Banner artwork by Yossakorn Kaewwannarat / Shutterstock.com
Should lawyers sit at the center of a company, where they protect consistency and keep a view of the whole business? Or should they sit inside it, close enough to the deal to shape it before problems arise? Most general counsel want both: lawyers close enough to understand what is commercially at stake, but connected enough to spot risks beyond any single business unit. They want advice that is fast, pragmatic, and consistent across the organization — advice that supports smart risk-taking without either breaking the business or rubber-stamping decisions already made. The catch: sitting closer to the business does not automatically mean having more influence over it.
A survey of 49 general counsel and senior legal leaders found that almost 89 percent had legal formally integrated into their organization's risk management system. Yet, around half still said legal got involved slightly too late. That gap is the real story. A legal department can sit in the risk framework, attend every committee, tick every reporting box and still miss the moment when commercial decisions are actually shaped.
A seat in the risk framework does not guarantee a voice in the decision.
The property company ECE ran straight into this problem. Moving lawyers out of the center and into operating and local business units made them faster and sharper about operational reality — they understood the projects, the people, the pressures, and could shape decisions early. But it also loosened the group’s grip on its own standards. Legal considerations started losing out to immediate commercial priorities, and different parts of the business began forming their own, sometimes conflicting, views on legal risk. ECE’s answer was not to retreat to a fully central model, nor to let embedding run unchecked. It moved to a hybrid: lawyers stay close to the business, while the general counsel keeps overall responsibility for governance, standards, and legal risk management across the group.
The lesson travels well beyond ECE. The real question is not whether legal should be centralized or embedded. It is whether the organization has built the governance, reporting lines, policies, and culture that make proximity to the business safe — and useful.
Integrated on paper, late in practice
Most companies in the survey had already done the formal work: 78 percent had a written risk policy, 64 percent a defined enterprise risk management framework, and about half ran cross-functional risk committees. Every single respondent saw legal risk as a company-wide concern rather than something that belongs to the legal department alone. Encouraging numbers — but they mask a gap between what is designed on paper and what happens day to day.
Respondents were upbeat about their risk culture: good cross-functional cooperation, open conversations about risk, a willingness to escalate even when it slows things down. But fewer than half were confident that their organization's stated risk appetite was actually applied consistently in daily decisions.
Risk appetite is often clear in policy and ambiguous in practice.
Three-quarters called legal a trusted adviser, and most described their legal function as a risk acceptor — neither reflexively cautious nor a pushover. But a legal team cannot really advise strategically if the business only calls once the strategic choices are already locked in. Trust is built by being in the room while the options are still open, not by being asked to bless them afterwards.
But a legal team cannot really advise strategically if the business only calls once the strategic choices are already locked in.
Why legal and compliance need one owner
Good risk management today is not a brake on the business — it is a management tool. It does not stop a company from taking risks; it helps the company compare them, put resources behind the right ones, and pursue opportunities with open eyes. Legal risk fits squarely into this picture. A failure in data protection, sustainability reporting or competition law rarely stays a legal problem — it can hit operations, reputation, financing and strategic room to maneuver. So legal risk cannot be managed as a filing cabinet of matters, and it cannot be left to lawyers alone. The business owns the decisions that create the risk. Legal supplies the framework and the challenge to identify and weigh it. Compliance checks that the rules and controls actually work. Enterprise risk management ties the three views together so senior leadership sees the whole picture — and embedded lawyers are the connective tissue, because they sit closest to where the risk is created. They should not, however, become the entire control system by themselves.
In many companies, legal and compliance grew up separately — Legal interpreting the law and structuring deals, compliance building programs and monitoring controls — even though they are often looking at the same risk from two angles. Without a shared model, that produces duplicated structures, mixed messages, and confusion about who escalates what. The fix is to put both functions under one leader, the general counsel, giving the company a single strategic view of legal and regulatory risk, shared definitions, and one coordinated report to senior management. That does not mean blurring the two jobs: Legal should still build defensible options, compliance should still monitor and test controls, and compliance must keep an independent right to escalate straight to the board or the appropriate executive, without needing legal’s sign-off. Joint leadership and independent escalation are not in tension — done properly, they reinforce each other.
