Corporate Governance - The Importance of a Compliant Record Retention Program. by Christopher N. Weiss 1

Transcription

1 Corporate Governance - The Importance of a Compliant Record Retention Program by Christopher N. Weiss 1 A. Rationale for a Sound Record Retention Policy Record retention is crucial to disciplined corporate governance. Its importance is highlighted with each new jury verdict and court decision that metes out severe punishments to prominent companies for mishandling their records. Implementing a compliant record retention program can be daunting. Businesses find themselves inundated with bulging file cabinets, their employees busy clicking away on , exchanging voice mails, and saving cumulatively to network servers terabytes of computer-generated documents. Most companies have some form of record retention system to respond to the evergrowing accumulation of records, ranging from an employee-by-employee method for retaining records to a formal written record retention policy with a detailed retention schedule. The trend has moved away from a company s reliance on its employees individual judgments toward the adoption of an enterprise-wide, written record retention policy and schedule. This move makes good business sense. Absent a compliant record retention policy, companies have found themselves burdened with inconsistencies, with some individuals retaining certain records while others are purging the same categories of documents. Inconsistent practices breed inefficiencies. Significant difficulties include loss of time and money searching or records; loss of evidence to support positions in business negotiations or in litigation; breaches of employee, customer or patient privacy rights exposing a company to potential fines and adverse publicity; risk of court sanctions; adverse inferences in litigation; charges of obstruction of justice or contempt of court; and personal criminal liability. Implementing a compliant record retention program is made more complex with the migration from paper records to electronically stored information. Up to 80 percent of all company records are now created and maintained exclusively in electronic formats. As such, the typical company maintains a mixed repository of paper documents (significantly more numerous for 20th century records) and electronically stored information. To compound the record management task, a substantial portion of records in many companies possession serve no enduring business purpose, remaining indefinitely in file drawers or on electronic servers notwithstanding retention schedules that specify purge dates. Despite its inherent challenges, sound record retention management is necessary for effective corporate governance. Directors and officers expect it, as do shareholders, government regulators, the courts, and the general public. 1 Chris Weiss is a principal in the Seattle office of Stoel Rives LLP. His practice focuses on commercial and products liability litigation. Chris is responsible for the firm s automated legal services group, which handles litigation technologies and ediscovery. He is the former chair of the Stoel Rives Litigation Practice Group. Chris can be reached at SF:

2 B. Formation and Implementation of a Policy Fundamentally, a policy should guide employees so they know which company records should be retained, for how long, and by what method. Employees must know the timing and process for purging records. To appropriately implement a record retention policy, the company should take the following actions: 1. Assessment of Current Records. The first step is to determine what types of records the company maintains and where those records are stored. At the assessment stage, the company must carefully assess its organizational chart and the various business and management activities it undertakes. These activities are not just outward toward its clients and customers, but internal as well, dealing with such matters as human resources and employee benefits. In conducting a records inventory, a company should assess both its paper records and information stored on microfilm and electronically. The company must identify records located at its offices, and those it maintains off-site, in its employees or agents home file cabinets and computers. To put into context the potential breadth of electronically stored information, such information can be divided into four categories: Active Data: Readily available data typically residing on network computer systems, user hard drives, and other routinely accessible storage devices; Archive Data: Data maintained apart from active data for record-keeping purposes; Disaster Recovery Data: Data to restore the system in the event of system failure, often overwritten by more recent backup data; and Residual and Legacy Data: Data not usually accessible, including hidden, deleted, fragmented, or damaged data, or data created by no-longer-used software. 2. Appropriate Retention Period and Media for Storage. After identifying the types and locations of records, a company should establish the appropriate retention period for each type of record and identify an appropriate medium for storage. The duration for a particular record retention category may or may not be prescribed by law. In addition, a company has its own business reasons for specifying a retention period, which sometimes may be longer than the minimum period required under law. Establishing appropriate retention periods for each type of company record is a challenging part of drafting a policy. Some record retention schedules may contain recommended retention periods for only four to six broad categories of records, such as employment or tax. These short-form schedules are generally used only by small companies. For larger organizations, record retention schedules often are set out in detailed spreadsheets that are dozens of pages long and identify retention periods for specific records, such as W-2s, time cards, insurance policies, contracts, and patent applications. There are costs and benefits to each approach. We generally advocate a middle ground and advise retention periods for several broad categories of records. A company s business requirements often warrant longer retention periods for certain records. Business requirements, historical or possible research value, and litigation potential may support extending the duration of a retention period. 2

