The First Five Minutes After a Lead Arrives: A Practical Intake Workflow

Key takeaways

• The first five minutes are a lead intake workflow, not a task: one complete record, the source, a named owner, an acknowledgement, and the next action.
• The record should be built automatically from the form rather than retyped. In HubSpot the form creates or updates a contact and deduplicates on the email address.
• Source is captured automatically as first-touch, so attribution never depends on asking “how did you hear about us” or on a rep remembering to log it.
• Acknowledgement is governed by Canadian law: a direct reply to the inquiry is generally exempt from CASL's main requirements, while later commercial follow-ups rely on the six-month implied consent an inquiry creates and must carry sender identification, contact information, and an unsubscribe.
• For a law firm, confidentiality and conflict screening apply from first contact, while formal client identification begins on being retained. Automation can flag a possible match, but only a lawyer can clear it.
• Map your own five minutes against this workflow, or explore our CRM, AI and Automation Systems and request a Growth Opportunity Audit.

What is a lead intake workflow?

A lead intake workflow is the defined set of steps a business runs the moment a new inquiry arrives, so that every lead is captured, recorded, routed and followed up the same way. A good one turns a form submission into a complete, owned record with an acknowledgement and a scheduled next action, using automation for the handoff and leaving the judgment calls to people. For law firms and other high-value service businesses, it also has to respect professional and privacy obligations from the first contact.

Why the first five minutes decide the outcome

In the intake systems we audit, most lost leads are not lost inside a marketing channel. They are lost in the handoff, in the few minutes between someone raising their hand and your business doing something about it. The advertising works and the form gets filled, and then the inquiry stalls in the gap between systems and people, where no single step is clearly responsible for it. At low volume that is survivable. As soon as demand grows, every one of those small gaps becomes an expensive leak, because you are now paying to generate leads that quietly go cold.

A reliable intake workflow closes that gap by making the first five minutes the same every time. The five steps below are the ones we build, in order, and each one hands cleanly to the next.

What we see when we audit intake

When we open up a firm's intake, the failures are rarely exotic. They are the same handful of gaps every time, and here is what we find:

• The form feeds a shared inbox that nobody owns, so inquiries sit unread while the ads keep spending.
• No source is captured, so the firm cannot say which channel actually produced a client, only that “leads come in.”
• The acknowledgement, if there is one, is a generic “thanks, we will be in touch” with no next step and no name attached.
• No task is created, so whether anyone follows up depends on memory and goodwill rather than the system.
• For a law firm, nothing flags a conflicts check before someone replies substantively, which is a professional-conduct problem, not just an operational one.

Every one of these is fixable in the first five minutes, and the five steps below are how we do it.

Step 1: create the complete record

The first job is to turn the submission into one complete record, created automatically, so nothing depends on a person retyping details from an email. In practice we build this on the form itself. A HubSpot form is designed to “collect information from visitors and create or update records in your CRM,” so a new inquiry becomes a contact the moment it is submitted, and HubSpot “uses the email address to deduplicate contacts” rather than creating a second record for someone already in the system (HubSpot, Create and customize forms; HubSpot, Create contacts). We describe the mechanics using HubSpot because it is the platform we implement most, and the specific features and their availability vary by HubSpot subscription and configuration.

A complete record means the essentials are captured as structured fields, not buried in a message. HubSpot's default contact properties already cover most of them, including first name, last name, email, a phone number that is validated and formatted by country code, and a Message property meant “for any message or comments the contact may want to leave on a form” ( HubSpot, default contact properties). We set the contact's lifecycle stage to Lead on submission, so the record announces what it is, and we associate it with a company or a matter record where that applies, because associations in HubSpot are “always two-way” and let a contact, a company and a deal hang together as one picture rather than as loose rows (HubSpot, Associate records). The submission can trigger everything that follows immediately, since a form can enroll the contact in a workflow the instant it is received (HubSpot, Automate form submission actions). That first record is the foundation for the next four steps.

