questionnaire
- A cyber insurance renewal asking more than last year
- Adopting an AI tool across fee-earning work
- A matter or project quality issue that prompted a look back
- A data incident, or a near miss with client information
- A merger or diligence event putting the firm's own practices under review
Where it bites first
Five decisions worth being able to replay
01
Engagement or matter acceptance
Why this engagement was taken, what was assessed on capability and independence, and what conditions were set.
02
A conflict clearance
What was checked, what was disclosed, who cleared it, and what information barrier was put in place.
03
AI-assisted work governance
Which tools are approved for what, what review a human applies, and how that is evidenced to a client who asks.
04
A quality or delivery call
A scope change, a resourcing decision, or a deliverable released under time pressure — and the review it received.
05
Confidentiality and data handling
Where client material sits, who has access, and the decision that put it there.
—
Not a cyber story
Cyber insurance and confidentiality keep it relevant, and it is not the lead. Acceptance, conflicts, quality and AI-assisted work usually carry the conversation — and most of what is listed above raises no cyber question at all.
What you already have
Your practice systems are not the gap.
Firms at this scale have practice and document management, a conflicts database, a quality or risk function, engagement letters and professional indemnity cover. Each is capable and each holds part of the record.
What none of them holds is the decision as it stood: what was in front of the partner who made it, the alternatives weighed, the authority exercised, and what has drifted since. Trace sits alongside and holds that.
What a Trace record preserves
- The evidence that existed at the time, and the policy version that applied
- The rationale, assumptions and alternatives considered
- Who had authority, and what exactly was approved
- Conditions, expiry and review dates
- Drift — whether changed circumstances unsettle the approval
The proof
What a replay actually produces
The comparison, gaps included
- The decision as evidenced, dated when it was made rather than when it was written up
- Each evidence item found, where it was held, and how long retrieval took
- Evidence that should exist and does not — named individually rather than summarised
- The approvals that were verbal and cannot now be confirmed
- The conditions attached at approval, and which have been reviewed since
- What a reviewer would ask that the current record cannot answer
The Diagnostic runs this against one decision you choose. The output includes what is missing, which is the part that makes it worth having before someone else asks.
Who this is for, and who it isn't
Scale changes which problem you have
Larger advisory, legal and accounting firms
Risk and quality functions already exist. The pressure is client assurance and defensibility — being able to show how a specific decision was reached.
Smaller firms and practices
What is needed is practical control without enterprise bureaucracy: key-person risk, capacity, delivery follow-through, and one current picture for the insurer.
If what you want is an AI policy document, that is not this. A policy nobody applies is the problem being described above, not the fix for it.
For your reviewers
The boundaries, in writing
What this is not
- Not legal advice, and not a professional-standards or regulatory opinion. The record holds what was decided and why; the professional judgement remains the firm's.
- Not a practice management or document management system, and not a conflicts database. It records the decision, not the matter.
- Not an AI policy pack, and not generic cyber consultancy.
- Client material is never requested through a public form. Privileged and confidential information stays where it is; a redacted extract or a walkthrough is how the first conversation works.
What would you send a client who asked how you govern their work?
If the honest answer is that it would have to be written for the occasion, that is the gap — and one engagement decision is enough to see its shape.