In-Depth

IT Dangerously Unprepared for E-Discovery, Survey Shows

A new survey from Fortiva shows the extent that IT is unprepared for e-discovery regulations

• By James E. Powell
• 03/20/2007

If your IT department is still using an "out of sight, out of mind" approach to e-mail evidence, you’re exposing your enterprise to legal risks. The new Federal Rules of Civil Procedure (FRCP), with changes now in effect for three months allows for hefty fines on a company for failing to make corporate e-mail evidence available within 30 days of a discovery hearing.

Despite this risk, a survey released last week by Fortiva shows that the a whopping 94 percent of people responsible for e-mail policy do not feel their organization is fully prepared to meet FRCP requirements. The survey also found that only 38 percent of those respondents say they are familiar with the changes. (The changes require companies to know where their electronic documents are stored. Companies must be prepared to make corporate e-mail available to the court in case of a lawsuit.)

It's clear that organizations are looking to IT to help them meet the FRCP requirements. According to the survey, 56.7 percent of respondents responsible for e-mail policy work in IT, while just 6.8 percent are in the legal department. Lest you think such e-discovery requests are rare, the survey found that more than a quarter (25.4 percent) of respondents said their organization has responded to such a request at least once in the past three years.

"We're seeing companies of all sizes struggle with the challenges of FRCP and e-discovery. The recent case between AMD and Intel is a great example of how even the most technologically advanced companies are having a hard time enforcing their policies and implementing legal holds for email," said Eric Goodwin, CEO, Fortiva, in a statement.

"After seeing the results of the survey, we realize there is still a significant need for resources that businesses can use to help meet FRCP—whether that's help with the policy or help implementing the policy."

The survey, conducted in late February, revealed other low points in IT's e-discovery preparedness. For example, 45.9 percent of respondents have no retention policy for e-mail; such policies are important in meeting FRCP rules. In addition, only 8.4 percent of respondents have met a critical FRCP requirement: putting a litigation hold procedure in place.

"While 10 percent of respondents have made changes to the policy to meet FRCP, over 20 percent are still in the planning stage, and 36 percent were not sure if changes were planned," Fortiva reported.

"The challenge of understanding and implementing the new FRCP requirements has caused a great deal of concern among corporate legal counsel, partly because meeting that challenge requires cooperation between different departments—including IT, records management, legal, and the business units—to make it happen. These survey results indicate that many businesses are clearly still struggling to meet the requirements," said Arthur L. Smith, a member of the Dispute Resolution Practice Group at Husch & Eppenberger in St. Louis. Smith is an expert on electronic discovery issues.

"Having a sound records-management policy and system in place are the important first steps towards meeting the e-discovery challenge posed by the FRCP amendments. Organizations that have not yet started this process should make it a priority or face leaving themselves open to significant risks," Smith notes.

Fortiva says its free online e-mail policy tool may help organizations prepare to meet new legal discovery requirements. According to the company, its Policy Builder—a free online template tool available at http://www.fortiva.com/policybuilder—"provides policy templates created by experts [and includes] acceptable usage, best practices, security guidelines, retention policies, and sample key words to use when enforcing policy elements. The tool also offers secure, password-protected access via a Web browser, allowing users to view and update their customized policy at any time. It also allows one-click creation of a PDF version of the policy for company-wide distribution."

That could be important, given another result from the survey: 45.6 percent of respondents said their organization does not have an official e-mail retention policy—users keep their e-mail as long as they like. Only a quarter (25.5 percent) of respondents said that legal counsel directives influenced their retention policy.