The E-Discovery Challenge Moves to the C-Suite

Transcription

1 The E-Discovery Challenge Moves to the C-Suite New Legislation is Upping the Ante Even Further, Making It Crucial to Manage E-Discovery at the Enterprise Level

2 Understanding E-Discovery Risk Whether information exists in a hard copy format or is electronically stored, it is subject to discovery in litigation. When responding to discovery requests, the ability to locate and retrieve information becomes critical. At the same time, advances in technology have substantially increased the volume of Electronically Stored Information (ESI) and have affected how this information is created, preserved and stored. Despite the technical challenges of format, condition, and the manner or location in which the information is stored, ESI contains unique characteristics that provide valuable evidence beyond the actual file contents, such as who knew what when (e.g., the names of contributors and the dates of creation, modification and most recent viewing). As the volume of ESI subject to legal discovery continues to grow, so do the stakes for organizations. A new and major force with regard to e-discovery is legislation amending the Federal Rules of Civil Procedure (FRCP), which became effective on December 1, The amended rules establish guidelines for e-discovery in civil suits brought in federal district courts, while state courts, too, increasingly adopt the federal rules in whole or in part as they seek solutions to difficulties posed by ESI. The effects of the amended FRCP on how an organization manages its ESI could be more far-reaching than other recent governmental regulations, such as the Sarbanes-Oxley Act and the Health Insurance Portability and Accountability Act (HIPAA). Why? For one thing, FRCP impacts virtually every organization, not just public companies or those in a specific industry, like health care. As the Association for Information and Image Management (AIIM) points out, many nonpublic companies that initially dismissed the records and information management requirements associated with Sarbanes-Oxley as not relevant to their companies will no longer be able to take this stance with the new e-discovery rules. With this legislation, all corporations doing business in the United States should consider an effective and responsible electronic information management infrastructure to be a necessity rather than an option. The amended FRCP regarding e-discovery dramatically changes the playing field. Previously, companies often approached discovery on an ad hoc basis, pleading ignorance as to the loss of discoverable information. They are now bound by the new rules to preserve any ESI that may be considered relevant evidence in a potential lawsuit. If they fail to produce a requested document, they may face consequences ranging from monetary sanctions to charges of obstruction of justice. The new FRCP requirements create two categories of information: reasonably accessible, which includes any data a company routinely accesses or uses; and that which is not reasonably accessible. 1 ESI that may be considered not reasonably accessible includes information that would require significant cost, effort or burden to produce (e.g., certain backup tapes or deleted data). Sources of information withheld from a discovery request on this basis must be identified, and the fact that the data is not reasonably accessible must be demonstrated. If a court finds that the parties have inaccurately classified this data as not reasonably accessible or if the opposing party agrees to pay for the costs of retrieval, this information still could be subject to discovery, regardless of the significance of the undertaking. Although the new legislation creates a safe harbor rule 2 that essentially allows companies that destroy information in a routine, good faith operation of an electronic information system to avoid court sanctions, this safe harbor does not necessarily protect a company from every type of data loss or destruction. Whether a company s data management and retention policy is reasonable or in good faith is subject to challenge. More significantly, the safe harbor does not relieve any party of the burden of preserving ESI and related evidence when a legal dispute is likely. This means that a company must include the ability to institute quickly a litigation hold as part of any routine data management and retention system. If the court determines that a company failed to preserve relevant data, or worse, deliberately destroyed evidence material to resolving a legal dispute, it could impose monetary penalties. The court also could hold that the missing data supports the opposition s argument, seriously compromising the company s legal position. 1 FRCP 26(b)(2)(B). 2 FRCP 37(f).