Joint leadership and independent escalation are not in tension — done properly, they reinforce each other.
What the hybrid model actually needs
Five things need to work together, not as separate initiatives but as one system. One leadership structure, so the general counsel has direct access to senior management and a seat on the relevant risk committee — otherwise legal risks get discussed as isolated incidents rather than part of the company’s overall risk portfolio. One shared language for legal risk — a common definition, a stated risk appetite, and consistent criteria for assessment and escalation, written down so embedded lawyers, business leaders, compliance, and senior management are all working from the same page. Two kinds of proximity, not one: embedded counsel who understand the local context and get involved before decisions are final, and a central legal and compliance team who see the patterns across the whole enterprise — risks that look manageable in isolation but add up when viewed across the group. One source of risk information, so material legal risks land in the company’s central risk register, rather than scattered across emails, spreadsheets and individual lawyers’ heads.
Five things need to work together, not as separate initiatives but as one system.
What is not visible cannot be managed consistently.
And one shared expectation of how people behave: lawyers who neither block every uncertain move nor simply rubber-stamp what the business wants, but who help everyone understand the nature of a risk, its likely impact, the safeguards available, and who should actually be making the call. That is where legal creates strategic value — enabling decisions that are informed and transparent, inside boundaries everyone understands.
A 90-day starting point
A GC can start by asking five questions. Can embedded lawyers explain the company’s legal-risk appetite and apply it to a real decision? Are material legal risks actually visible in the enterprise risk register? Does every lawyer still have a functional reporting line back to the general counsel? Are the roles of legal, compliance, the business, and enterprise risk management clearly divided? And are escalation thresholds agreed before, not during, a difficult matter?
If several of those answers are fuzzy, moving boxes on an org chart will not fix it — the operating model needs work, and that can start within three months. The first month is for mapping the current system: where lawyers and compliance staff sit, when they typically get involved, how risks are recorded, and — by checking a handful of recent decisions — whether legal came in early enough and who actually signed off on the risk taken. The second month is for agreeing the guardrails: a shared legal-risk taxonomy, clear responsibilities, escalation criteria, and which decisions embedded lawyers can make locally versus what needs central or senior-management sign-off. The aim is not to centralize everything, but to make the boundaries of decentralized decision-making explicit. The third month is for testing it on live matters across different business units, checking whether legal was involved early enough, whether the risk appetite held up in practice, and whether senior management actually got the full picture. Real decisions expose faster than any policy document where the framework is still too abstract.
Not centralize or embed — both, done properly
Centralized legal teams work well when they stay close enough to strategic decisions and are properly plugged into enterprise risk management. Embedded teams work well when they sit inside strong central governance. Neither structure wins on its own — the real risk is assuming structure alone will do the job. Embedding solves the proximity problem; it does not automatically solve governance. Centralizing strengthens oversight; it does not automatically buy commercial influence. The strongest model combines both: operational proximity, enterprise-wide visibility, shared standards, one legal-and-compliance leadership, and clear accountability for who accepted which risk. The point of legal risk management was never to remove uncertainty from business. It is to make sure the company knows which risks it is taking, who accepted them, and where the line sits.
Legal creates the greatest value not by eliminating risk, but by helping the company take the right risks with its eyes open.
Author’s note: This article draws on an Executive MBA research project at Maastricht University on integrating ECE’s legal function into enterprise risk management, including an online survey of 49 general counsel and senior legal leaders from organizations with comparatively mature risk-management systems and decentralized or embedded legal structures.
Disclaimer: The information in any resource in this website should not be construed as legal advice or as a legal opinion on specific facts, and should not be considered representing the views of its authors, its authors’ employers, its sponsors, and/or ACC. These resources are not intended as a definitive statement on the subject addressed. Rather, they are intended to serve as a tool providing practical guidance and references for the busy in-house practitioner and other readers.
