Due Diligence for Law Firm Mergers

Due Diligence for Law Firm Mergers

According to legal consultants Altman Weil, law firms in every section of the market are interested in mergers. They said that, in 2018, there were 106 mergers, which exceeded the previous record of 102 in 2017. The reasons firms merge vary, but they include such objectives as increasing size or geographic reach, acquiring or expanding a specialty practice and succession planning.

Due Diligence

Even if your firm isn’t ready to think about a merger just yet, it’s important to understand what firms look for when they conduct due diligence. The goal of examining the financial records of both firms is twofold: (1) objectively ensuring that the numbers align and (2) identifying any potential problems. Essentially, these goals are the same as the goals for any business merger.

Once a preliminary agreement is signed, the firms should perform due diligence examinations in the following areas:

  • Review of historical financial performance
  • Examination of current financial status
  • Future projection analyses
  • Entity structure
  • Tax implications
  • Outstanding liens and litigation
  • Existing contracts or leases
  • Quality of work product

The firms should also talk through the following:

  • Analysis of systems being used and how to align them (e.g., research, document management, client relationship management)
  • Personnel policies (e.g., performance management, annual raises)
  • Overlapping roles
  • Severance packages, if any
  • Nondisclosure and confidentiality agreements, if needed
  • Announcements of the merger, both internally and externally
  • Campaign for notifying clients
  • Changes in any locations, including closures or combinations and how and when this will be done

Sticking Points and Projections

Each of these elements is important, but a particular sticking point is how the new entity will be structured. The rules are complicated, but the result may be that individual partners or shareholders may find themselves with an unexpected tax bill. Consider these examples: suppose two partnerships merge. When the deal is consummated, taxable income might be accelerated for some or all of the partners because partnerships are pass-through entities that are not taxed at the partnership level. Now suppose the merger is between a partnership and a professional corporation. The rules in this case are different because corporations are taxed at the entity level. If the new combined entity is a partnership, the tax implications of liquidating the corporation need to be considered.

Pay close attention to future projections because they estimate the financial health of the combined entity. The analysis includes partner ages, the cost of existing partner buyouts, number of partners expected to retire in the next 5 to 10 years, the buyout structure going forward, projected rate of client retention and partner billing rates.

When firms merge, the best-case scenario is that the merger goes smoothly and everyone comes out feeling like a winner. Part of what reinforces that feeling is cultural fit. Cultural fit is hard to define because it is intangible. It encompasses things like how the firm values its employees and its clients, whether it values corporate social responsibility and what its overall growth goals are. Sometimes, firms need to meet with several potential merger partners before they meet a firm with which they feel comfortable.

If your solo/small firm is thinking about a merger, you might find important information in this case study of a solo practice merger.

Copyright ©

Discover our legal support staff for lawyers in Chicago.

Cybersecurity and the Importance of Data Privacy

Cybersecurity and the Importance of Data Privacy

Cybersecurity — especially data privacy — is one of the biggest problems facing businesses today. These security problems are compounded because every segment of every industry is affected differently, and each is subject to the risk factors peculiar to that segment. Grouping similar data together based on chosen parameters allows businesses to assess the privacy needs of each data segment they are holding. For example, the protections for public data don’t have to be as stringent as the protections for private data.

Protecting the privacy of the data with which they are entrusted is a universal business goal.

Get started by answering the following questions:

  • What types of data does your business have (e.g., credit card information, health information, criminal history, biometrics)?
  • Which departments have access to that data?
  • Who are your data service providers and what are their credentials?
  • Which personnel can access the data?
  • What steps has your company taken to protect the data (e.g., encryption, back-up, internal controls)?

Federal and International Regulations

The United States has no federal law protecting data privacy. A number of states, however, are responding: at least 31 states have already established laws regulating the secure destruction or disposal of personal information. At least 12 states — Arkansas, California, Connecticut, Florida, Indiana, Maryland, Massachusetts, Nevada, Oregon, Rhode Island, Texas and Utah — have imposed broader data security requirements. Other states, including New York, are considering legislation. Illinois has nine items pending legislation so far this year.

California is a pioneer on the data privacy front. The California Consumer Privacy Act of 2018, which goes into effect on January 1, 2020, is similar to the General Data Protection Regulation (GDPR). Companies that do business in California will be affected by this legislation.

At least some of the activity at the state level is in response to the European Union’s enactment of the GDPR. Any company doing business in a nation that has adopted the GDPR must comply with its consumer protections regarding data privacy. The GDPR covers many types of data, including the following:

  • Personally identifiable data (e.g., names, addresses, date of births, Social Security numbers)
  • Web-based data (e.g., user location, IP address, cookies, and RFID tags)
  • Health (HIPAA) and genetic data
  • Biometric data
  • Racial or ethnic data

The bottom line is that U.S. businesses operating in multiple jurisdictions must consider these categories, as well as any other categories pertinent to their industry, as they segment the data they are holding. Understanding the data they hold is essential to instituting the right level of privacy safeguards.

Three Steps to Securing Your Data

  1. Understanding your data

  2. Knowing the relevant laws and regulations your business must comply with

  3. Staying alert for any indications of a breach

The sad truth is that many data breaches go on for quite a while before they are discovered. The time lapse between hack and discovery allows hackers to continue accessing vulnerable data. That makes constant monitoring an important aspect of any data security program. Watching for the signs of a breach — such as an unanticipated spike in bandwidth usage — can indicate a problem.

By following these three steps, businesses can be sure they are doing their best to protect the data they and their data service providers hold.

Learn more about cybersecurity for law firms with Above the Law’s two part series: Part One | Part Two

Discover our legal support staff for lawyers in Chicago.

Copyright ©