DISCOVERY IN-HOUSE. Institute of Information Management 23 rd November 2010, Sydney. Graham Costello EMC

Transcription

1 BRINGING G ELECTRONIC C DISCOVERY IN-HOUSE Institute of Information Management 23 rd November 2010, Sydney Graham Costello EMC 1

2 Agenda for discussion: Improving electronic discovery and regulatory compliance is of significant business value if led by Information Management Business value of ediscovery Issues with outsourced ediscovery Opportunities of In-house ediscovery Relevance to IM? Issues created for IM? Leadership role for IM? Action Plan 2

3 Electronic discovery is of significant business value relating to board level issues. Regulatory Compliance: Qantas fined $US61 million and VP Freight for Americas received 6 month jail term Fined a further $20m by Federal Court in Sydney Received other penalties in Korea and Canada. November 2010 fined a further $12m by European commission. i Awaiting i outcomes of legal l action in NZ as well as follow on class actions around the globe. (SMH 10 Nov 2010) Qantas only makes $250m profit in a good year. Litigation: David Jones V Kristy Fraser-Kirk (2010). Filed a $37m lawsuit and mentioned directors. Settled out of court. Considerable negative press and damage to brand. David Jones annual profit is approximately $170m in a good year. Seven Network V News Limited (2007, FCA 1062). Judgement Deliberately dishonest conduct 3

4 Electronic Discovery (ediscovery) is the process of finding, identifying, locating, retrieving, and reviewing potentially relevant data in designated computer systems. ( Information Governance Information Management Retain or delete based on value ediscovery Process Bring ediscovery in-house Processing Preservation Information Management Identification Review Production Presentation Collection Analysis The Electronic Discovery Reference Model 4

5 Only 20% of legal departments perceive their readiness to respond to a disclosure as high. SURVEY RESULTS - READINESS Overall Level of Readiness (10 Point Scale) Readiness overall Employment matters (e.g. HR issues) Internal fraud Litigation (e.g. e-disclosure, e-discovery) Arbitration (or mediation) Competition/anti-trust cases to 10 6 to 8 1 to 5 Not sure KPMG survey of General Counsels of 200 global l companies High Low KPMG SURVEY RESULTS - CONCERNS 5

6 Organisations have a wide range of concerns ranging from costs through legal privilege, and volume of data to technology. Legal Department Concerns Costs Legally privileged documents Data security when transferring to Volume of data Data protection issues Consistency of records Ability to find data Knowing where the data is stored Cultural challenges How to deal with foreign languages Choice of technology Extremely concerned Very concerned Somewhat concerned Not very concerned Not at all concerned Not sure/refused KPMG SURVEY RESULTS - CONCERNS 6

7 ediscovery is typically ymanaged as a one-off event. However examination shows that a baseline of activity exists in most organisations. Example: Discovery Activity Level On a cumulative basis activity levels are less volatile than expected ive Matters Act Complaints Regulatory Investigations Litigation Complaints Regulatory Investigations Litigation Complaints Regulatory Investigations Litigation Most organisations have recurrent activity requiring discovery processes: Regulatory submissions and reports Litigation Investigations fraud, theft, HR related, customer Significant complaints - customer staff FOI Extractions may be included 7

8 Case duration is commonly long with related matters referred to a wide range of different regulators and courts. Costs are added by treating matter phases as separate cases. Matters have related cases but are managed separately Cases typically extend over years A single matter could generate internal investigations, regulatory investigations, litigation, action against directors, insurance claims, restitution, and class legal actions reso ources Multiple matters with multiple cases running concurrently combine to consume resources A c time B 8

9 Management of discovery incidents on a reactive basis stresses organisations, disrupts BAU, increases costs and reduces discovery effectiveness Disruption to business Data discovery is normally subject to aggressive schedules to meet production dates set by courts, regulators legislation or business KPIs Resources are taken from business functions disrupting BAU Specialist activities (data recovery and hosting) are often outsourced Budgets for managing EDD are typically provided as extraordinary events or absorbed Staff are often stressed by additional tasks from discovery Capability to respond to future occurrences rarely built Poor EDD outcomes Quality can suffer leading to negative outcomes Data identification, collection and preservation is often hit and miss High cost of ediscovery encourages early negotiation of settlement t before key data is discovered d and analysed. High cost of ediscovery is often used as a strategic mechanism by competitiors Last minute discovery responses normally reduces quality of results. Cost issues Discovery costs are typically not consolidated, thus they are not well understood Costs for discovery are normally funded by explicit and implicit activities Usually these costs are spread across legal, risk, IT, and business budgets Legal cost records do not usually separate EDD, and costs of extracting ESI for cases are not separately measured Investigations by finance, HR, risk and business elements are not separately managed, moreover these absorb significant energy, focus and cost BAU disruptions are not normally measured but are often profound Procurement opportunities are not optimised Cases are often outsourced to law-firms or bureaus from the outset. They are usually outsourced at a late stage under conditions of urgency. Both situations add to cost and risk reducing effectiveness. In-sourcing of EDD is not widely practiced. Technology selections drive costs Often paper or not EDD purpose specific Tools and methodologies that offer opportunities i to reduce costs such as Early Case Assessment and statistical sampling are not widely employed because they are not widely understood. Risks of poor EDD practices are rarely priced, even in bet the company situations. 9

