Planning for the Holiday Shutdown: A Risk Manager's Guide

It’s important to ensure your files are in order before you take leave, so you can step away confidently and avoid returning to urgent issues or missed deadlines. The steps below will help you manage key risks and maintain continuity while you’re away.

Review all active matters to identify critical dates, court deadlines, settlement conferences, and contractual time limits that fall during or immediately after the closure period. If a matter cannot be completed before the closure date, reschedule or confirm agreement for any extensions well before you close. Document these arrangements clearly and ensure clients are informed of the implications.

If deadlines cannot be moved, put plans in place for the work to be completed as and when required. This may involve briefing an agent, barrister or, if necessary, arranging for a staff member to return to work. Missed time limits and critical dates continue to be some of the biggest causes of professional negligence claims.

Notify clients of your closure dates well in advance through multiple channels: email signatures, your website, voicemail messages and direct communications. Provide alternative emergency contact arrangements where appropriate, particularly for clients with time-sensitive matters.

Electronic fund transfers carry significant risk, so the process needs to be carefully managed. Both clients and the firm should call to verify bank details before making an electronic transfer of funds. This may not be possible if offices are closed and people are on leave. If the required checks cannot be completed during the shutdown, it may be necessary to restrict the transfer of funds over the closure period unless appropriate staffing arrangements are in place to oversee and properly process the transaction.

If your firm is undertaking only a partial closure, ensure that staff who are working continue to receive the supervision they require. When delegating tasks or responsibilities, provide clear instructions and confirm that the person has the appropriate authority to act. Make sure that all staff working have access to an appropriate supervisor or principal if a matter needs escalation.

As the backbone of any law firm, your technology stack and digital assets must be protected at all times. Cybercriminals know offices are quieter, IT staff may be unavailable and firms have reduced capacity to respond. To minimise the risk of a cyber incident, consider the following strategies.

Shut down any non-essential computers or IT systems, including workstations, laptops and any equipment that will not be used remotely during the break. This reduces your attack surface. For systems that must remain operational, such as servers, backups and security monitoring tools, make sure appropriate monitoring arrangements are in place. Remember that your IT provider may also have staff on leave, so notify them of your closure and confirm emergency contact details on both sides in case support is needed during the holiday period.

Complete a backup of all systems just prior to your closure. Store backups off-site or in secure cloud locations that are isolated from your network. This is done because cybercriminals often encrypt backup files if they can access them on the network. Test your backup restoration process to ensure data can be recovered if needed.

Over the holiday period, staff often use remote access to work from home. Remote access should only be available on devices that carry the same protections and security controls as an employee’s usual firm-approved device. Remote access should be continually monitored to ensure that there are no hackers attempting to break in. To strengthen your cyber-protection, restrict remote access for employees who won't be working during the shutdown. This simple step removes a significant attack vector by limiting the amount of data that any one account can access should a cybercriminal obtain a password. This is also a good opportunity to check that the accounts of any staff members who have left the firm have been disabled and their access removed.

Configure out-of-office automatic replies for all staff, including shared inboxes, with appropriate emergency contact details. Keep out-of-office messages brief and professional, without disclosing excessive detail. Only state the official office closure and reopening dates and do not publicise where particular staff are located or when they will return.

During the holiday break people relax and are not necessarily keeping an eye out for suspicious emails or links. Cybercriminals know this and try to take advantage of people during this time. It is important to remind staff about continued cybersecurity awareness on both work and personal accounts during a break period.

Plan a systematic reopening process that includes checking for any security alerts or unusual system activity during the closure, reviewing backup logs to ensure continuity, and checking that all systems are functioning properly before full operations resume. Check to ensure that there are no unauthorised diversions or rules placed on any email account. Don't just turn systems back on and assume everything is working.

The holiday period should be a time to relax and recharge. Begin planning your shutdown strategy well before the closure date so the necessary arrangements are in place. A last-minute rush can lead to mistakes which can then lead to a claim. With proper planning, many firms find that they can genuinely disconnect during the holiday period without compromising client service or safety.

• Conduct a comprehensive review of all clients’ matters to identify critical dates and deadlines that fall during or soon after the closure period and ensure appropriate arrangements are in place to manage the work.
• Give clients plenty of notice about holiday closure times, but don’t give out more information than necessary. Details such as the movements of individual staff members can be used by cybercriminals as part of their social engineering tactics.
• Remember that cyberattacks continue during the holiday period. Maintain strong cybersecurity practices across both business and personal accounts.
• Remember that your professional obligations continue during the closure period. Maintain appropriate coverage and supervision arrangements.