White Paper: Managing ediscovery Initiatives In-House. Managing ediscovery Initiatives In-House

Transcription

1 White Paper: Managing ediscovery Initiatives In-House Managing ediscovery Initiatives In-House

2

3 Introduction Traditionally, enterprises responding to litigation, compliance, auditing or similar events have delegated responsibility for ediscovery tasks to third-parties such as law firms and their support providers. However, as volumes of electronic documents in enterprises increase and ediscovery costs escalate accordingly, there is a greater need for organisations to take more control of ediscovery processes. Progressive organisations are starting to manage ediscovery like any other business process - one that is repeatable, defensible and measurable, and are achieving greater cost control and risk mitigation around their ediscovery and information management initiatives as well as more successful outcomes from their litigation activities. Regaining ownership of corporate ediscovery requires careful consideration of your organisation s specific situation and needs, an understanding of how various ediscovery processes operate, and the roles that people and technology elements play around those processes. It also requires a careful balance between the elements that should be done in-house, versus those best suited to remaining as outsourced activities. The goal of this Espion white paper is to help organisations understand more clearly how they can move towards better implementation of ediscovery initiatives - and to achieve the right mix between in-house and outsourced ediscovery expertise. Reactive ediscovery There are several common themes that occur when an organisation delays thought on ediscovery to the very last moment - typically when a sudden and unexpected involvement in litigation or similar event occurs. Typical ill-fated consequences include: Organisation jumps into rapid-reaction panic mode. Once a litigation event occurs, ill-prepared organisations rush to hire outside law firms, who in turn hire digital forensics experts from the outset. This sets a costly money-meter in motion, with little client visibility or control on the final tab. Key day-to-day business processes are disrupted. Various internal stakeholders are mandated to find the necessary information in line with third-party information requests. C-level executives, IT stakeholders, legal departments, and other stakeholders become side-tracked and distracted from core day-to-day activities. Personnel are haphazardly reallocated to the ediscovery task, and traditional cash flows become compromised. Information key to a litigation event becomes compromised. Badly planned ediscovery approaches can lead to mistakes that can limit or even invalidate key electronic information being used in a litigation event. Information that is unknowingly destroyed or tampered with at the wrong stage in a legal event can have disastrous consequences. Hence it is important that standardised ediscovery processes such as EDRM or Sedona are understood internally and integrated effectively with your ediscovery approach. Companies resort to expensive upfront settlements. Ill-prepared organisations often resort to settling cases out-of-court, often at a very high cost. Such scenarios could be avoided with a proactive, planned ediscovery strategy. Managing ediscovery Initiatives In-House Page 1

4 Towards a Balanced ediscovery Approach It s important to ask several key upfront questions to establish the kind of ediscovery approach that applies to your enterprise - be it an in-house, outsourced, or hybrid approach. What s your company s litigation profile? It s important to understand the profile of your organisation with respect to litigation and regulatory activity. Is your particular vertical highly regulated (e.g. energy, financial services, pharmaceutical sectors) and is attention to related events the norm? Do litigation events involving your enterprise occur frequently? Do these legal events occur in consistent cycles, or can peak litigation periods be anticipated in advance? What is the potential outcome of those events - are they often bet the company scenarios, or impactful on corporate reputation? Answering yes to these and similar questions suggests the need for a proactive approach to ediscovery with significant provision for in-house processes and technology. What s the financial profile of existing ediscovery initiatives? It s important to compare historical costs of ediscovery initiatives with existing provisions for financing them. For example, does your company have a formal ediscovery budget? Is it defined as a specific capital expense (more ideal) or it is taken from general operating budgets as needed (less ideal?) Is there a way of assessing inbound and outbound cash-flows relating to ediscovery over time? Such analysis is important for developing a return-on-investment (ROI) argument specific to your organisation s needs. How consistent or complex are your typical ediscovery use-cases? This involves comparing individual ediscovery cases that occur in your organisation. Some organisations may find that their ediscovery cases are focused and repeatable - litigation requirements around human resource topics are one example. Other organisations may find that every ediscovery matter is unique and different - dictated by factors such as diversified business interests, broad regulatory requirements, differences in outside counsel and ediscovery approaches used, the need for expert testimony and auditing, and so on. How are your personnel assigned to ediscovery efforts? The ediscovery effort can involve input across different areas of expertise including legal, IT, records management, HR and the functional business units. In some organisations there will be hard-and-fast distinctions between these, and ediscovery initiatives will operate informally across this structure. Other, more progressive organisations will craft a specific crossfunctional team across these and other business units to handle ediscovery projects. ediscovery Process Steps - Finding The Right Balance Any effective ediscovery solution must have some reference point from which to understand how different process steps should be handled. In today s arena, two key frameworks used for managing ediscovery activities are: The Electronic Discovery Reference Model (EDRM) ( The Sedona Principles ( Managing ediscovery Initiatives In-House Page 2

