Law Firm Compliance Checklist

Pull the current state bar Rules of Professional Conduct and any amendments adopted since the last review. Note changes to Rule 1.6 (confidentiality / tech competence), Rule 5.5 (UPL across state lines), and any new advertising rules under Rule 7.x. Circulate a one-page summary to all attorneys.

Check the firm website, attorney bios, social media, and any paid advertising against Rule 7.1 (no false or misleading communications) and state-specific disclaimer requirements. Common gotchas: outdated practice area listings, unverified specialist claims, and missing "prior results do not guarantee" language.

Pull each attorney's CLE transcript from the state bar. Confirm general hours, ethics hours, and any mandatory diversity or mental-health hours separately — they're not interchangeable. Flag anyone within 60 days of their reporting deadline.

Check the carrier's declarations page for renewal date, per-claim and aggregate limits, and that all current attorneys are listed. If the firm is in a state requiring disclosure of non-coverage to clients, verify that disclosure is in the engagement letter template.

Reconcile bank statement balance, book balance, and the sum of individual client ledgers — all three must agree to the penny. Pull the report from Clio Trust, Tabs3 Trust, CosmoLex, or whichever PMS holds the trust ledger. Any discrepancy is investigated before partner sign-off.

Trace every transaction since the last clean reconciliation. Common causes: bank fees posted to IOLTA instead of operating, deposits credited to the wrong client ledger, or a stale outstanding check. Document the cause and the correcting entry. If commingling is suspected, escalate to managing partner same day.

An overdraft on any individual client matter is a Rule 1.15 violation, even if the aggregate IOLTA balance is positive. In most states the bank notifies the disciplinary counsel automatically. Sort the client ledger report by balance ascending and review every line at or below zero.

For each transfer from IOLTA to operating during the period, match it to a delivered invoice with sufficient earned fees on that client matter. Transfers ahead of an invoice or in excess of earned fees are improper, even with retainer authorization in the engagement letter.

Sweep matters opened since the last review and confirm every client, related entity, opposing party, and material witness is indexed in the conflicts system (Clio Conflicts, IntApp Open, NetDocuments + ConflictChex). Names captured only in the matter narrative but missing from the parties list cause false-clean conflict checks.

Pull every matter opened in the period and confirm the conflicts search was run and documented before the engagement letter went out. Flag any matter opened without a clearance memo. Note any hit that required waiver under Rule 1.7(b) for follow-up below.

For each conflict hit cleared by waiver, verify a written informed-consent letter signed by every affected client is in the matter file. Oral consents are not sufficient under Rule 1.7(b)(4). If a waiver is missing, draft and send before continuing representation.

List every system that touches client matter data: DMS (NetDocuments, iManage, Worldox), email, PMS, eDiscovery platforms, e-signature, file-share. Map each to a vendor, a data-residency location, and the matter types it holds. Rule 1.6(c) requires reasonable safeguards proportional to the sensitivity of the data.

Pull the admin reports from Microsoft 365 / Google Workspace and the DMS to confirm 100% MFA enrollment for attorneys and staff. Departing-employee accounts should be disabled, not merely password-reset. Document any exceptions and the compensating control.

Pick three closed matters and confirm the former client's portal access was revoked at file close. A common breach pattern is a lapsed client retaining indefinite access to the portal because no one revoked credentials at close-out.

Every vendor that processes client data needs a written confidentiality agreement consistent with Rule 1.6 — DMS, eDiscovery, transcription, virtual paralegal services, document destruction. Health-related matters may also need a BAA. Flag any vendor onboarded in the period without an executed agreement.

Confirm the firm's schedule still matches the state bar minimum (commonly 5–7 years post-close) and any longer matter-specific requirements: estate planning files often kept for the life of the testator, real estate files for the life of the title, IOLTA records typically 7+ years.

Run the closed-matter report and filter for files whose retention clock expired in the period. Cross-check against any active litigation hold — a file under hold is never destroyed even if past retention. Produce the destruction list for partner approval.

Spot-check matters closed in the period for the closing letter, final invoice, trust-balance disposition (refund or transfer), and original-document return receipt. Missing closing letters cause fee disputes years later when the client claims the engagement never ended.

Coordinate with the certified destruction vendor for paper files and the IT team for electronic. A second person witnesses each batch — destruction without a witness is a chain-of-custody gap if a former client later subpoenas the file.