Step 2: capture source and intent

Capture where the lead came from and what they need at the moment of submission, automatically, because both routing and attribution depend on it and neither should rely on someone remembering to ask. Source is the part most firms get wrong by trying to do it manually. HubSpot sets an Original Traffic Source property that records “the first known web source through which a contact interacted with your business,” and it does so automatically from the tracking cookie it set when the visitor first landed, tying their earlier anonymous page views to the contact once they submit a form (HubSpot, Understand Original and Latest traffic source properties; HubSpot, Track visitors). For paid and campaign traffic we carry the detail through with UTM tracking URLs and hidden form fields, which “automatically set property values when a form is submitted without requiring visitors to enter it manually” (HubSpot, Set property values with hidden form fields).

We are honest with clients about the limits of this. HubSpot keeps the first known source as first-touch in Original Traffic Source, though the property itself can be edited manually if you ever need to, while the drill-down detail beneath it cannot be hand-edited and Latest Traffic Source updates automatically on each new session. Attribution is also not perfect: an ad blocker can prevent the tracking cookie from being set, and a visit that arrives with no parameters is logged as direct traffic. Captured this way, automatic source tracking is still far more reliable than a drop-down asking people how they found you. Intent is the other half of this step. The matter, in the person's own words and captured alongside one simple service field, tells the owner what they are picking up before they open the record.

Step 3: route to a named owner

Every lead gets one named owner inside the five minutes, assigned by a rule rather than left for whoever happens to be watching the inbox. A shared inbox is where accountability goes to die, because when a lead is everyone's job it is no one's. In HubSpot the owner property assigns a record to a specific person, and a workflow can set it the instant the record is created (HubSpot, Assign ownership of records). Where a team shares intake, the Rotate record to owner workflow action distributes new leads “to users equally within a selected team or between specified users,” so the load is shared out fairly and predictably (HubSpot, Choose your workflow actions).

For inquiries that come through chat or a shared inbox rather than a form, HubSpot's conversation routing can send each one to a specific user, a team, or the contact's existing owner (HubSpot, Set up routing rules in the conversations inbox). One detail matters for how you staff this: routing will leave a conversation unassigned if no agent is available, which is a useful reminder that automation can hand a lead to a person but cannot make a person be there. Someone still has to own the queue. That is the whole point of assigning a name rather than a group.

Step 4: acknowledge the inquiry

Send an immediate acknowledgement that confirms you have the inquiry and sets an honest expectation, then make sure both the mechanism and the wording stand up to Canadian anti-spam law. HubSpot can send an automated email the moment a form is submitted (HubSpot, Send automated emails in workflows). Watch the mechanism, though: a standard marketing automation email only reaches contacts who are “eligible to receive marketing emails,” so a brand-new or non-marketing contact can be skipped. A dependable acknowledgement uses a channel that reaches the person regardless of marketing status, which is what HubSpot's transactional email is built for (HubSpot, Send transactional emails).

The law is the other half, and it treats the two jobs differently. A message sent purely in response to an inquiry, which is exactly what an acknowledgement is, is excluded from the main requirements of section 6 of the legislation, so the immediate acknowledgement itself is generally exempt (Electronic Commerce Protection Regulations, s.3(b)).

The commercial follow-ups are where consent and content rules bite. An inquiry or application made within the previous six months creates implied consent to send commercial messages, an existing business relationship recognized in the statute (Canada's Anti-Spam Legislation, s.10(10); Government of Canada, Getting consent to send email). That window is real but limited, and the CRTC advises that it is best not to assume implied consent when the circumstances are unclear, so we treat it as a defined permission rather than a blanket one (CRTC, Frequently asked questions about Canada's anti-spam legislation). Any commercial message you send on that basis must identify who sent it, give contact information the person can use, and include an unsubscribe mechanism (CASL, s.6(2)); the contact information has to stay valid for at least 60 days, and an unsubscribe request must be honoured without delay and no later than 10 business days (CASL, s.6(3) and s.11(3)). As a practical rule we build every automated message, the acknowledgement included, to carry those elements, because it costs nothing and removes any argument about which rule applies.

