Management and Litigation Risk Management

Transcription

1 and Litigation Risk is one of the most heavily used applications in every enterprise. But it s also an application that, without proper management, can threaten an organization s future. Just ask Goldman Sachs, whose s concerning the likelihood of the mortgage market collapse got the firm s current and former executives into trouble with Senate investigators. Or Toyota, whose s discussing how to deal with its products mechanical problems led to a major public relations snafu, not to mention a precipitate decline in its U.S. sales. is a mainstay of business communication a repository of the interactions that take place among employees, customers, and suppliers. Most organizations have come around to the importance of properly managing these communications. (If you haven t, please see the sidebar on page 4.) The problem, though, is how to go about performing management effectively. A few years ago, many organizations turned to the enterprise content management (ECM) vendors to do it, with the idea that a single vendor solution with records management (RM) capabilities could manage both and other kinds of electronic records. But there were problems. The solutions couldn t scale to accommodate high volumes of messages and mailboxes, plus they couldn t provide fast, reliable access to messages and attachments once they d been placed in the system archive. management turns out to be more complicated than the vendors and their customers originally anticipated. Now we see many organizations simply jettisoning their failed management implementations and starting over. And some of the suppliers have modified their expectations for providing complex management functionality, focusing instead on the basic aspects. That s where matters stand now, from the technology standpoint. But in the meantime, you (and your organization) still have legal and compliance obligations to meet. Given the situation, what should you be doing now to reliably and effectively manage your organization s ? And what tools if any should you be using to do the job? Doculabs Recommended Approach This document outlines a simple, proven approach for implementing management. It s based on the best practices of organizations that we ve assisted and benchmarked; on our knowledge of the relevant technologies and products; and, probably most important, on our knowledge of what works and what doesn t in actual practice within organizations. The approach is designed with reasonable, realistic expectations for the roles of all participants involved in management, including ordinary users, IT, Legal, and the vendors involved. In a nutshell, it consists of the following three steps: This approach to management leverages a combination of the technologies that have been proven to work in real world situations, and it s specifically designed to avoid the failure points of most of the other approaches. Note that while this approach will likely work for most organizations, you may need to modify it to meet your own particular requirements.

2 The Scope of the Problem or Why It s So Difficult Clearly, proper management of is essential to corporate accountability. Many s document business decisions and should be classified as business records, with the same obligations of lifecycle management, according to defined procedures established by regulatory authorities and the courts. Like other business related information, should neither be destroyed nor preserved arbitrarily. But it turns out that is different from much other businessrelated information. First, there are the high volumes of requiring management. Consider that more than 4 trillion s are sent per day in North America alone. Even within a single organization, represents a sizable haystack. Determining which of those s warrant lifecycle management as business records is no easy task, and the technology to do this isn t quite there yet, either. (The auto classification engines that are supposed to determine which s to archive and which categories they should be sorted into have yet to perform up to par.) Then there s the question of where your organization s is stored. Perhaps it s all archived on backup tape or on optical disc. Neither of these storage media is granular enough to enable effective retention or disposition on s, based on their content. (E.g. you can t selectively retain, dispose, hold, or release s based on what they re about.) All of which is highly problematic when you need to produce all s relating to a particular matter to fulfill a discovery request or respond to a regulatory inquiry, for instance. Even more insidious are personal files or archives (PST files in Microsoft Exchange and NSF files in Lotus Notes). Say your organization has a corporate policy that sets individual mailbox quotas as a way of limiting how much it s retaining. In the absence of clear policies and procedures, employees can just move their s into personal files and store them on laptops, home computers, or USB drives all of which puts the organization at risk of exposure in litigation discovery, with potential for serious damage. Also consider attachments: the vast number of documents that get sent around to various parties, in lieu of other methods of document sharing or approval routing what we like to call poor man s workflow. winds up being used as a document management system for all these documents, which greatly complicates your efforts to impose proper retention and disposition. What exactly are the impacts of each of these issues surrounding ? The checkboxes in the table below tell the story, showing where each of the issues discussed above has significant negative impact on an organization. Most of the in organizations is not managed, or even should be managed, like ordinary business records. In many instances, does not include regulated documents and typically isn t a proactively declared record or classified via retention schedules in the enterprise records plan. However, is more difficult to inventory and control, plus it s of indeterminate risk and value to the organization all of which poses particular challenges from a governance standpoint.

3 The Advantages of Doculabs Recommended Approach Doculabs approach to management leverages a combination of the technologies that have been proven to work in real world situations. Moreover, it s specifically designed to avoid the failure points of most of the other approaches. Other approaches may appear to be simpler e.g. because they require just one software product. These are the ones that tell you to just archive everything, or to just use autoclassification from an management product to select only the s you want. But these approaches have been tried, and they have been found lacking. Take, for instance, approaches that rely on management systems. Unfortunately, most of these systems can t scale to archive every last from your system. And you need to have the scalability to archive every last , in order to guarantee the retention of every in the event your organization needs to impose a legal hold. Doculabs Step 2 addresses this by ensuring retention of all s for a longer default period, via an archiving system. These systems do have the storage capacity to handle high scale archiving. Then there s the practical problem of approaches that lock down user access to the archive, once s have been moved out of the system and into the archive. The problem is that users respond by squirreling away their s on their hard drives or in PST or NST files a practice that wreaks havoc with an organization s efforts at disposition. Step 2 of Doculabs approach addresses this issue by providing users limited access to s that have been placed in the default archive. We ve seen other approaches to management that do allow for high user access to the archive, but they tend to provide slower, less reliable access. Again, the response of the average user will be to create a private stash of s. Doculabs Steps 2 and 3 address this problem by providing limited access to s in the default archive and by providing longer term access via the ECM system, with proper retention and disposition applied. Finally, we ve seen organizations try to use the archive to manage multiple, complex, non default retention periods. This is asking too much of these products, which simply aren t designed to deliver such granular control. Step 3 of Doculabs approach addresses this issue by handing off s that require longer retention (i.e. longer than the default retention of the archiving solution) to an ECM/RM system that s designed to provide these capabilities. Basically, Doculabs approach to management meets the needs of both users and the organization. It capitalizes on the usability of the system (Step 1), it provides assurance of access to s that have been archived once they exceed the retention period of the system (Step 2), and it ensures appropriate retention and disposition of those s that must be retained longer term for business or legal reasons (Step 3). Doculabs Recommended Approach to

