Becoming Litigation Ready Through Proactive Information Governance

Transcription

1 WHITE PAPER: EDISCOVERY AND LITIGATION READINESS Becoming Litigation Ready Through Proactive Information Governance OCTOBER 2008 Peter Pepiton II CA INFORMATION GOVERNANCE SOLUTIONS

2 Table of Contents Executive Summary SECTION 1: CHALLENGE 2 A Case for Increased Preparedness Managing More Than Just Technology Keeping Everything: An Outdated Practice Updated Guidelines Drive Technology and Process Improvements Trends Point to the Need for Solid Discovery Processes Identifying Pain Points A Few Ways to Assess Litigation Preparedness SECTION 4: CONCLUSIONS 10 Taking a Proactive Approach SECTION 5: REFERENCES 11 SECTION 6: ABOUT THE AUTHOR 11 SECTION 2: OPPORTUNITY 6 Creating an Effective ediscovery Program Mitigating Risk and Increasing Litigation Preparedness Critical Capabilities for Effective ediscovery Key Tactics for Increasing Preparedness SECTION 3: BENEFITS 8 Achieve Greater Benefits With a Comprehensive Information Governance Strategy That Includes ediscovery ediscovery and Records Management Capabilities Go Hand in Hand Copyright 2008 CA. All rights reserved. All trademarks, trade names, service marks and logos referenced herein belong to their respective companies. THIS DOCUMENT IS FOR YOUR INFORMATIONAL PURPOSES ONLY. TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENT AS IS WITHOUT WARRANTY OF ANY KIND, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT WILL CA BE LIABLE FOR ANY LOSS OR DAMAGE, DIRECT OR INDIRECT, FROM THE USE OF THIS DOCUMENT, INCLUDING, WITHOUT LIMITATION, LOST PROFITS, LOST INVESTMENT, BUSINESS INTERRUPTION, GOODWILL OR LOST DATA, EVEN IF CA IS EXPRESSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. CA does not provide legal advice. Neither this document nor any software product referenced herein shall serve as a substitute for the reader s compliance with any laws (including but not limited to any act, statue, regulation, rule, directive, standard, policy, administrative order, executive order, etc. (collectively, Laws )) referenced herein. The reader should consult with competent legal counsel regarding any such Laws.

3 Executive Summary Challenge The process of discovery presents an enormous set of challenges for organizations today. It is costly, disruptive and unpredictable and often forces them to respond to each matter in an ad-hoc manner driven largely by outside counsel and ediscovery vendors. And with information growth rates soaring, stricter requirements for management and control increase the pressure. Compounding this already complex situation is the fact that organizations are scrambling to comply with, and prepare for, the updated Federal Rules of Civil Procedure (FRCP) even years after their enactment to mitigate the various risks highlighted in many recent court cases. This scenario points to the urgent need for a comprehensive information governance solution that includes ediscovery capabilities. Opportunity Companies can increase their litigation preparedness and reduce risk with an information governance solution that integrates the management of all content whether in systems or on paper, disparate content systems, network servers, laptops, voice recordings or elsewhere. This will provide immediate access to content regardless of location or format and enable a straightforward and consistent legal-hold process. Centralized policy enforcement for all information-based applications across the enterprise minimizes risks, increases productivity and contains costs. Benefits The right ediscovery solution can help businesses increase productivity, reduce costs and take a proactive posture toward enterprise-wide compliance, which can also improve their ability to transform the typically reactive processes of ediscovery, edisclosure, information requests and audit. Additional benefits include the ability to: Respond quickly and efficiently to ediscovery requests at a lower cost Remove users from the content preservation process and streamline the legal-hold practice Effectively manage, control and discover information assets to support business objectives, meet obligations and instill confidence Minimize organizational risk to the organization Reduce storage costs by eliminating stale content and the overall amount of content under management Respond with equal efficiency to edisclosures, audits and Freedom of Information requests WHITE PAPER: EDISCOVERY AND LITIGATION READINESS 1