The stakes are worth one line: the maximum penalty for a violation is one million dollars for an individual and ten million for a business (CASL, s.20(4)). The acknowledgement confirms receipt and sets an honest expectation about what happens next.

Step 5: create the next action

The five minutes end by creating the next action, with an owner and a due time, so that following up never depends on someone remembering to. An acknowledged lead with no scheduled next step is still a lead at risk. In HubSpot a task is a reminder attached to the record, with a type such as call, email or to-do, a due date, and a queue that groups the day's work (HubSpot, Create tasks). A workflow can create that task automatically the moment the record is complete, so the next action exists before anyone has touched the inquiry by hand (HubSpot, Choose your workflow actions).

For an inquiry that clearly qualifies, we also open the matter as a deal or a ticket so it has somewhere to live and move, dropping it into a pipeline that “helps visualize your processes through stages” (HubSpot, Set up and manage object pipelines). And because leads still get missed, we build a safety net: a delay followed by a branch that checks whether the lead has been worked, so an untouched record escalates instead of dying quietly. HubSpot gives you the delays and if/then branches to assemble that, though it is worth saying plainly that this is a deliberate build rather than an off-the-shelf button. The escalation exists precisely because automation should catch a dropped handoff, not paper over the fact that a human owns it.

For law firms: what the first five minutes must respect

For a law firm, intake is not only an operational workflow. The duties attach in stages, and the workflow has to respect the sequence: from first contact, confidentiality and conflict screening apply; formal client identification begins when the firm is retained; and identity verification applies where the retainer involves handling funds. None of these can be handed to software, and this is the part general “lead intake” advice ignores.

Start with how easily a relationship forms. Under the Law Society of Ontario's rules, a person becomes a client when they consult a lawyer who agrees to act, or when, “having consulted the lawyer,” they reasonably conclude the lawyer has agreed to render legal services on their behalf, and the commentary is blunt that “a lawyer-client relationship may be established without formality” ( Law Society of Ontario, Rules of Professional Conduct, Rule 1.1-1). Confidentiality can attach even earlier: a lawyer “owes a duty of confidentiality to anyone seeking advice or assistance” on a legal matter, whether or not that person is ever retained, so prospective-client information has to be handled carefully from the first message (Law Society of Ontario, Rules of Professional Conduct, Rule 3.3).

That is why screening has to happen before anyone gives a substantive reply. The conflicts duty is strict: a lawyer “must not act or continue to act for a client where there is a conflict of interest,” except where the rules specifically permit it, and a lawyer “should examine whether a conflict of interest exists not only from the outset but throughout the duration of a retainer” (Law Society of Ontario, Rules of Professional Conduct, Rule 3.4-1). The Law Society's own practice guidance goes further and expects firms to run a conflict-checking system to do this reliably (Law Society of Ontario, Selecting a Conflict Checking System).

Client identification is a separate and later obligation. Under By-Law 7.1 it attaches when the firm is retained to provide legal services, not on the first inquiry, with an additional verification step where the retainer involves handling funds (Law Society of Ontario, By-Law 7.1). The quality-of-service rule, meanwhile, is on the firm's side here rather than against it: a lawyer has a duty to provide “courteous, thorough and prompt service,” and a competent lawyer communicates “at all relevant stages of a matter in a timely and effective manner,” which is precisely what a clean acknowledgement and a scheduled next action deliver (Law Society of Ontario, Rules of Professional Conduct, Rules 3.1-1 and 3.2-1). So the workflow's job in the first five minutes is to capture the inquiry, flag it against the conflict-checking system, and route it to the right person fast. Clearing the conflict and deciding to act stay with the lawyer.

What happens after the first five minutes

The five minutes do not replace human follow-up. They make it fast and possible, and the evidence on speed points one way. In the widely cited study of online sales leads, Harvard Business Review found that “most companies are not responding nearly fast enough,” and reported that firms which reached a prospect within an hour were far more likely to qualify the lead than those that waited longer (Oldroyd, McElheran and Elkington, The Short Life of Online Sales Leads, Harvard Business Review, 2011). Our own experience matches it. The teams that convert reach out quickly, with a real person and a defined follow-up sequence behind them, and the leads that go cold in an inbox convert far less often.

