Offshore Operations Risk Review
Offshore work can reduce cost and increase capacity. But does your firm know exactly what comes with it?
Law firms increasingly use offshore employees, contractors and service providers for administrative, paralegal, finance, technology and other operational work.
The risk is not simply that work happens overseas. It is that the firm's principals may not have a complete picture of who has access to client information and systems, what work they perform, how that work is supervised, and whether the controls the firm expects are actually operating.
JurisIT helps you establish the evidence.
Could you answer these questions today?
If your firm uses offshore resources, could you readily demonstrate:
- who is currently performing work for the firm and where they are located?
- whether your provider uses subcontractors?
- which client and matter information offshore personnel can access?
- which Microsoft 365, practice management, document management and other systems they can access?
- whether access is limited to what each person actually needs?
- how identities, devices and authentication are controlled?
- whether information can be downloaded or stored outside approved systems?
- how offshore work is supervised, reviewed and approved?
- what happens when an offshore worker leaves or changes role?
- how an incident involving the offshore provider would be handled?
- what happens if the offshore service suddenly becomes unavailable?
If some answers are "we think so" rather than "we can demonstrate it", the arrangement may warrant a closer look.
Read more about the obligations involved: Offshore staff in Australian law firms: obligations, risks and controls
Start with the Offshore Operations Risk Snapshot
Free
The Snapshot is a short structured assessment of your firm's offshore operating model.
It looks across areas including:
- People and providers
- Who performs work for the firm, where they are located and who is responsible for the arrangement.
- Client information
- What client, matter and other sensitive information offshore personnel may encounter.
- Systems and access
- What offshore personnel can access across Microsoft 365, your practice management and document management environments, and other relevant systems.
- Security
- How identities, authentication, devices, permissions and access are managed.
- Supervision and workflow
- How offshore work is allocated, supervised, reviewed, escalated and approved.
- Privacy and confidentiality
- How personal, client and confidential information is handled within the offshore operating model.
- Provider governance
- How personnel changes, subcontracting, incidents and responsibilities are managed.
- Continuity
- What happens if the offshore provider or capability becomes unavailable.
What you receive
Your Offshore Operations Risk Snapshot identifies:
- apparent strengths;
- areas of uncertainty;
- priority risk indicators; and
- areas that may warrant evidence-based verification.
With your Snapshot, we confirm the scope and fixed fee for a Risk Review, if one is warranted.
The Snapshot reflects the information provided by the firm. It is indicative and self-reported. It is not verified evidence.
From "we believe" to "we can demonstrate"
Offshore Operations Risk Review
Where the Snapshot identifies something worth examining, the next step is an evidence-based Offshore Operations Risk Review.
The Snapshot establishes what the firm reports.
The Risk Review establishes what the available evidence demonstrates.
We confirm the scope and examine the relevant documentary, operational and technical evidence.
Depending on the issues being reviewed, that may include evidence relating to:
- offshore personnel and providers;
- locations and functions performed;
- client and matter information flows;
- Microsoft 365 and application access;
- identities and permissions;
- devices and security controls;
- onboarding and offboarding;
- work allocation and supervision;
- confidentiality and information handling;
- provider arrangements and responsibilities;
- incidents and escalation; and
- business continuity.
What you receive
The Risk Review gives management a documented baseline showing:
- What could be verified
- What could only be partially verified
- What was not evidenced
- Where evidence conflicts with the reported position
- What matters warrant attention
- What should be addressed first
The Review identifies the problem and its priority. It does not force you into a JurisIT implementation project.
Two levels of review
Focused Risk Review
- For a clearly defined offshore arrangement or specific area of concern within standard scope limits.
- Fixed fee, confirmed with your Snapshot. No separate scoping engagement.
- You know the price and scope before the Review commences.
Broad Risk Review
- For multiple providers, systems, locations or significant areas requiring examination.
- Scope agreed first, followed by a fixed quotation.
- You know the price and scope before the Review commences.
If something needs to change
A Risk Review tells you what is wrong, why it matters and what should be addressed first.
If more detailed work is required, the next step can turn those findings into an implementation-ready Offshore Operations Remediation Plan.
A Plan can define:
- the required outcome;
- actions required;
- priority and sequence;
- responsible parties;
- dependencies;
- evidence required for completion; and
- the test for closing each finding.
The plan is yours
You can ask your existing IT provider, your offshore provider, your internal team, another specialist or JurisIT to implement the work.
Where several parties are involved, the Plan provides a common specification against which responsibilities and completion can be tracked.
WE IDENTIFY THE REQUIRED OUTCOME. YOU CHOOSE WHO IMPLEMENTS IT.
Or JurisIT can help implement it
Where requested, JurisIT can implement appropriate work directly, coordinate changes with your existing providers, or work alongside them.
There is no requirement to replace an incumbent technology or offshore provider simply because JurisIT conducted the Review.
Implementation is separately scoped and fixed-priced.
Completion means more than ticking a task off a list.
Implement → collect evidence → retest → close
Keep it under review
Offshore Operations Health Check
An offshore operating model does not remain static.
People change. Responsibilities change. Systems change. Access changes. Providers change.
The Health Check periodically compares the current position with the firm's established baseline and highlights material change, missing evidence, unresolved findings or control drift.
What management receives
A periodic Control Status and Management Attestation Pack summarising:
- the current control position;
- material changes since the previous review;
- evidence requiring refresh;
- open findings or exceptions;
- remediation progress; and
- matters requiring management attention.
The firm remains responsible for its management decisions and any attestation it makes. JurisIT maintains and reports the supporting evidence and control status within the agreed scope.
Start where it makes sense
You do not have to buy the entire service pathway.
- Start with the free Snapshot and stop if nothing warrants further investigation.
- Commission a Risk Review and handle the findings yourself.
- Obtain a Remediation Plan and give it to your existing providers.
- Ask JurisIT to implement some or all of the Plan.
- Use the Health Check to monitor the resulting position over time.
Each stage has value in its own right.
Frequently asked questions
-
No. The Snapshot is a structured questionnaire. Access is only needed for a Risk Review, and then it is read-only and time-limited. We make no changes to your environment during a Review.
-
Not without your agreement. Most Review evidence comes from your own systems and documents. Where provider evidence is needed, we agree with you how it is requested.
-
No. We review controls, evidence and arrangements against the obligations that apply. If a matter needs legal advice, we will tell you.
-
A Focused Risk Review is typically completed within five business days of receiving the agreed access and documents. Broad Risk Reviews are scheduled when the scope is agreed.
-
The Snapshot still applies. For a Risk Review, we will confirm with you what evidence can be examined in your environment before you commit.
Not sure whether your offshore arrangements need a closer look?
Start with the free Offshore Operations Risk Snapshot.
Find out where you may need to look more closely before committing to a paid review.
For Australian law firms using offshore employees, contractors, virtual assistants or outsourced service providers.