Here’s an odd truth: lawyers are obsessed with risk, yet law firms across Moldova, Romania, Europe, and pretty much everywhere else keep getting blindsided by the same things. Can you take a wild guess at what that is?

It’s not malpractice suits. Not compliance violations. It’s the reputational disasters, communication blunders, and governance gaps they never saw coming.

Traditional risk frameworks like ISO 31000 aren’t useless, despite the raised eyebrows most people have when hearing of them. They’re just built for a different era. They handle financial exposure beautifully. Regulatory compliance? Sure, that, too. But ask them to deal with what happens when a partner says something stupid on LinkedIn, or when your firm’s website promises expertise you don’t actually have, and suddenly you’re in uncharted territory.

Let’s talk about where these frameworks break down, and what smarter firms are doing instead.

Why the Old Playbook Doesn’t Work Anymore

ISO 31000 and similar frameworks follow a sensible pattern: identify risks, assess how bad they could get, put controls in place, and keep an eye on things. It works great for the obvious stuff like conflicts of interest, data breaches, or missed filing deadlines.

But here’s what it misses: reputation, communication, and public perception. These get labeled “soft risks” and promptly ignored. Which, to be honest, is bizarre, because they’re anything but soft. They’re:

• Predictable. The same patterns show up across firms, across borders, across practice areas.
• Manageable. You can build policies around them just like around any other risk.
• Trackable. Media mentions, client feedback, online sentiment… it’s all measurable if you bother to look.

The firms that get burned aren’t usually losing cases or violating regulations. They’re making unforced errors: saying the wrong thing at the wrong time, making promises they can’t keep, or letting gaps open up between their public image and their actual operations.

Let me show you what this looks like in practice.

When Reputation Risk Gets Real

The Client Who Becomes Radioactive

Kirkland & Ellis, one of the biggest law firms in the world, dropped a client mid-representation. You’d think it was because of a conflict of interest in the traditional sense, right?

Wrong. It was because other clients started getting nervous. The case was creating too much heat. The Financial Times and Wall Street Journal covered it as a pure business decision driven by reputational calculus.

Think about that for a second. A top-tier firm walked away from billable hours because the optics were bad. That’s not a soft risk.

When Your Lawyer’s Twitter Becomes Your Problem

Foley & Lardner allegedly rescinded a job offer to a lawyer because of her political views on social media. She sued. A federal court said the case could proceed. Suddenly, the firm was in litigation not over legal work, but over how it handled someone’s public online presence. Someone who wasn’t even working with the firm! Let’s take a minute and digest that.

The lesson? If you don’t have clear policies about what lawyers can say publicly and how you’ll respond to it, you’re just waiting for someone to test the boundaries.

The Compliance Failure That Became a Headline

Simpson Thacher & Bartlett got fined £362,000 by UK regulators for anti-money laundering failures. The fine itself wasn’t catastrophic for a firm of that size. But the Financial Times wrote about it. Clients read about it. And overnight, you’re the firm that can’t get the basics right.

Reputational damage doesn’t require a big scandal to happen. Sometimes, a bureaucratic failure and a public regulator are enough.

The Controversy You Didn’t See Coming

Paul, Weiss faced serious public backlash for taking on certain high-profile, politically charged representations. The firm did nothing illegal. But the pressure was real, the media coverage was extensive, and the reputational cost was significant.

Modern law firms operate in an environment where client choice itself can become contentious. Whether that’s fair is debatable. Whether it’s reality, well… it sure isn’t.

The Marketing Claim That Backfired

A UK law firm faced allegations of deceptive advertising. The case was eventually dropped, but not before Reuters reported on it. The firm’s marketing language had created expectations it couldn’t meet, and someone called them on it.

So, keep in mind. Your website isn’t just a brochure. It’s a legal representation of what you can deliver. Treat it accordingly.

What Actually Works

So if the old frameworks aren’t enough, what does good risk management look like for a law firm today? Here’s what the better-run firms are doing:

They Control the Microphone

Not everyone at the firm gets to speak for the firm. There are rules about who can talk to the press, post thought leadership, or represent the firm at conferences. Before anyone publishes anything under the firm’s name, someone reviews it.

Some may call it censorship. I call it basic brand discipline.

Someone Actually Owns Reputation

In most firms, reputation is everyone’s problem, which means it’s no one’s responsibility. The smart firms assign it to a specific partner or committee. When something goes sideways, there’s a clear escalation path. Someone is monitoring what people are saying about the firm. Someone is making sure the firm’s messaging stays consistent.

They Mean What They Say

If your website says you have deep expertise in cross-border transactions, you’d better have lawyers who actually do that work. If you’re publishing statements about diversity and inclusion, you need policies to back it up. The gap between marketing and reality is where reputation goes to die.

They’ve Thought Through the Nightmare Scenarios

What happens if a client gets indicted? What if a partner says something inflammatory and it goes viral? What if there’s a data breach involving a high-profile client?

The firms that handle these situations well aren’t winging it. They’ve run the scenarios in advance. They know who does what, who talks to whom, and how decisions get made under pressure.

They Audit Their Own Story

Websites get outdated. LinkedIn profiles contradict each other. Directories list people who left three years ago. Your digital presence is usually the first place clients, journalists, and regulators look. If it’s a mess, that tells them something about how you run the rest of the business.

Regular audits catch these things before they become embarrassing.

The Real Game Has Changed

Risk management in law used to be about avoiding malpractice and staying out of trouble with regulators. That’s still important. But the game has expanded.

Today, it’s about credibility. Can clients trust you? Can regulators? Can the public? In a world where everything is visible, everything is connected, and reputational crises can unfold in hours instead of weeks, managing how you’re perceived isn’t vanity anymore. It’s basic, 101, survival.

The firms that get this will avoid disasters and build something more valuable: a reputation for being trustworthy, competent, and consistent. Which, let’s be honest, is exactly what clients are paying for in the first place.