Alternative Business Structures (ABS) in Arizona already audit themselves. The rule that governs the program requires it. The firm’s Compliance Lawyer reviews the firm’s policies and procedures twice a year and writes a report. A firm that completes that review carefully may conclude it is in good shape.
It may be right. The self-audit cannot say. It asks whether procedures exist and whether they are being followed. It is answered by the people who wrote the procedures and who run them. That is a reasonable design for internal monitoring. It is not a test.
An external audit is a test. This article sets out what it should test, how it differs from the firm’s own review, and what a useful result looks like.
A policy is not a control
A policy states what should happen. A control is the mechanism that makes it happen, and the evidence that it did.
A conflict-checking policy says every new matter is checked before intake. The control is the check itself: who runs it, against which database, who reads the result, and who signs the waiver when a conflict is found. Paper compliance is having the policy. Operational compliance is being able to show, matter by matter, that the check ran and someone acted on it.
The gap between the two is where risk lives. Policies are the easy part. They are written once. Controls have to operate in every office, every practice group, and every month of the year, and the firm has to be able to prove it.
What the firm already reviews about itself
Arizona licenses and regulates ABS organizations through the Arizona Supreme Court under Arizona Code of Judicial Administration § 7-209. An ABS is a business entity that includes nonlawyers with an economic interest or decision-making authority in the firm and that provides legal services under the court’s rules. Each ABS must designate a Compliance Lawyer. Among that lawyer’s duties is a semi-annual compliance audit of the firm’s internal policies and procedures, with a written report retained at the end of each one.
A semi-annual compliance audit form for Arizona ABS firms shows what that review covers. It walks through conflict checking, client intake and signed fee agreements, data and document security systems, trust accounting, business stability and finances, ancillary businesses and their access to client data, training, client complaints, inquiries from regulatory bodies, and action items before the next audit. It suggests reviewing a random sample of engagement letters.
That is a sound checklist. The rule’s code of conduct expects more than a checklist: effective governance structures, systems, and controls; records that demonstrate compliance; protection of lawyers’ professional independence; client property held separately from the firm’s; monitoring of financial stability; and management of material risks, including risks from connected businesses. The rule also places individual responsibility on the nonlawyer owners and decision-makers, not only on the Compliance Lawyer.
The self-audit is a management attestation. It records what the firm believes about itself. It is necessary. It is not independent.
Why an external audit is different
Four things separate an external audit from the semi-annual review.
- Independence. The auditor has no role in the firm’s operations, reports to leadership and the board rather than to the people who run the controls, and has no consulting outcome riding on the findings.
- Evidence. Answers are not accepted. They are traced to documents, system records, and reperformance. A control with no evidence is treated as a control that did not operate.
- Sampling and testing. The auditor selects the matters, transactions, and user accounts, and tests each one against the policy. The selection is the auditor’s, not management’s.
- Operating effectiveness. The question is not whether a control was designed well. It is whether it worked, throughout the period, every time it should have.
The output differs too: findings, a risk rating for each one, and a roadmap with owners and dates.
Ten domains, ten tests
Koers organizes an ABS audit around ten domains. Each one below pairs a domain with one test an independent auditor should perform. None of them can be completed by reading a policy.
1. Ownership and governance
Compare the ownership and decision-making structure disclosed to the regulator with the operating agreement, board and management minutes, and a sample of significant decisions. Confirm the people who actually decide are the people on record, and that changes in ownership, key roles, or purpose were reported.
2. Regulatory compliance
Take the last two semi-annual compliance reports. Trace every action item to evidence that it was closed. Confirm the Compliance Lawyer’s designation, license standing, and required filings are current.
3. Professional independence
Select a sample of matters across practice groups. Read the file, the correspondence, and the billing record for signs that a person with decision-making authority but no law license shaped legal judgment: scope, staffing, settlement, or advice. Interview the responsible lawyers separately from management.