This is also why we do not publish a universal “respond within X minutes” promise, and we would be cautious of anyone who does. The right first-response speed depends on your firm, the type of matter, and how you are staffed, and a number that ignores all three is marketing, not a commitment. What the first five minutes reliably deliver is different and more useful: a complete, owned, acknowledged record with a scheduled next action, so that whoever follows up can do so quickly and well. For a law firm, the human follow-up is where the conflicts clearance is confirmed and the decision to act is actually made, which is another reason the workflow's role is to prepare that decision, not to make it.

Where AI can help safely

In intake, AI genuinely helps with drafting, summarizing and flagging missing information, as long as a person approves anything before it goes out. It should not be making the judgment calls. The useful, unglamorous applications are already here. HubSpot's assistant can summarize a record so an owner picking up a lead sees the history at a glance, and it can draft an acknowledgement or a follow-up for a person to review (HubSpot, Use Breeze Assistant). Its data tools can flag a record that is missing a phone number or has an inconsistent field, which is exactly the kind of quiet gap that breaks a follow-up later.

The guardrail is not our invention. HubSpot's own guidance tells users to “check AI data and generated content for accuracy and tone prior to sending emails” ( HubSpot, Get started with AI-powered prospecting). We hold to that line because the alternative erodes the trust the whole intake depends on. AI can surface a possible conflict by matching a name, but it cannot clear that conflict, decide whether to take the matter, or give advice. For a regulated firm those remain the lawyer's professional responsibility, and no tool changes that.

There is one more line for a regulated firm, and it is not optional. Because information from a prospective client can be confidential from the first contact, intake data should only go into an approved, controlled AI environment with proper privacy, access and data-handling safeguards, never a public chatbot that inquiry details get pasted into. The Law Society expects a lawyer to “understand the benefits and risks associated with relevant technology” and to protect confidential information when using it (Law Society of Ontario, Rules of Professional Conduct, Rule 3.1-1, commentary on technology).

The minimum data every intake record needs

Collect the least you need to act on the inquiry, name, best contact, the matter in their words, the source, consent status, and an owner, and leave everything else until the matter is qualified. This is both good conversion practice and a legal obligation. Under Canada's federal privacy law, PIPEDA, “the collection of personal information shall be limited to that which is necessary for the purposes identified by the organization,” and organizations “shall not collect personal information indiscriminately” ( PIPEDA, Schedule 1, Principle 4.4). The Office of the Privacy Commissioner puts it in plainer terms for businesses: ask “for the least amount of personal information to meet the purpose of providing the product or service,” and tell people clearly why you are collecting it (Office of the Privacy Commissioner of Canada, Ten tips).

Two more obligations shape the record. You have to identify your purpose “at or before the time the information is collected” and have consent for it, and you should keep the information “only as long as necessary” and protect it with safeguards appropriate to its sensitivity (PIPEDA, Schedule 1, Principles 4.2, 4.3, 4.5 and 4.7). The practical payoff is that the compliant intake form and the high-converting intake form tend to be the same form. A shorter form asks less of the person and collects less risk, and in our experience it usually converts better too. Everything beyond the minimum can be gathered once the matter is qualified and the relationship is real.

Build the intake once, so every lead lands the same way

The firms that convert more of the demand they already have are the ones whose first five minutes run the same way on a Tuesday morning and a Friday afternoon. That consistency does not come from working harder on each lead. It comes from building the intake once, as one connected system across your forms, your CRM and your follow-up, so capture, ownership, acknowledgement and the next action happen the same way every time. It is the work behind results like the custom lead-intake and attribution system we built for MG Law, which in our own reporting helped lift website leads by 111 percent on 57 percent more traffic.

If your leads are arriving but too many stall in the handoff, that is a fixable systems problem, and it is where we start. Explore CRM, AI & Automation Systems to see how the intake connects end to end, look at how we build the Lead Generation and Follow-Up system around it, or request a Growth Opportunity Audit and we will show you where your first five minutes are leaking.

