You change costs draftsman after nine years and ask for your papers back. What arrives is a link to somebody's personal cloud folder holding part of a run of matters, with no record of when the papers went out, who sent them, or what else that draftsman still holds.
Nobody in the firm did anything wrong on any single day. The arrangement began before the current managing partner took over, the terms were settled in an email chain, and the fee earner who settled them retired years ago.
Try an illustrative count on your own firm. Ask a partner to name, without leaving the room, every outside organisation that holds client papers or touches client data, and you tend to get four, being the cloud host, the IT support contractor, the off-site storage company and the costs draftsman. Then spend an afternoon walking the building and reading the purchase ledger. The number runs to three times that once you add the transcription service, the process server, the search provider, the translation agency, the confidential shredding contractor, the outsourced cashier, and the marketing agency given access to the enquiries inbox. Both counts are illustrative rather than researched, and the gap between them is the point.
Responsibility stays with your firm
Sending work outside does not send the responsibility with it. Your client engaged your firm, and the SRA Standards and Regulations expect a firm to run effective systems and controls over its business, including work carried out on its behalf. A supplier failing is your firm failing in front of the client and the regulator, whatever the invoice says about who did the typing.
Confidentiality attaches to the client's papers wherever those papers physically sit. Under data protection law, where your firm decides why and how personal data is processed, your firm stays the controller and the outside organisation processes on your instructions as your processor. That calls for a written arrangement setting out what the supplier can and cannot do with the material, a settled answer on where the data sits, and an answer on whether the supplier passes any of the work to somebody else. A transcription service using overseas typists is a different proposition from one that does not, and you want to know which you bought.
The practical step needs nothing from anybody selling you software. Write one list. Every outside organisation that holds client data or does work on your behalf goes on it, with the partner who owns the relationship, what it holds now rather than what it was engaged to hold, the written terms behind the arrangement, and the date somebody last read them. Add where the data sits, and what happens at the end.
Then add the column firms leave out. If that supplier stopped trading on a Friday, what would come back to you, in what format, and how quickly. Test the exit as hard as you tested the entry, because the entry is the part everybody negotiates. Ask each supplier, in writing, who else it uses. Give every arrangement a named internal owner, since the reason the list does not exist already is that no one person ever held the whole of it.
Building the list from your own records
The Bracton AI Assistant is built into Bracton, the case and client management platform, and a firm contracted elsewhere runs the assistant against the system it already has, LEAP, Clio, Proclaim or another system with an interface. Overnight it reads across every live matter and builds a derived record of where your work and your papers have gone outside the firm, what went, when it went, and what has come back, so the list starts from your own file record rather than from what four people remember in a partners' meeting. Everything it produces goes to a qualified fee earner for sign off.
What it does not do is worth stating plainly. It does not inspect a supplier's security, it does not read a supplier's contract for you, and it does not form your firm's judgement on whether an arrangement is adequate. The record tells you what left and where it went. Deciding that the arrangement on line eleven has to change is a partner's job.
The Bracton client account review reads an export of your client ledgers, the cash book and the bank statements against the SRA Accounts Rules and nothing else. It does not inspect suppliers and it does not open matter files. Where the cashiering itself is outsourced, though, that review is a read of records somebody outside your firm keeps on your behalf, judged by somebody who did not keep them, which is the same discipline on a smaller question. If that is the supplier you would rather know about first, book a client account review.