3 The company must select and make available space and electronic storage for record retention, with a corresponding investment in retention resources, both personnel time and financial cost. Generally, companies retain records in local areas for a time and then move the records to an off-site storage area and/or to backup tapes or discs when the records are no longer required for daily business operations. Factors to consider with respect to long-term storage are cost, availability, technical capability, administrative capacity, security, and the evidentiary nature of the records to be retained. Businesses continue to move toward a purely automated storage system of scanning records onto a digital medium, but that method is not without risk. Although automated storage systems save space, there is still a significant risk of loss or corruption of electronically stored information or of technical difficulty in accessing records. Courts have not yet reached a consensus as to the admissibility of scanned records in place of the original hard copy. Consequently, until the issue is more clearly resolved, we recommend keeping hard copies of all paper records within a defined retention class. 3. Appropriate Considerations During Record Retention. A company s obligation to maintain the confidentiality of certain records or to protect the privileged nature of records does not cease during the record retention period. As such, the company should consider the following when formulating a policy: a. Confidential Records. Records such as payroll, personnel, health, drug testing, medical, and credit documentation are given certain privacy and confidentiality protections by statute or rule. The company should include provisions in its record retention policy clarifying that all records generally considered to be private or confidential will continue to be treated as such. For example, the policy could require that such records be marked confidential and located in a separate area of the storage facility with access limited to authorized personnel. b. Attorney-Client Privilege and Work Product. As with confidential records, records subject to either the attorney-client privilege or the work product doctrine should be clearly labeled and located in a separate area of the storage facility with access limited to authorized personnel. 4. Appropriate and Consistent Record Purging. Records should be purged regularly pursuant to the record retention schedule. Records should be purged - whether paper or electronic - include both those on premises and those in off-site storage. Purging must be performed in a manner that ensures continued confidentiality or privilege of appropriate records during the destruction process. Although specific records may warrant different treatment, in general, shredding confidential paper documents is sufficient. The company should work with its information technology personnel to determine how best to ensure the permanent deletion of electronic records, because many computer systems retain deleted files on the hard drive until that portion of the hard drive is overwritten, which can sometimes take several months or years. 5. Litigation Holds. A procedure for implementing a Litigation Hold is vital to managing corporate records. A company must have a clear mechanism that ensures that record purging can be suspended promptly to prevent loss of records (1) upon notice of potential 3

4 litigation or the receipt of service of legal process for which those records may be relevant, (2) upon learning of a government inquiry, and/or (3) during the course of voluntary cooperation with governmental authorities. Paper documents long have been sought through the litigation discovery process. Electronically stored information also is a legitimate target for discovery in litigation ( ediscovery ). For parties in litigation, courts impose high standards for management and production of electronic stored information. Failure to produce such records, even in the face of inadvertent data destruction, has resulted in tough sanctions, including adverse jury instructions, exclusion of evidence, monetary penalties, and entry of default judgments. As soon as your company reasonably believes that a claim may be filed by or against the company, your organization has an affirmative duty to preserve relevant records, both electronic and hard copy. The company should impose a litigation hold as its policy of preserving potentially relevant evidence. In implementing a Litigation Hold, a company should work with litigation counsel to implement a properly scaled approach. A person should be designated to evaluate the preservation of potentially relevant electronic evidence. Preservation should be broad. The investigation should include (1) a review of the company s electronic information retention architecture and system, (2) a meeting with company information technology ( IT ) personnel to understand system wide backup procedures and the company s electronic information recycling policy, (3) a meeting with key players in the litigation to discuss how they manage electronic information, (4) the preservation of potentially relevant electronic evidence, and (5) instruction to all pertinent employees to produce copies of their relevant active files and ensure that all backup media, such as backup tapes, are identified and preserved Adherence to the Record Retention Program. After adoption of a record retention program, it is critical that a company clearly communicate the policy to the personnel who create, store, and purge records. Most important, records must then be created, stored, and purged on a consistent basis in accordance with the policy. A court will likely construe against a company the purging of records in contravention of a policy, and severe consequences for noncompliance can result. C. Additional Considerations and Avoiding Pitfalls 1. Consider Creation of Documents. A component often overlooked in a policy is educating employees about what documents should be created in the first place and establishing guidelines for creation of those documents. For example, employees should be instructed that when drafting any document related to the business, they should assume that the document will exist forever, that it could be published in the national media, and that it could be quoted out of context. Employees also should be instructed to avoid drafting documents that are unnecessarily 2 A form for a litigation hold appears in Appendix A. 4