10 Significant organisational resources are directed toward managing legal and regulatory risk -a coherent strategy and model for managing EDD provides significant benefits A robust EDD strategy should consider: Visibility - of EDD issues and efficient strategies Data - location, access and retention Process - the key tasks and stages for data to be extracted t -what is done internally and externally to the business Analysis and search - how relevant data is found from within the corpus Benefits of an evolved EDD strategy: Strategy based on knowledge of facts not assumptions A defensible, repeatable process Reduced risk of not finding or deleting relevant data Immediate access to relevant data, in advance of investigations and litigation, saving time and money Reduced costs % is common. 10

11 Opportunities exist to better manage the extraction, analysis and control of ESI for investigation and disclosure Scale, risk and case load are key determinants of EDD regarding make vs. buy decisions. Better practice: Data Removal/culling of unwanted data from corpus Real-time de-duplication of data Knowledge of where data exists Holistic view of data that is likely to be spread over multiple data stores ( , archive, document management systems, sharepoint etc). Different business units and / or geographies. EDD technology embedded in enterprise systems and storage Concurrent search index and analysis EDRM key stages understood and implemented Business process re-engineer out dated processes to meet increased legislative requirements and take advantage of emergent technologies. Process optimise internal processes to integrate EDD efforts across the corporation. People build internal capabilities. Procurement optimise outsourcing arrangements and induce providers to invest in integration of process, methods and policy. OPPORTUNITY: DESIRED STATE 11

12 Implement a strategy to optimise EDD in the enterprise Business Case - Collect data on all EDD related activities to understand scale, duplications of effort. Analyse to identify synergies and develop value proposition. Strategy define an EDD strategy that is optimal for the enterprise. Key areas are: Strategy should the enterprise continue in a reactive way or implement a proactive strategy that identifies risks early and manages EDD proactively? Governance how will the enterprise coordinate and manage EDD? Who will be responsible? Funding? Business case understand the real costs of EDD and identify mechanisms for efficiency. Processes re-engineer processes to reflect new legislative requirements and legal requirements for electronically stored data. Data identify key data sources, rationalise what needs to be kept, reduce scope by deduplicating, implement information management. Enable enterprise wide searching and analysis. Technology Exploit emergent technologies that enable previously expensive outsourced services to be managed internally. Procurement Rationalise the scope of work outsourced and integrate policies, procedures, and technologies to improve efficiency. i Implementation implement in stages as new EDD tasks emerge with a view to filling out the corporate EDD strategy in a cost neutral way. 12

13 There are two strategies for bringing ediscovery in-house: Incremental or Dynamic. Incremental strategies flesh out the vision and build capability on the back of each opportunity. A Dynamic strategy would put in place all components of the capability simultaneously. STRATEGY OPTIONS Incremental Where can we be next year? Versus Dynamic - efforts undertaken with strategy driving procurement decisions Vision of where we need to be five years from now Goal Goal Actions driven by strategy Where we are now? Actions taken in response to circumstances Where are we now? Time Time 13

14 Risks need to be mitigated Risk Implication Mitigation Defendability of internal A key reason for outsourcing Implement robust auditable process may increase legal risk ediscovery was defendability and allocation of risk to a respected third party specialist processes supported by quality systems. Retain services of external advisors to implement and audit governance, and systems ediscovery becomes just another stove pipe system Internal capability can t cope with volume or complexity Complicates information management, overlaps with other systems and diverts resources. Poor quality of results and increased legal costs or business costs. Implement as part of a coherent information management strategy and architecture. Retain the services of expert advisors who can scale up internal resources as required. 14

15 Business benefits Business Value Implication How Manage litigation, regulatory and Identify risks before they emerge Integrate ediscovery with operational business risks proactively rather then reactively and then manage them holistically information management into the corporate risk management strategy Reduce costs (15 to 50%) Avoid costs of event escalating. Index content in native format in Reduce cost by more efficient processes. Avoid outsourced service costs. Avoid third party incompatibility. situe to reduce collection and analysis costs. Take advantage of improved technology to build internal capability. Resolve issues promptly (days not months) Improve access to organisational information for better decisions Many cases spiral out of control then fester for years. Resolve them quickly by more timely access to information. Gain visibility to all corporate data and the ability to manage it. Understand exposure quickly by early case assessment behind the firewall to make timely business value decisions. Integrate with information management strategy to improve access to unstructured information. 15

16 What could be done today? Initiate discussions between general counsel, CIO and information management about where data resides, regulatory and compliance requirements, and responsibilities. bl Draft high level policies and procedures that improve litigation and compliance readiness. Conduct a test of readiness to identify key challenges and workarounds. Start discussions with stakeholders about re-engineering ediscovery and the business case. Conduct training for IT, in-house lawyers, and information management staff. Research best practice ediscovery. 16

17 Authors, references and resources Material for this presentation was jointly prepared by: Brett Webber, Associate Director KPMG Forensics. Graham Costello, EMC Information Governance Group. Institute of Information Management Presentation on ediscovery Seamus Byrne August KPMG Managing Electronic Data for Litigation and Regulatory Readiness A Global Survey 2009 EMC Bringing ediscovery In-House for Dummies Electronic Discovery Reference Model

18 Q&A 18