4 SECTION 1: CHALLENGE A Case for Increased Preparedness Today s CIOs, CCOs, COOs, corporate counsels and IT directors are accountable for a host of daunting responsibilities related to the management of corporate information. They must minimize risk exposure, cut costs, improve performance and increase business agility while maximizing existing technology investments. And, the task list continues to grow. For example, the information management landscape is more difficult than ever to navigate because of the updated Federal Rules of Civil Procedure (FRCP). These rules provide guidelines about how organizations must respond to ediscovery requests for Electronically Stored Information (ESI). Managing More Than Just Technology Beyond the challenge of litigation preparedness, organizations are finding that the standard methods of managing information may not be enough. In fact, they are facing legal, regulatory and compliance pressures that demand that information overload is addressed proactively to directly meet business objectives head on. And at the same time, they must implement appropriate safeguards and measures to protect sensitive information and minimize risk through effective and transparent mechanisms that ensure compliance. This has lead companies to widen their efforts, expand their strategies and seek a more holistic solution. This new path, which helps increase control over information, is more accurately referred to as Information Governance. Information Governance is a new approach that represents a shift in the way information is managed. It moves beyond a focus on information repositories, what those repositories can functionally accomplish and their surrounding infrastructures to an overarching strategy of a policy authority. The result is an enterprise governance program guided by a best-practicebased policy, rather than any limitations dictated by a repository or technology. A solid information governance program provides accurate, consistent information controls that deliver the right information at the right time to make the fact-based decisions that drive the business and help keep it competitive. Keeping Everything: An Outdated Practice Some organizations still believe that retaining all records is a safe approach. But the truth is, keeping outdated content is often costly to store, and can actually prove to be a liability. Alternatively, developing a solid retention schedule safeguards content that should be maintained while providing a defensible strategy for disposition of content. It also minimizes the risk associated with the inability to produce information that should legitimately be on hand, but removes unneeded content that could negatively impact productivity and add undue risk. Simply put, information assets cannot be indiscriminately destroyed. It is no longer a defensible position to respond to a request by saying information is unavailable, erased or that it has been inadvertently deleted or shredded. As many companies have realized, the updated FRCP presents an intricate set of guidelines that makes compliance a daunting challenge. An underlying tone of the FRCP and a simple rule to follow, however, is that organizations need to know what they have and where it is stored. Unfortunately, when it comes to this level of 2 WHITE PAPER: EDISCOVERY AND LITIGATION READINESS

5 knowledge and preparedness even this long after the updated FRCP has been in effect many corporations still fall short. Few have the right technology partner to effectively manage a legal discovery process involving electronic and/or physical documents. And it is clear from reviewing recent lawsuits that many companies still lack a formal records policy that incorporates all content formats. Because the amount of information that must undergo review is often great, it is important to establish a reasonable production timeline for the completion of a discovery process. This should be addressed, or at least considered, during the meet-and-confer-process. By prioritizing, organizations can deal with more relevant information first while leaving the less critical information for later review. However, records must be appropriately categorized and easily accessible in order to achieve this objective. The time has come for organizations to take a careful inventory of their information landscape, technologies and business processes to see how they stack up. The option to wait and see or assume that existing policies are adequate, is not a prudent path. In fact, many enterprises that have chosen to take this approach are currently in litigation, receiving audit notices or Freedom of Information requests or will be soon. Therefore, the time to ensure preparedness is now. Updated Guidelines Drive Technology and Process Improvements Today s changing information landscape affects all staff levels within the organization and charges each department with unique responsibilities in the event of litigation or audit. Now, with growing evidence that increased legal, regulatory and business obligations require management and process improvement, organizations are exploring ways to update systems for increased preparedness and reduced risk. The decentralized management of information is an area that deserves careful examination. Although information in most organizations is stored in a decentralized manner within individual silos, the systems used to ensure litigation preparedness really need to enable a 360-degree view of enterprise content. The business should be able to effectively manage, control and discover its information easily and effectively. Having efficient and total access to records and non-records ensures solid Information Governance, increased productivity and compliance with legal, regulatory and business requirements. Appropriate solutions will allow enterprise content to be stored in place in the repository of origin to minimize disruption. They should also facilitate the production of requested information, whether electronic, physical (on paper) or managed by an off-site vendor, within a reasonable timeframe and without incurring exorbitant costs. Leaving little room for debate as to whether a proactive strategy for litigation preparedness is needed, many believe there are just two types of companies: those who have been sued and those that will be sued. But, understanding the potential risks of violating ediscovery rules is the first step. In addition to derailed careers, steep monetary fines and damaged reputations, companies can be slapped with other undesirable sanctions. For example, negative rulings can be made that can exclude evidence that may have helped win a lawsuit. What s more, a judge can decide to allow jurors to infer missing information as negative to the case. And in extreme situations, the inability to produce information could bring a default judgment for lack of performance. WHITE PAPER: EDISCOVERY AND LITIGATION READINESS 3

