Your Malpractice and Cyber Carriers Are Now Underwriting Your Tech Stack — And Most Law Firms Cannot Answer the Questionnaire
Renewal questionnaires that once asked about practice areas and claims history now ask about MFA, trust account controls, AI usage policies, vendor security, and incident response. Firms treating these as paperwork are leaving premium credits and, increasingly, coverage on the table. Here is what carriers are asking in 2026, why, and how to be able to answer honestly.
Published: 2026-08-21T12:22:22.677Z · Category: Compliance · 8 min read
📄 What Changed on the Questionnaire
Five years ago, a legal malpractice application asked about headcount, practice area mix, revenue, claims history, and calendaring. A 2026 renewal packet — especially where cyber is bundled or written alongside — reads more like a security assessment.
The questions cluster into five areas:
Access Controls
MFA on email and all systems, role-based permissions, offboarding process, admin account governance.
Funds Handling
Wire verification procedure, dual authorization thresholds, trust reconciliation frequency, who can initiate a disbursement.
Deadline Management
Centralized docketing, redundant calendaring, supervision of deadline entry, escalation on missed tasks.
AI Governance
Written AI usage policy, approved tools list, verification requirements for AI output, client disclosure practice.
Vendor Risk
Where client data resides, vendor security certifications, breach notification terms, subcontractor disclosure.
Resilience
Backup frequency, restore testing, documented incident response plan, tabletop exercise history.
🎯 Why Carriers Focus on These Specific Controls
Underwriters are not auditing technology for its own sake. They are targeting the two claim categories that dominate legal malpractice loss data.
⏰ Missed deadlines
Blown statutes of limitation and missed filing dates remain among the most common and most indefensible claims. They are also highly correlated with a specific operational pattern: deadlines tracked in individual calendars rather than a central, supervised system. A carrier asking "is calendaring centralized and independently verified" is asking a question with real predictive value.
🏦 Diverted funds
Business email compromise targeting real estate closings, settlement disbursements, and trust transfers has become an industry-wide loss driver. The controls that stop it are unglamorous and verifiable: out-of-band verification of any change to wire instructions, dual authorization above a threshold, and disbursement authority separated from disbursement approval.
⚠️ The Honesty Problem
Here is the uncomfortable part. These questionnaires are typically completed by a partner or administrator based on belief rather than evidence. "Do you perform monthly three-way trust reconciliation?" is answered yes because the firm intends to, not because anyone checked whether the last four months were actually completed and reviewed.
That gap matters in two directions. Materially inaccurate representations can affect coverage at exactly the moment you need it. And a firm that cannot evidence a control usually does not consistently perform it — which means the underlying risk is real regardless of what the form says.
🛠️ Making the Answers Evidence-Based
The firms that renew well have one thing in common: their controls are enforced by systems rather than by intention, which means the evidence is a byproduct of normal operations rather than a project.
| Underwriter Question | Intention-Based Answer | Evidence-Based Answer |
|---|---|---|
| Do you reconcile trust accounts monthly? | "Yes, our bookkeeper does it." | Reconciliation reports for 12 consecutive months, timestamped, with reviewer sign-off |
| Is disbursement authority segregated? | "Only partners can sign checks." | Role permission matrix plus audit log of initiator and approver on every transfer |
| Are deadlines centrally managed? | "Everyone uses the shared calendar." | Deadlines as matter data with automated rules, task assignment, and escalation history |
| Who can access client matter data? | "Only the team on the matter." | Role-based permissions with an access audit trail per matter |
| Do you have an AI usage policy? | "We tell people to be careful." | Written policy, approved tool list, acknowledgment records, verification requirement |
| Where does client data reside? | "In the cloud." | Named platform, security certifications, data residency, breach notification terms |
🏗️ Why This Is Increasingly a Platform Question
Nearly every control on the list is easier to evidence when it is enforced by the system where the work happens. Trust reconciliation performed in the accounting platform generates a retained, timestamped report. Disbursement approval enforced by role permissions generates an audit trail automatically. Deadlines stored as matter data with rule-based calculation generate a history of what was set, changed, and escalated.
By contrast, a firm running practice management in one system, accounting in another, and documents in a third has to assemble evidence from three places — and cannot demonstrate that the three agree.
CaseQube and LawAccounting were built on Salesforce specifically for that reason: role-based permissions, immutable audit trails, and native trust controls operating on a single record. The compliance artifact is not something the firm produces at renewal. It is what the system has been recording all year.
- Malpractice and cyber renewal questionnaires have become technology audits covering access, funds handling, deadlines, AI governance, vendor risk, and resilience.
- Carriers focus on missed deadlines and diverted funds because those dominate loss data and are preventable by verifiable controls.
- Answer questionnaires from artifacts, not intentions — inaccurate representations can affect coverage when you need it most.
- Segregation of trust disbursement authority is the single control most often overstated and most directly asked about.
- Systems that enforce controls produce the evidence as a byproduct; fragmented stacks require assembling proof from three places.
Turn Your Controls Into Evidence
See how CaseQube and LawAccounting enforce trust controls, role-based access, and deadline management — with the audit trail your carrier is asking for already in place.
Schedule Your Demo →