3 The potential repercussions of these new e-discovery mandates demand significant attention from executive management as well as from their board of directors. Lawsuits and governmental investigations have been a reality in corporate America for a very long time. Now, they have become more costly and impose a higher level of risk than ever before. The chances of being sued or investigated are so great for large companies today that it is no longer a matter of if, but when it will happen. Whether or not a company is embroiled currently in such a matter, it is now critical to be prepared. It is not an easy task to design and implement an effective Records and Information Management (RIM) infrastructure. ESI management and retention policies and procedures, which both satisfy the requirements of the new rules and are not overly burdensome on business operations, may not be easy to design and implement, but clearly are essential. A company can best manage the litigation risks of discovery by taking early, proactive measures before a legal dispute arises. Clearly, no company can afford to ignore ESI management issues any longer. Heads Buried in the Sand? Currently, many organizations operate in a reactive, wait-and-see mode when it comes to litigation or official investigation and the concomitant need for e-discovery. Few have comprehensive RIM programs in place for such events. Take , for example. As the primary medium for communicating and documenting business activity and decisions, electronic messages are a major focus of e-discovery requests. And yet, a 2006 survey by AIIM shows that for most organizations management is usually something of an oxymoron, and at best more a wish than a business reality. AIIM found that unmanaged creates significant litigation and e-discovery risks, yet most organizations take a very casual attitude toward it. More than one in three survey respondents (35 percent) reported that they have not yet begun to address key management issues such as archiving, life cycle management, retention and disposition. 3 U.S. businesses currently spend between $2.5 to $4 million per year for e-discovery per billion dollars in sales. Cohasset Associates, Inc. Many companies take a similar see no evil, hear no evil, speak no evil attitude toward RIM in general at least until they are hit with a subpoena or motion for discovery. Once companies find themselves the target of litigation or investigation, however, they begin to recognize that it is neither cost- nor time-effective if even possible to attempt to handle discovery requests from opposing counsel internally. Instead, this immense undertaking prompts them to outsource e-discovery activities to a vendor who specializes in the field. In the process, the provision of e-discovery services has become a rapidly growing industry on its own. In fact, some may be surprised to learn that e-discovery is becoming the largest controlled cost in American business. According to Cohasset Associates, U.S. businesses currently spend between $2.5 to $4 million per year for e-discovery per billion dollars in sales. 4 That translates to $25 to $40 million a year for a $10 billion company. And these costs are not likely to abate any time soon. In fact, the total e-discovery vendor market is predicted to grow to around $3 billion by John F. Mancini President, AIIM, Management: An Oxymoron? AIIM Industry Watch Survey (2006). 4 Cohasset Associates, Inc., The Eternal Charter: Improving Corporate Governance through Compliance and Assured Records Management, 2005, p. 11, search?q=cache:wiphzhqsyswj: 3

4 Costs associated with discovery requests can be exorbitant, and the dollars involved are not the end of the story in terms of organizational impact. There is an array of other possible repercussions, ranging from disruption of business operations and monetary sanctions to the threat of criminal penalties and charges of obstruction of justice. In the process, one of the most valued assets of any organization its reputation also may be placed in jeopardy. How Senior Executives View Electronic Data Management Policies Senior Executives... worry about what effect their compliance systems will have on their companies future. Almost half said they are concerned that their corporations failure to effectively archive and manage all their electronic documents could be a critical liability percent of those who do have policies for electronic records (such as an outline of how long s are kept) said they are not effectively enforced percent of the survey respondents said their IT spending will increase. Source: CFO.com survey: IT Falls Behind on Compliance, September 18, 2006 Understanding the New Rules For the meeting on discovery to be productive, and to avoid sanctions by the court, attorneys and litigants must prepare for the possibility of e-discovery well in advance. For instance, from the moment a party believes a lawsuit may be filed, and certainly no later than the date a complaint is served, steps must be taken to preserve all data that could relate to the dispute. This may mean that automatic deletion of s must be stopped, documents scheduled for routine disposal must be retained, and computer trash cans must not be emptied. Similarly, it is not sufficient to simply make backup copies of ESI that may be subject to discovery. The original storage medium, such as hard disk drives or flash drives, must not be erased, reformatted, destroyed or discarded because in addition to the contents of any ESI file, the equipment itself may be discoverable. It may even be necessary to stop using the storage medium in order to prevent the spoliation, loss or overwriting of old data by newly entered data. Counsel and responsible corporate principals also must become well-versed in the nature, contents and condition of any equipment on which ESI may be stored and any software that has been used to create, modify or manage it. Failure to fully appreciate the practical limitations of the ESI environment may cause counsel to agree to burdensome production goals and unrealistic deadlines, possibly incurring sanctions if those goals cannot be met. Parties propounding discovery requests must likewise be conversant in the technological aspects of ESI in order to determine what type of information should be sought and the format in which it should be provided. As a consequence of the foregoing, it likely will be advisable to have technology specialists who are familiar with the corporation s data retention policies and equipment attend any discussions about e-discovery. Clearly, companies must now address discovery issues and orchestrate a production plan much earlier in the process than they did under the old rules. So early, in fact, that few companies will be able to reach a settlement prior to thoroughly addressing discovery issues. 4

