Technology can often be a catch-22 for law firms. Sure, it allows them to reach new heights of efficiency and cost savings, but it also increases their risks of cyber threats, inadvertent disclosures and human error.

Law firms are becoming increasingly aware of such risks—but that doesn't mean it's getting any easier to manage them.

According to American LegalNet's “2017 Risk Management Survey” of IT and legal directors, CIOs and CTOs, and other managers at 186 U.S.-based law firms, though law firms have high confidence in their ability to address risk, many still face ongoing management challenges.

Over 75 percent of surveyed respondents said their firm was capable of addressing and mitigating risk in their business. Slightly over 50 percent, described their firms' risk as coming from cyberthreats, malware, ransomware and viruses, while 22 percent cited human error and negligence.

But despite this confidence, 49 percent noted that malpractice suits against their firms increased “significantly in recent years,” while 44 percent were unsure if such suits would grow or decrease. What's more, almost 58 percent noted their firm is planning to invest more over the next 12 months in risk management technology and processes.

When asked about the underlying causes of malpractice suits against their firm, around 36 percent cited human error and negligence, while almost 35 percent said they did not know.

Erez Bustan, CEO of American LegalNet, said that the growing amount of malpractice suits against law firms was due to the fact that many had to manage risk on multiple fronts—not just cybersecurity and negligence, but also compliance risks stemming from M&As, mobile devices and other areas.

He also noted that law firms' investment in risk management processes and technologies “is going to be ongoing,” in part because their clients are demanding they meet specific security standards or deploy specific cybersecurity technologies.

What's more, insurance companies may require law firms to also have a set of policies and technologies in order to be covered for liability risk, Bustan added.

Given their responsibilities in addressing risk, more law firm employees are also becoming more aware of their firm's risk management operations. The survey found that slightly less than 29 percent of respondents, for example, did not know who was in charge of their risk management program in 2017, a drop from 38 percent in 2016.

It became less likely, however, that general counsel were in charge of the risk management program. Only 19 percent of law firms turned to their GC to oversee risk management, down from 38 percent in 2016. Separate compliance or risk management heads were the second most likely, 16 percent, to oversee such programs, followed by CIOs or CTOs, at 14 percent.

Bustan explained many law firms were moving to grow their in-house risk management teams, either by spinning them off into entirely separate departments or putting them under the purview of the IT department. “Today law firms are creating more and more positions to handle their risk,” he said.

Rhys Dipshan can be contacted at [email protected].