Automation follows a sequence you already have. If the sequence is only in someone’s head, automating it just makes the inconsistency faster.
Key takeaways
Most firms discover, when they try to automate onboarding, that they have three versions of it — one per partner — and none of them written down. Automating before that is resolved encodes whichever version happened to be described to the person configuring the tool.
Take the last ten clients you took on. Write the actual sequence of events for each: who spoke to them first, when the conflict check ran, when the letter went out, when it came back, when work started. The gaps will be obvious and they will not be evenly distributed.
The output you want is a single ordered list with an owner against each step. That list is the specification. Everything after this is implementation.
A flow step can run automatically because if it runs at the wrong moment nothing irreversible happens — creating a folder, sending a records request, adding a calendar reminder.
A gate is different. Conflict clearance, the acceptance decision and the signed engagement letter are gates: no downstream step may fire until a named person has cleared them. Build the automation so a gate physically blocks the next action rather than merely reminding someone about it.
The single most common failure we see is work starting before the letter comes back, because the "kickoff" automation was triggered by the letter being sent. If a dispute follows, the terms you can actually rely on are the ones the client agreed to, not the ones you emailed.
Once gates are identified, the rest is a trigger map: an event, a condition, an action, an owner. For example — event: engagement letter signature received; condition: identification record complete; action: open the file, issue the records request, schedule the kickoff; owner: the engagement manager.
Keep conditions explicit. "Identification record complete" should mean a named set of fields is populated, not a subjective judgment. Conditions that cannot be evaluated mechanically belong to a gate, not a trigger.
Resist chaining more than three or four actions to a single trigger at the start. Long chains are hard to debug and, worse, hard to explain to a client when one link misfires.
This is the trap. Firms build an onboarding sequence, tack a "while you are here, our newsletter" email onto the end, and quietly move from client communication into commercial electronic messaging.
The CRTC, which enforces Canada’s Anti-Spam Legislation, is explicit that the law requires consent and an unsubscribe option. Sender identification is part of the same package. The CRTC’s own compliance and enforcement process describes notices of violation carrying administrative monetary penalties, with a typical thirty days to pay or make representations.
Before you automate a single send, settle three questions: is this consent express or implied (the distinction matters and they expire differently), does any business-to-business exemption actually apply (it is narrower than most firms assume), and does every message carry a compliant unsubscribe mechanism. Our sister firm’s note on CASL and email marketing is the short version.
An automated onboarding sequence should leave a better audit trail than a manual one, not a worse one. At minimum, record the timestamp of each step, the identity of the person who cleared each gate, the version of the engagement letter that was sent, and the date the signed copy was received.
You also need retention rules. PIPEDA’s principles include limiting use, disclosure and retention, so a system that keeps every draft and every uploaded document forever is not a neutral choice. Decide the retention period per document class before the automation starts creating them.
If a privacy incident does occur, breach reporting obligations apply to the firm, and knowing exactly what the automation held makes that a manageable exercise rather than a forensic one.
Week one to two: document the sequence and mark the gates. Week three: automate file creation and the records request only. Week four onward: add the reminder cadence for outstanding items. Only after that, look at the client-facing message sequence, because that is where the compliance questions live.
Do not start with the letter. The engagement letter is the highest-value step to get right and the worst one to learn on.
If the front-of-house side of your practice is the actual constraint — phones, booking, reminders — that is a different problem set covered under practice owners.
How much of onboarding can realistically be automated?
The clerical spine of it — file creation, records requests, reminders, status visibility. The judgment steps stay manual, and they are a small share of elapsed time but nearly all of the risk.
Do we need consent before emailing a new client?
Client communication about the engagement is not the same as marketing. The moment a message promotes your services, CASL is in play — see the CRTC’s CASL pages.
What if partners disagree on the sequence?
Automate the steps they agree on and leave the rest manual. A partially automated sequence that everyone follows beats a complete one that two partners route around.
A 30-minute call is enough to tell you whether AI pays for itself here.