5 Adopting a Risk-Based Approach Companies must consider the prospect of e-discovery requests from a risk-based, process-enabled perspective, not merely as an event to be dealt with once it occurs. For firms unprepared, e-discovery increasingly is a Pandora s box of problems that can adversely affect shareholders perceptions and even the viability of an enterprise. In stark contrast to risks centered on specific operational functions, e-discovery risks affect the entire enterprise: Uncertainty is not limited to just one or two areas; it is pervasive, cutting across the whole organization. General recognition of the broad nature of these risks is critical, and decisions affecting document management cannot be made in a business-unit vacuum. Each department or unit of a company is likely to have a very different perspective on the utility of any data management policy. Some affected groups may not even be aware that they share in the responsibility of properly managing electronic records. Further, any choice of policies or practices will generate its own set of corresponding difficulties. Some departments, such as finance, accounting, personnel and legal, may need to maintain records based on statutory requirements not applicable to other departments. IT managers may focus on technical considerations, such as the ease of operation or electronic storage capacity, rather than on the underlying nature of the documents being preserved. But technically easy procedures, such as the automatic deletion of s based on age of the document, may cause important documents to be lost. Conversely, saving all records because of high storage capabilities is likely to result in the retention of an excessive number of documents that are duplicative, superseded or spurious, making the discovery process more confusing and time-consuming than necessary. Other choices, such as centralized archives, may result in transforming information that is not reasonably accessible into readily discoverable evidence. Beyond preservation of documents and other data produced in the ordinary course of business, the metadata 5 associated with each discrete piece of ESI can be of great importance in establishing the history of the document. The storage units themselves, such as hard drives, may be considered to be material evidence, so proper care of hardware can be as essential as the management of ESI itself. Collaboration is critical when document systems are created or changed, and retention policies are set. The fact that each function brings a different perspective to the issue makes regular communication essential. Ultimately, it may be incumbent upon management and the board of directors to ensure e-discovery is being addressed at the enterprise level. The importance of litigation readiness cannot be overemphasized. For example, under FRCP 26(f), parties involved in litigation are required to meet to discuss a proposed discovery plan and agree on a scheduling order no later than 120 days after the complaint has been served on a defendant, or within 90 days after the appearance of a defendant. The proposed plan must include provisions for disclosure or discovery of ESI, as well as any agreements the parties reach for asserting claims of privilege after production. 6 Given that litigation readiness needs to be an ongoing and sustainable process, best practices should include, but not be limited to: 7 Ensuring a comprehensive document retention policy is in place, which must include electronically stored information in all of its ever-evolving formats and uses Segregating potentially privileged information (e.g., restricting access to servers where privileged information may be stored) Working closely with IT personnel to mitigate e-discovery risks Training key staff in information technology basics, so they can communicate and assist more effectively when litigation holds are required 5 Metadata is sometimes described as data about data. In the context of e-discovery, it most frequently indicates automatically or manually generated data that provides information in addition to the substantive contents of the file, e.g., the names of the author, typist or owner; creation and revision dates; keywords; etc. 6 FRCP 16(b). 7 LexisNexis, Applied Discovery, Applied Discovery Fact Sheet, Top 10 Tips to Prepare for FRCP Changes, 2006, Applied Discovery, Inc., 5