5 accusatory or describe internal disputes, that draw legal conclusions (unless the author is a lawyer), that contain overstated expressions, characterizations, opinions, or inflammatory phrases, or that are intended as a joke but might be read at a later time as fact. Additionally, employees should be encouraged to avoid drafting documents that discuss liability issues, except when requested by legal counsel. Similarly, we recommend reminding employees that people tend to converse more frequently and carelessly via electronic communication, and that electronic media lacks both tone and context that would otherwise accompany communications. Consequently, employees should be cautious in the communications they make via or other electronic means of communication. 2. Consider Duplicate Documents. Often employees make and keep duplicate records. Duplicate documents can be problematic because employees may make personal notes, including preliminary thoughts and opinions, on the face of duplicate documents. Additionally, because employees often keep duplicate documents in their private office files or off-site, these documents are often overlooked when files are purged or stored pursuant to the policy. Thus we suggest including a provision in the policy that discourages employees from keeping duplicate records in personal files or off-site and that encourages employees to locate any duplicates they may have, so those documents can be disposed of or kept in accordance with the policy. 3. Consider Mixed Documents. Some records are neither fully personal nor fully professional. For example, an executive s desk calendar may contain information about sensitive internal executive meetings as well as family birthdays. These records are often considered discoverable documents in litigation. Information contained in these types of documents may not be protected by the Fifth Amendment right against self-incrimination, and their production could lead to uninformed and incorrect conclusions. However, these records often include helpful information in litigation. Therefore, in the first instance, employees should be counseled to refrain from including personal information in the company s corporate records (e.g., in corporate calendars and files). Employees should appreciate that mixing personal and business records not only is inappropriate but also could prove embarrassing. Second, we suggest including in the policy a provision that any mixed records be purged only when they are no longer necessary for business purposes. 4. Consider Drafts and Superseded Records. Most records are not created in their final form, but are revised by their author or revised through negotiations with a third party. In either event, generally only the final version of a record should be retained under the policy, and all drafts, preliminary documents, or other superseded records should be clearly marked as such and discarded (or, as appropriate, forwarded to the company s legal counsel) at the conclusion of a project. There are exceptions for certain legal records or superseded records that have been incorporated by reference into later records or for situations in which it is important to document the negotiation process. 5

6 Appendix A Litigation Hold Notice To: [Company Managers - Relevant Departments, Related IT Managers, Specific Persons Involved with Dispute] From: [General Counsel, Risk Management, or Other Senior Management] Re: Litigation Hold Preservation of Relevant Information: Paper Documents and Electronically Stored Information Date: [Date] From time to time, our company is involved with litigation. We currently are involved in a dispute involving [basic description of case]. The parties to the lawsuit allege, among other things, [basic description of subject matter or allegations]. We intend to vigorously [defend against these allegations and/or pursue establishing our claims/counterclaims]. During the course of litigation, our company may be required to make certain of its paper files and electronically stored information available both to our own lawyers and to the legal staff representing the other parties in the case. It is crucial that you take affirmative steps to preserve both paper documents and electronically stored information that are relevant to this dispute and that are in your custody or control The failure to preserve these materials could be detrimental to our position in the litigation. We request that you preserve electronically stored information, including , electronic calendars, financial spreadsheets, Word documents, CAD documents, and other information created and/or stored on your computer. The time period at issue in this case is [insert date span]. Although this time period might be adjusted as the litigation proceeds, this date span is a good starting point to assess the materials you should preserve. Please note that our company has in place a record retention schedule. By this notice, you are requested to suspend compliance with the record retention schedule for those documents and electronically stored information that you determine are relevant. Do not discard documents or electronically stored information that are relevant. Do not delete, overwrite, alter, or destroy such materials. Our IT staff has been notified of this Litigation Hold. IT will be working with our legal department to ensure we implement the Litigation Hold. We will follow up with more information as the litigation proceeds, including advising you when the Litigation Hold is lifting. In the meantime, if you have questions, please give [insert NAME and phone number].