4 In fact, for many organizations, the most significant aspect of electronically stored information (ESI) like is that it s unlikely that any particular item will be requested in discovery. On the other hand, it s highly likely that some of this ESI will be uncovered, collected, and that opposing counsel could determine it to be relevant to a discovery event. If it s not managed reasonably well, that can have a significant negative impact on the organization, either because the item is produced and is damaging, or because the item cannot be produced, but the court rules that the organization should have been able to produce it. Add to these considerations the level of expectation that s been created since the new Federal Rules of Civil Procedure (FRCP) went into effect late in It s a whole new climate, presenting organizations with even greater need to make sure that appropriate Information and Records Lifecycle is being applied to their s. What You ll Need This approach has a required parts list. In addition to your existing System (typically, Microsoft Outlook/Exchange or Lotus Notes, but also other products), you will need: Archiving System. This is a large archive into which you will migrate some or all of your and which will serve as the default archive. Non Default Retention. This is not a product or system, but rather a capability, specifically, the retention capability that can be applied to those s that you need to keep for longer than the period set for the system or for the default archive. Enterprise Content /Records System. By this we mean an enterprise content management (ECM) system capable of managing electronic documents and other unstructured electronically stored information (ESI). Ideally, the system is successfully implemented and in production in the primary line of business and administrative processes in your organization. If possible, it should also provide records management (RM) capabilities particularly managing retention and disposition according to your organization s records retention plan. What Doculabs recommends as an approach to management is essentially a staged approach to archival and retention staged, that is, across the Information and Records Lifecycle. As we ve noted, the single bullet approach (ECM plus RM) didn t work. This three staged approach does work and it addresses the scalability and access issues discussed previously. Is an RM system a prerequisite for this approach? To get rolling with the approach recommended here, it is not really necessary to have RM capabilities deployed as part of the ECM environment, as long as retention and disposition of s (and other documents in the ECM) can be managed with some reliable, perhaps manual, approach. Actually, deploying RM technology successfully is more complex than management, so you want to be sure that you are taking the right approach to that endeavor as well. For more information, see Doculabs Discovery Readiness white paper: discovery. Making the Case for Determining whether there is a good business case to be made for management in your organization is fairly straightforward. Here are the four primary areas to quantify: Reduce the risk and cost of discovery and litigation 2. Reduce the cost of storage 3. Improve the efficiency of your system (e.g. improve search and eliminate the need for mailbox quotas and PST archive files for users; some reduction of IT backup requirements) 4. Improve the operational efficiency of your line ofbusiness and administrative processes, where messages are part of those processes; productivity gains resulting from improved search and access Doculabs has an E discovery ROI Calculator to help you analyze the potential business case for deploying technologies like management for e discovery. Get the white paper and watch the explanatory video here:

5 Doculabs Consulting Services management is a part of an effective strategy for records management and e discovery all the more reason to understand the underlying requirements of management and have a strategy for addressing it. Doculabs can help you assess the gaps in your management capabilities as well as the other facets of your approach to managing electronically stored information and your records management program. Technology specifically, ECM technology is a key part of any approach to corporate governance. It facilitates records management (which includes record retention, maintenance, and disposition); it s also the centerpiece of an organization s approach to e discovery. But just as important are the non technology aspects: the policies and procedures for effective governance. A typical consulting engagement consists of the following phases: 1. Assessment Doculabs will work with you and your project team to assess your organization s current state and define the functional and technical requirements for addressing management, records management, or e discovery (from both a process and technology perspective). 2. Records Policy Framework Development Doculabs will assess the gaps in your organization s current policies and procedures for management, records management, or e discovery. Doculabs will then develop recommendations and create templates for the future policy and procedure documentation. 3. Future State Conceptual Design Doculabs will create a future state vision and conceptual design for the technology environment that will address your business priorities and your management, records management, or e discovery processes. 4. Deployment Strategy Based on the future state conceptual design, Doculabs will work with your team to develop a high level deployment strategy. This will identify the specific projects, the resources required, and the benefits you can expect when moving to the identified goal, with a staged delivery plan for management, records management, or e discovery initiatives. Financial Impact Analysis We also know that organizations struggle when it comes to quantifying the savings associated with using ECM to more effectively manage their information. It s essential to build a credible business case in order to qualify the viability of an initiative, prior to any requirements gathering or system design. Doculabs helps you understand the order ofmagnitude savings estimates you can expect, based on industry data. We then give you the tools to communicate those savings projections to executive management. We offer Financial Impact Analysis in the following areas: Electronic Discovery: Quantify the savings associated with data collection, review, and production in support of litigation matters Content Archival: Estimate the reduction in storage costs by applying tiered storage, de duplication, and disposition capabilities