6 Trends Point to the Need for Solid Discovery Processes Many recent news stories have documented corporate missteps during litigation. It is no surprise then that an April 2008 Gartner report ranks litigation readiness as the third major trend of Litigation readiness encompasses everything from legacy tape destruction (under legal and controlled conditions) to conducting thorough electronic information inventories and data mapping. It also includes instituting legal-hold processes for preservation that are repeatable and consistent throughout the enterprise. And while litigation readiness is top of mind for many corporate executives, these challenges and the implementations that address them can be overwhelming. The report also noted, "The biggest problem that end-user organizations face today is the sheer volume of data that they have stored." 1 Harnessing information overload is an important step towards improving ediscovery processes. And, while outsourcing this critical task to litigation services firms may be commonplace, developing an effective in-house system as part of an Information Governance initiative can minimize the need to outsource for collection, as well as reduce the volumes of information that need to be reviewed. This approach provides greater control, shorter response times and reduces costs. Identifying Pain Points Because some discovery requests are so extensive, all information must be easily accessible and entirely open to view. Supporting this point, a 2007 Forrester Research report stated that, In an ediscovery action, an organization needs to find information no matter where it lives. At times, the discovery action will be confined to , and in such a case, ediscovery can be conducted directly within a message archive. Often, though, ediscovery must extend to other managed and unmanaged repositories 2 Industry changes over the past several years have proven that the rising costs of document collection and review demand a major realignment of how business information is maintained and controlled. Pain points, such as the following, exist in many areas of business operations. LEVEL OF RISK EXPOSURE Risk mitigation is the leading factor driving many organizations to purchase technology. Some information management initiatives have been planned for years, but minimizing risk is driving purchase decisions and forcing organizations to consider their overall governance strategies in a more holistic, policy-driven manner. AMOUNT OF INFORMATION UNDER MANAGEMENT Effective ediscovery requires companies to identify, collect, analyze and process millions of electronic and physical records for the purposes of audit and legal discovery. But, having a glut of stale and out-of-control information under management can leave organizations unnecessarily exposed and vulnerable to zealous fishing expeditions and unwelcome fines and sanctions. 4 WHITE PAPER: EDISCOVERY AND LITIGATION READINESS

7 PROTECTING VITAL INFORMATION It is crucial that vital information assets are both authentic and appropriately protected to mitigate risk, particularly in light of litigation, regulatory compliance, privacy and data loss. In order to eliminate security gaps, organizations should review, then strengthen, if necessary, the following areas: Content authenticity: Ensure that content is authentic to meet the demands of client, business, regulatory and legal requirements. Rights management: Ensure user and group rights to information are granted based on business needs. Ethical wall security: Review and confirm need to know policies and information access for compliance, regulatory, legislative and business requirements. Hierarchical security: Review and confirm the need for security classifications and hierarchies (typically used in government). Retention management: Ensure that chain of custody can be preserved and that information is maintained according to business policy and based on compliance, legal and business requirements. Disaster recovery and business continuity: Streamline disaster recovery and business continuity processes through easy identification of vital business records. RESPONSIVENESS SHORTFALLS The inability to respond in a timely manner to requests for evidentiary information whether for litigation, audit or an information request can lead to fines, punishments and damaged reputation. Shortfalls in this area can force companies to settle out of court by choosing the less expensive route of non response. But, it is important to note that settlement costs while ensuring resolution can quickly exceed the price of an effective ediscovery solution. A Few Ways to Assess Litigation Preparedness Companies can better assess their level of preparedness, and as a result risk exposure, in the area of ediscovery by considering these questions, among others: Do we, at a high level, know what information the organization has, where it is stored and what applications are used to manage it? Do we have retention policies? Are they published to all staff and updated regularly with input from department leaders? Are they applied consistently across the enterprise to effectively meet business needs, eliminate stale content and enable efficient discovery processes? What role should each information gatekeeper play (CIO, CCO, corporate counsel, IT directors and their teams, legal and compliance professionals, records managers and end users) if the organization is threatened with a lawsuit or audit? Have we adopted standardized policies and IT practices for activities related to the identification, preservation and collection of potentially responsive information? Which ad-hoc and/or manual business processes exist that could present potential challenges or risks to our legal-hold practices? Are any of our practices repeatable? 1 1 Key Issues for an Electronic Discovery Project, 2008 a Gartner Group report, April E-Discovery Compliance Growing Increasingly Difficult by Melanie Rodier, August 17, 2007 Source: WHITE PAPER: EDISCOVERY AND LITIGATION READINESS 5