4. Financial controls
Reperform a sample of trust account three-way reconciliations from bank and ledger source records rather than from the firm’s summary. Map who can initiate, approve, and record a disbursement of client funds, and identify anyone who can do all three. Confirm a lawyer reviewed invoices before they were sent.
5. Client protection
Sample engagement letters against intake records and billing numbers. Confirm the letter was signed before work began and before a billing number was assigned. Re-run a sample of conflict checks against the current database and confirm who reviewed each result and who authorized any waiver.
6. Operational controls
Sample matters for diligence and promptness: deadlines calendared, responsibility assigned, supervision documented, and client communication logged. Test declination and disengagement: whether the letter went out, who sent it, and whether the file was closed and any client property returned.
7. Technology and cybersecurity
Start from the software inventory the firm listed in its own review. For each system that holds client data, test access: who has an account, whether departed staff were removed on time, whether multi-factor authentication is enforced, and whether a backup has been restored successfully in a test.
8. Vendor management
List every third party with access to client data, including ancillary service divisions, outside IT, and any litigation funder. For each, check for contractual confidentiality and security obligations and for a technical control that limits what the third party can reach. Confirm ancillary business staff cannot see client data without client consent.
9. Risk management
Ask for the risk register and the financial stability indicators leadership reviews. If neither exists, that is a finding. Test the complaint and regulatory inquiry log for completeness and for prompt notice to the Compliance Lawyer.
10. Documentation and reporting
Pick a handful of answers from the most recent self-audit and ask for the documents behind them. The rule expects an ABS to keep records that demonstrate compliance. Records that cannot be produced within a reasonable time do not demonstrate anything.
Classify findings by risk
A list of findings without ratings is a list of tasks. Ratings tell leadership where to look first.
| Rating | What it means | Expected response |
|---|---|---|
| Critical | Client property, confidentiality, or professional independence is exposed now, or an obligation to the regulator has not been met. | Immediate remediation. Leadership and the Compliance Lawyer informed at once. |
| High | A required control is missing or not operating. Exposure is likely if conditions continue. | Interim mitigation now. Full remediation within a defined period. |
| Moderate | The control exists but operates inconsistently or lacks evidence. | Fix within the remediation roadmap. Retest at follow-up. |
| Low | Documentation or process improvement with limited direct exposure. | Address in the normal course. Track to closure. |
Two rules make the ratings useful. Rate the exposure, not the effort to fix it. And rate each finding on its own before considering the pattern, because a cluster of moderate findings in one domain is often a high finding about governance.
What a useful report looks like
The report should be readable by a board member in one sitting and usable by an operations lead for a year.
- Executive summary. Scope, period covered, overall assessment, and the critical and high findings on the first page.
- Scope and methodology. What was tested, what was sampled, how samples were chosen, and what was excluded.
- Findings. For each: the condition observed, the standard it was tested against, the evidence, the exposure, and the recommendation.
- Risk classification. The rating for each finding and the rationale for it.
- Remediation roadmap. Owners, target dates, and the evidence that will show closure.
Findings describe what was observed, not who is to blame.
How to prepare
Preparation shortens the audit and improves it.
- Gather the last two semi-annual compliance reports and the evidence behind each answer.
- Produce a current inventory of systems that hold client data and the people and vendors with access to them.
- Assemble the governance documents: operating agreement, ownership records, minutes, and the disclosures on file with the regulator.
- Make trust account reconciliations, bank statements, and client ledgers available for the period under review.
- Identify the lawyers and staff the auditor should interview, and let them speak freely.
- Decide in advance who receives the report and who owns remediation.
A firm that cannot assemble this material within a few weeks has already learned something about its documentation domain.
How Koers approaches this work
Koers evaluates independence before accepting an audit, including a review of any prior consulting relationship. Conclusions rest on evidence: documents, records, and reperformance, not interviews alone. Findings are classified by risk and paired with a remediation roadmap the firm can act on, and consulting opportunities do not influence what the report says. The engagement is described on the ABS External Audits service page.
This article is general information about audit practice, not legal advice on any firm’s regulatory obligations.