6 CFO (Business & Operations) How Do C-Level Executives See Their Priorities? CIO & CTO (Technology) CLO & CRO (Legal & Regulatory) Controls Capacity Compliance Cost Performance Liability Accountability Reliability Defensibility Profitability Obsolescence Legality Sustainability Functionality Applicability Authority Security Privacy Access Administer Archive Record Retrieve/Remove Retain You Can Outsource the Function, But Not the Responsibility Failing to view e-discovery requests as clear and present risks can put companies in an unwanted crisis mode when, not if, they are sued. Even if a company turns over its data to a third-party provider, it is imperative to work closely with the provider to develop successful e-discovery policies and procedures. Otherwise, the company is no longer self-reliant and becomes much less able to demonstrate that its systems and ESI are part of routine operations. At the end of the day, a company may be able to outsource the e-discovery function, but it cannot outsource its accountability. So what are companies doing to develop a basic strategy toward responsible and effective records and information management? According to AIIM, many have a long way to go. In a recently released survey of 820 end users of electronic records management, barely half (53 percent) say they have a policy in place for ensuring the preservation of all information potentially relevant to litigation. Forty-seven percent have no spending planned related to managing information in the context of discovery and litigation support. What Companies are Doing about Discoverable Data Management New AIIM Survey Only 57 percent have a formal policy for record classification. Only 36 percent have a formal policy for litigation readiness. Barely half (53 percent) have a policy for preserving all information potentially relevant to a litigation. 47 percent have no spending planned related to managing information for discovery and litigation support. Only 48 percent have a policy covering employees responsibility for records management. Only 41 percent deliver employee training on information management. Source: AIIM survey of 820 end users of electronic records management, December 2006 Moving From Project to Process Even before the new rules, the e-discovery environment was heating to a boiling point, but their adoption now makes immediate action critical. What exactly should companies do to protect themselves from rising costs, court sanctions and operational disruptions? They should start responding to the new discovery environment instead of reacting only when litigation is initiated. Viewing e-discovery from a risk-based, process-enabled perspective rather than reactively is the first step toward developing and maintaining an effective discovery risk management program. Organizations should 6

7 move from reactive mode (Respond, Defend and Remediate) to proactive mode (Evaluate, Mitigate and Monitor) by creating well-designed, highly effective records management systems for all their electronically stored information. By launching a records management process, they can manage the risk up-front proactively. Organizations that plan now and build a process for e-discovery will address the risk while it is uncomplicated by pending legal action. As a result, they will be ideally prepared and equipped to face litigation or investigation requiring document retrieval. In the process, they can save a significant amount of time and money. To comply with federal requirements and prepare a company to address legal actions in an organized, costeffective manner, document management systems must become part of routine operations and kept in robust working order. If challenged, companies must be able to demonstrate that they have defensible processes in place. The E-Discovery Landscape Has Changed for Good Without defensible processes in place, companies are likely to succumb to a left-hand-doesn t-know-whatthe-right-hand-is-doing scenario with regard to e-discovery. The last thing CEOs under the stress of an investigation or litigation can afford is finger-pointing as people throughout the organization declare the matter is not my responsibility. The truth is that each senior-level executive may have some responsibility for e-discovery requests. The cost of compliance and noncompliance and their associated consequences demand enterprisewide attention. In the end, it is all about sound governance. Records management and litigation readiness, through a sustainable process, are essential for ensuring an organization s future well-being. About Protiviti Protiviti ( is a leading provider of independent risk consulting and internal audit services. We provide consulting and advisory services to help clients identify, assess, measure and manage financial, operational and technology-related risks encountered in their industries, and assist in the implementation of the processes and controls to enable their continued monitoring. We also offer a full spectrum of internal audit services to assist management and directors with their internal audit functions, including full outsourcing, co-sourcing, technology and tool implementation, and quality assessment and readiness reviews. Protiviti, which has more than 50 locations in the Americas, Asia-Pacific and Europe, is a wholly owned subsidiary of Robert Half International Inc. (NYSE symbol: RHI). Founded in 1948, Robert Half International is a member of the S&P 500 index. Our Discovery Risk Management Practice Protiviti s Discovery Risk Management practice assists clients with transforming the challenges of records management and ad hoc e-discovery projects into sustainable processes. We accomplish this by balancing the priorities across business units, and leveraging existing investments in people, processes and technology. Our approach to discovery risk management helps our clients to: Establish defensible processes as part of routine operations and avoid excessive costs in responding to investigations, litigation and/or regulatory requests. Demonstrate good faith efforts in handling the discovery process. Help ensure compliance with internal policies and applicable legal and regulatory requirements. Minimize business disruptions and drive operational efficiencies as business units create, receive, distribute, use, maintain, and ultimately, dispose of records. 7

8 Protiviti is a leading provider of independent risk consulting and internal audit services. We provide consulting and advisory services to help clients identify, assess, measure and manage financial, operational and technology-related risks encountered in their industries, and assist in the implementation of the processes and controls to enable their continued monitoring. We also offer a full spectrum of internal audit services to assist management and directors with their internal audit functions, including full outsourcing, co-sourcing, technology and tool implementation, and quality assessment and readiness reviews. Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services Protiviti Inc. An Equal Opportunity Employer PRO