8 SECTION 2: OPPORTUNITY Creating an Effective ediscovery Program Taking steps to increase litigation preparedness can result in an overall Information Governance strategy that enables the centralized management and control of enterprise-wide content regardless of format or location. Through information governance, enterprises can take control of their information, reduce ediscovery costs and minimize the content that must be processed or reviewed by high-priced consultants and professional services firms. When executed properly, ediscovery systems can provide capabilities critical to litigation, disclosures or audit. By proactively preparing to respond to requests for information, business disruption is reduced, enabling IT and end users to continue with their normal business activities. The ability to respond in a controlled, efficient manner also decreases the time, money, resources and opportunity cost of the search in a discovery request or audit. What s more, creating repeatable and predictable processes provides organizations with more control over processes and costs, and increases confidence. Mitigating Risk and Increasing Litigation Preparedness With risk mitigation a leading concern in corporations today, deploying an Information Governance solution addresses ediscovery requirements and helps provide additional benefits through increased productivity, efficiency and business agility. Another step a company can take to lower risk and improve litigation preparedness is to minimize the amount of stale content within information storage and content environments. , content repositories and file systems can be kept lean through the use of effective and consistent retention policies based on legal and business requirements. According to Forrester Research, companies that pursue the following three key objectives can increase their ability to execute a successful ediscovery investigation: Build and use systems to reduce information volumes Improve efficiency for legal professionals Maintain chain of custody and avoid spoliation BUILD AND USE SYSTEMS TO REDUCE INFORMATION VOLUMES Today s end users have and store far too much information, most of which is redundant or out of date, containing many duplicates and drafts. The biggest direct spend in ediscovery is the processing of information on average, about $1,800 per GB. Therefore, tools that minimize the amount of information to be processed present potentially huge cost savings by maintaining a smaller haystack to search. IMPROVE EFFICIENCY FOR LEGAL PROFESSIONALS Another large ediscovery expense is incurred by the legal professionals who review information. Tools with built-in visual analytics can make legal professionals more efficient by determining whether or not information is relevant, privileged or needs to be produced in response to a discovery request. Tools aimed at making highly paid lawyers as efficient as possible represents one of the largest potential cost savings in ediscovery. 6 WHITE PAPER: EDISCOVERY AND LITIGATION READINESS

