October 2003

Top 10 Risks During Electronic Evidence Discovery in Litigation

According to FTI Consulting (www.fticonsulting.com), a consulting firm with expertise on computer forensics issues, a majority of U.S. corporations have inadequate document-retention policies and will likely incur inflated legal costs when faced with the restoration and review of computer and e-mail files during electronic evidence discovery.

Electronic evidence discovery is a key component of most litigious or investigative proceedings, and organizations should expect it to be a pivotal issue during an investigative process. FTI sees a sharp disconnect between the capabilities of IT systems and the business and legal needs of an organization.

FTI noted 10 key document-retention issues that typically expose corporations to inflated litigation costs:

• Lack of a central corporate repository. Information is spread across servers, backup tapes, and individual user-maintained archives, usually resulting in considerable overlap. If this information needs to be reviewed (e.g., as part of legal proceedings), a company faces increased time and higher costs to filter through layers of information and duplication.
• Lack of a corporate document management policy. Employees save any and all documents, with no organizing principle, significantly magnifying the cost
  and complexity of sifting through information.
• Intermingling critical and less critical documents. Little distinction is made between the relative importance of stored information, making it difficult for attorneys to determine what is considered privileged information. Consequently, computer forensics teams are often forced to sift through information to ensure no privileged information is inadvertently disclosed.
• Intermingling business and private use. Employees often use business computers for private use, forcing corporations facing litigation to spend resources separating company data from employees’ private data.
• Lack of distinction between disaster-recovery backup and business archiving. Corporations save too much unnecessary information for too long, adding to inefficiencies during information restoration and review. Most corporations save absolutely everything in preparation for disaster recovery and rely on the same store of information as a long-term business archive; in fact, different information is needed for each.
• Backup systems that cannot easily be restored. Corporations regularly update software and hardware with little regard to their existing backup collection. When faced with litigation, a corporation is obligated to pay for restoring or recreating data from a legacy system. Accomplishing this can often take several months and millions of dollars.
• Ad hoc caches of backup or miscellaneous information. Most companies have ad hoc stores of information and usually are unsure of whether they contain new or duplicate information. If backup data exists, a corporation has a legal obligation to review the content for relevance.
• Insufficient recognition of laptops. Laptop computers can represent a significant proportion of a corporation’s information. In addition to the ongoing risk of loss and theft, laptops typically are ineffective at deleting information. During litigation, “forensic copies” of laptops can be requested to recapture deleted information, adding another layer of complexity and cost.
• Automated processes. Companies are unsystematic about what information they automatically save and delete. When companies enter into litigation, they are under strict legal obligation to ensure that they preserve all relevant information. Upon determining that a loss of information (spoliation) has occurred, a judge can automatically instruct the jury to assume the worst; for example, that inadvertently deleted records contained unfavorable information. Depending upon the seriousness of the infraction, this can even lead to a directed verdict.
• Manual systems. Despite great advances in integration and enterprise resource planning (ERP) systems, many companies use a mix of automated and manual processes (e.g., the spreadsheet used to transform data from the inventory system before loading it into the general ledger). Such manual processes often suffer from a lack of documentation, lack of retention, and a lack of systematic application. This inevitably makes reconstructing what happened more difficult and costly.

Proactive Steps

FTI said corporations can take proactive steps to avoid these problems before an investigation or litigation begins. They should start by instituting a comprehensive document-retention policy, which means clearing out unnecessary information in a responsible and legal manner and saving important information. Moreover, since most major corporations will face some type of litigation in the general course of business, consideration should also be given to an incident response plan that can be swiftly instituted once the litigation process begins. A well-crafted policy can save a corporation significant costs later on.

©2006 The CPA Journal. Legal Notices

Visit the new cpajournal.com.