Where HR Consulting Advice Crosses Into Legal Risk

Set an internal policy, and train consultants on it, that any question touching a specific termination decision's legal risk, a discrimination complaint's exposure, or interpretation of a specific statute gets redirected to the client's own employment counsel rather than answered directly, however confident the consultant feels. Document this policy as a formal firm decision and revisit it whenever a near-miss happens, a consultant who got closer to that line than the firm was comfortable with, since these near-misses are exactly the signal that the policy needs reinforcement or clarification.

Compensation benchmarking work means the firm often holds detailed pay data from multiple clients, sometimes direct competitors, at once. Build a clear internal policy on how benchmark data gets aggregated and anonymized before it's used across engagements, and make sure the policy is documented and reviewed by firm leadership periodically, not just written once and forgotten. A client who later discovers their specific pay data was identifiable in benchmarking work shared with a competitor has a legitimate grievance that a documented, followed policy is the firm's best protection against.

A two- or three-partner firm can maintain both policies through direct oversight and a shared decision log; a firm large enough to have consultants who never interact directly with the partners needs more structure; documented training, a designated person who reviews edge cases, and periodic policy refreshers. This is less about board software specifically and more about whether the firm's growth has outpaced its informal oversight capacity, which is worth an honest assessment independent of revenue or headcount alone.

Most firms in this space are partner-owned without outside capital, and BoardPro's lightweight structure comfortably handles partner-level governance, admitting a new partner, profit sharing changes, major policy decisions like the two above. Diligent's heavier apparatus becomes relevant mainly if the firm takes on outside investment or grows into a multi-office structure where consistent policy enforcement across locations becomes a real governance challenge rather than a single office's internal discipline.

Any policy governing the two risks above, the legal-advice boundary and compensation data confidentiality, deserves a dated, firm-level decision record, along with any material near-miss and how the firm responded. Day-to-day client engagement notes don't need this level of formality; the distinction is whether the decision shapes how every consultant handles a recurring risk, which is a firm governance question, not a project management one.

Record these as dated firm-level decisions:

• The policy that sets the boundary between consulting advice and legal advice, including how consultants are trained on it.
• The policy on compensation data confidentiality, including how benchmarking data is anonymized across clients.
• Any material near-miss, such as a consultant telling a client which employees to terminate, along with how the firm responded.
• Skip formal records for day-to-day engagement notes and formalize only decisions that shape how every consultant handles a recurring risk.

Say a consultant, mid-engagement, tells a client which specific employees to terminate first in a reduction in force based on performance ranking, a recommendation that edges close to legal risk territory around disparate impact even when well-intentioned. The firm's response matters as much as the original near-miss: was it caught, was the client redirected to counsel, and was the consultant given feedback that changes how they'd handle a similar situation next time. Document all three, not just the fact that a near-miss occurred, since the pattern of response over time is what actually protects the firm.

Most professional services firms worry about client conflicts, working for two competitors. HR consulting firms face that too, but the legal-advice boundary risk is distinct and, in some ways, harder to manage because it depends on a specific conversation's content in the moment rather than a checkable fact like which companies a firm currently serves. That's exactly why training and a living policy, revisited after real near-misses, matters more here than in a firm where conflicts can be screened with a simple client list check alone, since the risk lives inside a specific conversation, not on a list anyone could check in advance regardless of how carefully it was maintained, and a policy nobody's actually read recently offers little real protection when it matters most.