9 MAINTAIN CHAIN OF CUSTODY AND AVOID SPOLIATION As some court cases have demonstrated, any alteration or deletion of potential evidence can result in huge fines. Tools that monitor chain of custody and lock down information can help companies avoid altering or deleting potentially relevant information. This scenario holds true for both litigation and audits. Beyond these objectives, another important consideration is the decision to select a solution that does not require the replacement of existing technology. By staying with current infrastructure and applications, companies can maintain existing repositories and content in the same physical location to gain additional cost and productivity benefits. With a federated approach to policy control, search and legal holds, companies can limit business disruption while enhancing the ability to access, control and preserve all information. This strategy also eliminates the costs associated with migrating to another platform. Critical Capabilities for Effective ediscovery Plans for litigation preparedness are most effectively deployed as part of a proactive and holistic Information Governance strategy. The following capabilities combine to provide a solid foundation to ensure an organization has a solution in place to conduct an effective ediscovery investigation. AND INSTANT MESSAGE (IM) MANAGEMENT Part of the total Information Governance solution must address the management of and instant messages as valuable corporate assets. The solution must include capabilities to effectively manage volumes and conduct ediscovery tasks across all and IM records whether current or archived. ENTERPRISE RETENTION MANAGEMENT The complex task of managing records and non-records across file servers, , archives, document management and imaging systems requires a carefully considered retention plan. Effective solutions provide comprehensive lifecycle management of vital corporate knowledge assets while reducing end-user burden and administrative overhead. Implementing a superior Information Governance solution enables companies to effectively control and manage physical, electronic and content in a consistent manner through a centralized policy engine that ensures proactive compliance with legal, regulatory and business obligations. ADVANCED EDISCOVERY By making discovery processes repeatable, companies can reduce costs, proactively mitigate risk, increase operational efficiency and respond to information requests more effectively. Advanced ediscovery capabilities can further streamline processes and reduce costs through file content preservation, file metadata preservation and tagging files for identification and redaction. Enterprise ediscovery should also span all information sources, regardless of format or location. WHITE PAPER: EDISCOVERY AND LITIGATION READINESS 7

10 Key Tactics for Increasing Preparedness ediscovery solutions should allow an organization to manage and control unstructured information created in , instant messages, text messages and electronic documents. And, the full process of ediscovery involves the management, identification, preservation, collection, processing, review, analysis, production and presentation of information that might be useable in litigation. To accomplish these steps effectively, the right solution should integrate directly into existing business systems and processes and perform its tasks without derailing the regular course of business. Organizations can increase litigation preparedness by choosing a solution that includes these tactics: Total ediscovery through enterprise-wide information governance Infrastructure independence Minimized business disruption TOTAL EDISCOVERY THROUGH ENTERPRISE-WIDE INFORMATION GOVERNANCE To effectively address litigation preparedness, solutions should offer capabilities that span the full ediscovery continuum and enable information management, identification, preservation, collection and processing. This will allow the collection and presentation of only necessary, legally defensible information including both electronic and physical information. INFRASTRUCTURE INDEPENDENCE An infrastructure-independent solution will support all leading , storage, archiving, content and document management systems. Organizations should avoid solutions that are not flexible enough to accommodate pre-existing technology or that compromise their efforts due to a particular infrastructure proliferation. It is also critical that a solution enable the discovery of information from file shares, desktops and laptops. MINIMIZED BUSINESS DISRUPTION An effective solution will not interfere with employee productivity, but will ensure that relevant documents needed for litigation, audit or disclosures are produced in an efficient manner. Information placed on legal hold should not negatively affect the quality of work and must ensure compliance to preservation requirements. SECTION 3: BENEFITS Achieve Greater Benefits With a Comprehensive Information Governance Strategy That Includes ediscovery There are many offerings available to help companies address the complex challenges inherent in litigation, audit and other types of investigations or disclosures. There are also best practices and guidelines, such as the Electronic Discovery Reference Model (EDRM), that may be followed to get the most out of the supporting technology-based solution. To manage risk proactively and ensure an effective response in the event of litigation or audit, the chosen solution should include ediscovery as part of a total Information Governance strategy. 8 WHITE PAPER: EDISCOVERY AND LITIGATION READINESS

11 FIGURE A The EDRM provides a common, flexible and extensible framework for the development, selection, evaluation and use of ediscovery products and services. THE ELECTRONIC DISCOVERY REFERENCE MODEL (EDRM) ediscovery and Records Management Capabilities Go Hand in Hand The capabilities required for effective litigation preparedness and ediscovery are the same as those used to respond to an audit request from a regulatory body, an information request from a civilian to a government agency or simply to find information needed to make a business decision. With an effective Information Governance strategy in place, however, companies have their content consistently available, while also enjoying increased productivity and efficiency across the board. The greatest benefits can be realized by implementing ediscovery as part of an overall Information Governance program. Tying these key initiatives together allows companies to achieve numerous objectives, including: Reduced risk exposure Enhanced litigation support Reduced information overload Comprehensive federated search and management Increased efficiency and productivity Reduced costs WHITE PAPER: EDISCOVERY AND LITIGATION READINESS 9