Frequently asked questions

What should happen immediately after a lead submits a form?

The record should be created, the source captured, an owner assigned, an acknowledgement sent, and a next action scheduled, ideally within about five minutes. Treat those five minutes as an internal target for the workflow, not a promise to the customer about when a person will call. Most of it can be automated so it happens the instant the form is received, which is the point: none of it should wait for someone to notice an email.

How can a law firm automate intake follow-up without breaking professional-conduct rules?

Automate the parts that are administrative and keep the parts that are professional judgment. It is safe to automate the record, the source capture, the routing to a named lawyer or clerk, the acknowledgement, and the creation of a follow-up task. What must stay human is clearing the conflict of interest and deciding whether to act, because under the Law Society of Ontario's rules those are the lawyer's responsibility. Build the workflow so it flags a potential conflict and routes fast, then stops and waits for a person.

What is a minimum viable lead intake workflow?

The smallest version that still holds is four moving parts: a form that creates a complete record, a rule that gives every lead a named owner, an automated acknowledgement that is compliant, and a task that schedules the next action. If you have only those four, you already capture, own, acknowledge and follow up on every inquiry, which puts you ahead of most firms. Source capture and escalation are the next things to add, not the first.

Should the acknowledgement email promise a response time?

Confirm receipt and set an honest expectation, but avoid promising a specific number you cannot keep every time. A message that says a member of the team will be in touch, and that gives the person a way to reach you in the meantime, does the job without creating a commitment you may miss on a busy day. It also keeps the email on the right side of anti-spam law, which cares about identification, contact information and unsubscribe, not about a response-time pledge.

References

1. HubSpot. Create and customize forms. HubSpot Knowledge Base.
2. HubSpot. Create contacts. HubSpot Knowledge Base.
3. HubSpot. HubSpot's default contact properties. HubSpot Knowledge Base.
4. HubSpot. Use contact and company lifecycle stages. HubSpot Knowledge Base.
5. HubSpot. Associate records. HubSpot Knowledge Base.
6. HubSpot. Automate form submission actions. HubSpot Knowledge Base.
7. HubSpot. Understand Original and Latest traffic source properties. HubSpot Knowledge Base.
8. HubSpot. Track visitors in HubSpot. HubSpot Knowledge Base.
9. HubSpot. Set property values with hidden form fields. HubSpot Knowledge Base.
10. HubSpot. Assign ownership of records. HubSpot Knowledge Base.
11. HubSpot. Choose your workflow actions. HubSpot Knowledge Base.
12. HubSpot. Set up routing rules in the conversations inbox. HubSpot Knowledge Base.
13. HubSpot. Send automated emails in workflows. HubSpot Knowledge Base.
14. HubSpot. Send transactional emails. HubSpot Knowledge Base.
15. HubSpot. Create tasks. HubSpot Knowledge Base.
16. HubSpot. Set up and manage object pipelines. HubSpot Knowledge Base.
17. HubSpot. Use Breeze Assistant. HubSpot Knowledge Base.
18. HubSpot. Get started with AI-powered prospecting. HubSpot Knowledge Base.
19. Government of Canada. Canada's Anti-Spam Legislation, S.C. 2010, c. 23. Justice Laws.
20. Government of Canada. Electronic Commerce Protection Regulations, SOR/2013-221. Justice Laws.
21. Government of Canada. Getting consent to send email. Innovation, Science and Economic Development Canada.
22. CRTC. Frequently asked questions about Canada's anti-spam legislation.
23. Government of Canada. PIPEDA, Schedule 1. Justice Laws.
24. Office of the Privacy Commissioner of Canada. Ten tips for avoiding complaints to the OPC.
25. Law Society of Ontario. Rules of Professional Conduct, Chapters 1 and 3, and By-Law 7.1.
26. Oldroyd, J. B., McElheran, K., & Elkington, D. The Short Life of Online Sales Leads. Harvard Business Review, 89(3), 2011.