5 Figure 1 EDRM Process Steps This section focuses on the different EDRM steps (Figure 1) and considers how each might be treated depending on your specific corporate context. As the diagram indicates, this process can be highly iterative. Aside from the clear goal of achieving ROI, there are a several benefits to bringing different phases of this process in-house - for example: Increased likelihood of a favourable outcome to the underlying litigation or similar event Greater ability to add focus and manage scope of ediscovery Greater ability to control ediscovery activity costs Increased insight into how to manage the process and make it more repeatable over time Reduced disruption to internal data custodians and those who manage and maintain the IT infrastructure. With respect to the individual EDRM stages, the following considerations should apply: Information Management: this first step involves getting your electronic house in order, by preparing in advance should an ediscovery event or other large scale information gathering exercise be required. It requires close collaboration between key stakeholders such as legal, IT, records management, information security, HR, audit and the different functional business units. Appropriate, upfront in-house information management will greatly enhance the ability to identify, preserve and collect pertinent Electronically Stored Information (ESI). Identification: this is where potential ESI sources are located and assessed for their scope, depth and breadth in relation to a pending or prospective legal proceeding. The ability to in-source tasks in this step is dependent on the scope of internal resources available - in particular whether IT can assist legal stakeholders in creating a map of all relevant data sources. This requires necessary ediscovery knowledge, skills, as well as having the time available as needed. Managing ediscovery Initiatives In-House Page 3

6 Preservation: this important step is to ensure that ESI is protected against inappropriate alteration or destruction. This is in line with a hold notice issued by legal stakeholders - the timing of which is crucial to the integrity of the information collected. In order to manage this stage in-house, it s crucial that legal, IT and outside counsel are able to co-ordinate effectively to hold these notices - and to reinforce reminders to data custodians over time. However in some cases it s better to outsource, especially if the litigation is highly contentious and the use of a neutral third-party may make the evidence in question more defensible in court. Collection: this relates to gathering ESI for further use in the ediscovery process, and is highly interlinked with the Preservation stage. Again, this stage must be handled carefully to ensure that the approach will stand up to judicial scrutiny, and that data authentication and chain-of-custody protocols are adhered to. Managing this activity in house is easiest when the file types in question are easily harvestable by capable IT personnel, using proven tools that don t change relevant metadata. However outside help may be necessary if the litigation is highly contentious and requires testimony - or if there are difficult file types requiring external expertise. Processing: this step involves reducing the volume of ESI and converting it, if necessary into forms more suitable for review and analysis - with the main goal here being to reduce the data volumes necessary for expensive downstream attorney review, while ensuring that the correct scope of information is delivered. There can be significant ROI achieved by bringing this stage in-house, especially when dealing with a large repeatable caseload over time, and where large volumes are involved. However when litigation is less predictable or infrequent, outsourcing can be a more favourable option. Analysis: This stage involves evaluating and scanning ESI for content and context, including key patterns, topics, people and discussions. This stage usually helps users to understand what they need to do and what their data tells them about the dispute at hand. Internal personnel are often familiar with issues around the subject matter and may be able to act on the data quickly - a factor making this stage suitable for in-sourcing. However outsourcing may be more favourable when the case requires a thorough, brute-force approach to assessing documents. Production: This is the last significant stage in EDRM, and involves delivering ESI to others in appropriate forms and via appropriate methods of delivery. In order to manage some or all of this stage in-house, it is important to understand whenever possible the specific file format requirements requested by the requesting party - and to provision for these file formats in earlier EDRM steps. For example, if the requesting party wants a native file production with metadata, then this will be extremely difficult if the producing party has turned native files into.tiff images during the processing stage. Without this prior treatment, it may be difficult to produce the correct formats and perform necessary conversions. Hence, in order to handle this stage inhouse, it is favourable if production formats can be pre-negotiated into native or XML standards. Managing ediscovery Initiatives In-House Page 4

7 What Espion Can Provide Espion deliver comprehensive forensic, ediscovery and litigation support services to in-house counsel, law firms, corporations and government agencies - combining innovative technologies, unrivalled experience, and industry leading best practices. We can provide all the necessary support and advice to help you decide the ediscovery approach most suited to your needs, including: Technology decision assistance: Espion have a deep understanding of leading-edge ediscovery technology solutions and their suitability to different scenarios. We also maintain partnerships with top vendors in the space and can assist you in choosing your solution. Key high-level considerations in choosing your solution include: Strong integration with EDRM process methodology, or analogous process approaches relevant to your ediscovery scenario Ability to integrate solutions with existing information management/records management approach and solutions Ability to support strong implementation of a legal hold Strong, multi-phase search capability that meets stringent legal requirements Licensing and deployment options: Espion can help you decide which deployment approach best suits your ediscovery scenario. Options include: Fully Hosted: this involves accessing ediscovery content from a remote third-party server, uploading relevant files to the hosted solution on an as-needed basis. This is best suited to scenarios where ediscovery support is required on an ad-hoc basis, and caseload volumes involved are on a smaller scale. On-premise full purchase: deploy your technology solution in-house, purchasing the solution outright. This is most suited to companies with consistent and extensive ediscovery requirements, with large caseload volumes. On-premise leased: this hybrid option allows the solution to be hosted in-house, but on a temporary, leased basis. This offers the benefits of both in-house and leased options while also alleviating potential concerns about exporting sensitive data outside the building. EDiscovery process implementation support: Espion can assist you in identifying the right balance of in-house and out-of-house support across your entire ediscovery process. In particular, how to treat each process stage step (be it an EDRM-based approach or otherwise), how to allocate internal and external personnel, interleaving your chosen process with a suitable technology solution. Need To Know More? Contact Espion at +353 (0) or info@espiongroup.com Managing ediscovery Initiatives In-House Page 5

8

9 About Espion Espion are Corporate Information specialists. We work with organisations across all industries and business functions to provide advice and assistance relating to the holistic compliance, protection and management requirements of their most valuable asset information. This allows our clients to focus on their core business and ultimately achieve greater success. Espion Headquaters Corrig Court, Corrig Road, Sandyford Industrial Estate, Dublin 18, Ireland +353 (01)