12 REDUCED RISK EXPOSURE Information Governance solutions can help companies adapt quickly to new regulatory, legal and business mandates, minimizing risk in areas related to audit, litigation, data protection and business continuity. And with a proactive and continuous compliance approach, companies can protect information assets from the threat of unauthorized access, loss or destruction. ENHANCED LITIGATION SUPPORT By turning ediscovery tasks into repeatable processes, companies can reduce costs and minimize business disruption. Formalizing the discovery process with established workflows allows businesses to predict costs and plan more effectively. REDUCED INFORMATION OVERLOAD Information Governance helps companies better manage and control the overabundance of information that can reduce productivity and increase risk. Moreover, removing stale or outdated files based on legal, regulatory and business requirements streamlines information access and minimizes the proverbial haystack that must be culled. COMPREHENSIVE FEDERATED SEARCH AND MANAGEMENT A federated architecture ensures that companies can search, preserve and identify pertinent content within the enterprise for a successful investigation. Federation also ensures that consistent policies are applied across disparate content silos to enable proper management for compliance and legal purposes. INCREASED EFFICIENCY AND PRODUCTIVITY Information Governance helps companies save time and money, gain a competitive edge and increase agility when responding to requests for information. Additionally, an effective program helps IT departments improve service to internal customers by optimizing storage and making it more efficient, which increases overall productivity. REDUCED COSTS THROUGH AUTOMATION By automating such repetitive and manual tasks as declaration, reviews, ediscovery workflows, record circulation and disposition processing, companies can reduce the costs associated with these activities. And, content can also be classified based on business value, usage and legal requirements to minimize storage space and improve productivity and efficiency. SECTION 4 Conclusions Making ediscovery an effective, repeatable process that can be managed internally and with minimal business disruption is the desired mode of operation for most organizations. By taking this step many organizations are able to dramatically reduce response times for legal and audit requests, better manage internal processes and information storage and in turn save millions annually. With such big payoffs, choosing the right solution becomes paramount. A solution that only addresses part of the problem and responds to yesterday s legal guidelines can sometimes cause more pain, rather than reduce it. Instead, organizations should look for a solution that can evolve with the business as new requirements and strategies come into play and has the potential to mitigate risk while increasing productivity and efficiencies across the enterprise. 10 WHITE PAPER: EDISCOVERY AND LITIGATION READINESS

13 Taking a Proactive Approach The decision to adopt a proactive approach through a comprehensive Information Governance strategy can help organizations increase their effectiveness and reduce risk. With a solid Information Governance solution, companies can enforce appropriate controls and define accountability to meet compliance and regulatory requirements and also reduce risk. An Information Governance platform should include an organizational portal that presents vital information assets in a single, consolidated view that is consistent and transparent and not separated by departments, offices, formats (physical or electronic) or source application. Having this birds-eye view is essential to providing efficiency and confidence when responding to litigation and audit demands. Moreover, with holistic Information Governance, companies can reduce the cost, complexity and integration difficulties associated with collaboration and sharing of information assets. By implementing an overall Information Governance strategy, businesses can take a proactive posture toward enterprise-wide governance and compliance. This approach improves the typically reactive processes of ediscovery, edisclosure, information requests and audit to increase productivity and response times, mitigate risks and reduce overall costs. SECTION 5 References Key Issues for an Electronic Discovery Project, 2008 a Gartner Group report, April 2008 E-Discovery Compliance Growing Increasingly Difficult by Melanie Rodier, August 17, 2007 Source: SECTION 6 Peter Pepiton II CA Information Governance Solutions About the Author Peter Pepiton has spent the past 15 years helping lawyers utilize technology to achieve greater efficiency and better results in litigation. He is currently supporting CA s ediscovery focus in Information Governance and spends much of his time writing and speaking on the methods and benefits of achieving greater ediscovery readiness. WHITE PAPER: EDISCOVERY AND LITIGATION READINESS 11

14 CA (NSD: CA), one of the world s leading independent, enterprise management software companies, unifies and simplifies complex information technology (IT) management across the enterprise for greater business results. With our Enterprise IT Management vision, solutions and expertise, we help customers effectively govern, manage and secure IT