It will no longer be looking solely at individual responsibility for acts and omissions: it is also going after organisational under-performance and misconduct.

This new approach is reflected in changes to the Solicitors' Code of Conduct (the code). So, when the regulator says “you” must do something, in most cases this now means both solicitors and recognised bodies (the new label for what most people would still call “a solicitors' firm”).

These changes are backed up by enforcement powers. For minor infractions the SRA will be able to fine firms up to £2,000 and apply conditions to their authorisation. For the more serious cases the Solicitors Disciplinary Tribunal (SDT) has the power to levy unlimited fines on all types of firms, their managers and employees.

Firm-based regulation is a sensible and inevitable development. For one thing, it corrects an anomaly under the old code whereby the SRA directly regulated individual solicitors and incorporated law firms but not partnerships. But the changes go further than this. Take for example r 23.01. It provides for the application of the code. Somewhat surprisingly, it also says that most of the rules in the code are to apply to all employees of solicitors' firms as well as their managers. This means that everyone in the firm—from the head of marketing to the person who buys the biscuits—needs to know about the arcana of r 9 (Referrals of business) and r 3 (Conflicts of interests), to take but two examples.

It is curious that the SRA should want to extend the application of the rules to all employees. After all, the principals of a firm are already duty-bound to exercise appropriate supervision over staff and ensure proper supervision of client matters, and non-solicitor employees can be banned from employment by solicitors' firms under s 43 of the Solicitors Act 1974.

At a practical level, firms should already be thinking about the implications of this extension of the SRA's reach. For example, should training be rolled out to all employees regarding core aspects of the code? Would it be sensible to write into employment contracts an obligation to obey the code? The SRA will be expecting firms to address these issues.

Firm-based regulation also brings in a new approach to enforcement. The SRA's proposals in this regard were set out in its Consultation Paper no. 16, Legal Services Act: New forms of practice and regulation (the consultation closed on 31 March 2009).

Until recently while the SRA's investigation and enforcement activities could be focused at either the firm or the solicitor, the sanctions for misconduct had to be delivered at the individual level. So it was solicitors and partners who were reprimanded and fined, not firms.

This approach made sense from a historical perspective. Professional conduct rules have their origins in codes of ethics. They applied at the level of individual morality and decision-making. This was reflected in findings of misconduct. For the individual to be responsible in conduct, usually the prosecuting authority had to prove an element of culpability, some sort of mens rea. However, as the sophistication and size of professional services firms increased, this focus on the individual became less effective and in the larger firms the personal responsibility of partners became unavoidably diffuse.

To illustrate the point, suppose a cashier circumvents inadequate financial controls and steals client funds. Who should bear the regulatory blame? There are a number of candidates. Should it be the partners at the time of theft, or the partners who agreed to put in place the inadequate systems, or the managing partner responsible for implementing the financial controls, or all of the above? The difficulties of collective responsibility are particularly apparent in those parts of the conduct rules that say the principals “must ensure” that something is done. For example, r 6 of the Solicitors' Accounts Rules 1998 provides that all principals “…must ensure compliance with the rules by the principals themselves and by everyone else working in the practice”. This rule led the SDT recently to say of a partner that “…he had an absolute liability in his capacity… not a mere vicarious liability” for breaches of the rules by his fellow partner (Decision no. 9799–2007).

While the language of “absolute liability” seems more appropriate to the law of civil remedies than professional conduct, it is understandable that a disciplinary tribunal might take this approach where one partner, through culpable oversight, inadvertently allows another partner to breach the rules. But what if the procedures in a firm are above reproach? There are few if any systems of financial controls that cannot be subverted by the determined. In such a situation, is it fair to impose strict responsibility on “innocent” partners for the misconduct of an employee?

In the view of the author, as long as the sanction for misconduct is delivered to the individual, there can be little or no justification for any principle of strict (or collective) regulatory responsibility. If the purpose of a conduct rule is to change behaviour, and compliance with the rule is encouraged by the prospect of sanctions to be applied to the individual, then there is no point to a rule that can be breached by an individual without fault or culpability on his part.

Firm-based regulation changes all this. If a firm can breach a conduct rule then a sanction at that level must follow. And, of course, it is easy to argue that firm-targeted sanctions, especially fines, are effective because they have such an impact on the bottom line. But there still needs to be some sort of intellectual underpinning to the occasions when a firm is the right choice of target for enforcement activity. An obvious place to look for this is in the SRA's consultation paper 16.

In that paper the SRA identified a number of sensible advantages to taking enforcement action against a firm. For example, it would be more cost-effective to target a firm, as improving a firm's performance offers benefits for its current and prospective clients. Interestingly, the SRA also said that firm-based enforcement would arguably be “less emotive” as it would avoid the need to apportion responsibility among partners. This implies that for at least some types of regulatory failings the SRA will not try to drill down in its investigation and identify the individuals responsible. It is unclear, however, when this would happen.

More ominously, the SRA cited as an advantage of firm-based enforcement that it “encourages collective responsibility”. Having read the consultation paper carefully, one could be forgiven for thinking that the word “encourages” should have been replaced with “creates”.

Certainly this attitude is reflected in one of the questions consulted upon. Where a disciplinary penalty is to be applied to a firm, the SRA proposes that the decision to do so should form part of the disciplinary record of all the managers in the firm.

The SRA cited the example of phoenix firms to justify this approach. The nature of this phenomenon is unclear, but it seems the regulator has in mind situations where managers walk away from a firm with a poor disciplinary history and set up a new firm, thereby scrubbing their records clean.

This seems a rather weak justification for such a contentious proposal. First of all, it implies that the SRA needs this ability because it has difficulties in dealing with phoenix firms. If true, that would be a concern. Second, tagging all managers of a firm with a firm-based disciplinary finding seems a very blunt instrument to identify underperforming individuals. Wouldn't it be better just to focus on the individual managers?

The proposal is contentious for a number of other reasons:

The SRA says it wants an “open relationship” with regulated firms. But this is no request for permissiveness; indeed, it is the very opposite.

The regulator argues that if firms are to be trusted with the task of ensuring their employees' compliance with the code then they should be duty-bound to disclose problems. The SRA therefore proposes that the foundation of its relationship with firms should be core duty, ranking alongside such fundamentals as integrity, independence and the rule of law. It will be something like this: “A firm must deal with its regulators in an open and co-operative way, and must disclose to the SRA appropriately anything relating to the firm of which the SRA would reasonably expect notice.”

This duty of Maoist self-criticism is worryingly vague. What exactly are the limits of the phrase “reasonably expect”? One cannot help but feel that compliance with such a duty will be judged with hindsight and only from the perspective of the regulator.

The proposed rule is lifted from the Financial Services Authority's (FSA) Principle 11 and Statement 4 of Principles for Businesses and Statements of Principle for Approved Persons. It is therefore helpful to look to the experience of that sector in anticipating the effect this rule might have on solicitors.

Experience suggests that Principle 11 is used to reinforce other rules. For example, where a systemic error is discovered, the FSA will express greater concern where the firm did not rush to tell the regulator. The duty has also been used to require firms to inform their regulator of any changes to their business models that might affect the risk they present to the public. Of course, confessing to the regulator can have a downside as well. The NatWest Three claimed that they only came to the attention of the US authorities because they volunteered information to FSA investigators.

One might be forgiven for thinking that a duty like this has other less obvious advantages for the regulator. The government's Better Regulation Executive encourages regulators to simplify their rules. What better way could there be of getting rules off-balance sheet than to require a regulated person to decide what should be notified, as compared to the regulator setting items out in a list?