Tackling eDiscovery for Internal Investigations

For corporate legal departments, the threat of internal misconduct is substantial and rapidly increasing in frequency and scale of impact. While it is easy to envision the largest threat to your organization as an external bad actor, the reality is that sometimes the biggest threats come from the trusted internal professionals within an organization. This poses unique challenges to in-house counsel in terms of the need for utmost confidentiality, speed, and thoroughness when conducting internal investigations.

While most practitioners think of litigation when the term eDiscovery is bantered about, the application and benefit of using said technology in the context of a high-stakes investigation are substantial. When managing Electronically Stored Information (ESI) in the investigation process, the volume, and variety of data are often no less daunting than large-scale litigation and the time and cost pressures may even outpace litigation.

Flavors of Internal Investigation

Internal investigations come in a variety of flavors, with differing end objectives and considerations for effective execution.

• • Due Diligence: Due diligence around mergers and acquisitions or in response to regulatory scrutiny of a proposed merger is often document-intensive and sometimes with multi-billion-dollar deals hanging in balance.
  • Employee Misconduct: Alleged wrongdoing is the second major impetus for a variety of internal investigations. The Human resources department is often fertile ground for investigations around employee misconduct and equal employment opportunity issues. 
  •  Whistleblower actions: Another common source for an internal investigation is via a whistleblower, often in anticipation of a subsequent regulator-driven government investigation or follow-on litigation. Because law enforcement or regulators like the Department of Justice (DOJ) may have an interest in whistleblower-driven investigations, timely and thorough identification, and document review to uncover relevant information is critically important.
  • Insider Threat & Cyber Breach Improper access and exfiltration of data by internal or external hackers can pose a massive risk for organizations because it exposes a wealth of valuable IP, trade secrets, and/or internal confidential information at risk. Timely remediation and determination of the method of improper access and exfiltration is critical to mitigate the existing breach and prevent future ones. 

Unique Challenges in Internal Investigations

Tight timelines, large and varied data volumes, and the malefactors still employed in an organization create immense pressure to complete an investigation expeditiously, with extreme control over the flow of information, sufficiently defensible procedures, and adequate documentation in the event of follow-on investigations or litigation. For legal teams, whether in-house or on the law firm side, it is imperative to start the investigation process off quickly, casting the net broadly enough to determine if a settlement, future litigation, or regulatory reporting obligations are triggered quickly and get ahead of the ramifications of the malfeasance.

While an investigation is similar in many respects to a litigation eDiscovery workflow, it differs in several key aspects.

• • Time is even more of the essence - Whether conducting a due diligence investigation, responding to a whistleblower, or heading off a regulatory investigation, understanding the facts and risks in each matter quickly is of paramount importance. 
  • The fox is in the henhouse Ensuring strict confidentiality, speed and discretion are key in an investigation because the custodians and people of interest in an investigation are often still gainfully employed at the organization throughout the investigation.
  • Don't be a creeper - Scope creep is a danger facing many people undertaking internal investigations. Given the time and confidentiality requirements for conducting internal investigations, it is of paramount importance to keep your investigation laser-focused on relevant facts and custodians. Whether conducting an internal audit, antitrust due diligence, or investigating a whistleblower's allegations of wrongdoing it is easy to have a scope of the investigation creep, corporate counsel and their outside counsel must work to mitigate this.
  • Mums the word - because the subject matter and the information involved in many internal audits, or internal investigations, is so highly confidential, maintaining the utmost data protection and privacy is a major concern for the case teams. Because these investigations may involve unsubstantiated allegations of wrongdoing, subjects under regulatory scrutiny, confidential merger activity, and/or highly valuable IP it is smart to keep the investigation team to a need-to-know basis and use secure and robust technology to identify key facts and conduct targeted document review quickly and securely.
  • You got another thing coming - As noted above, a corporate investigation is often not the end of the road for the types of matters an organization conducts an internal investigation on. The results of the investigation may inform future regulatory agencies in a subsequent government investigation or could be used as evidence in a follow-on investigation. Thoroughness in terms of the scope of data collection, methodology to identify critical information and even the workflow of the document review are of paramount importance when the securities and exchange commission or board of directors may be reviewing the results of the investigation down the road!
    
    

Best Practices for Internal Investigations

Given the unique challenges facing an organization when undertaking an internal investigation, employing a thorough and defensible approach from the outset is critical. Whether facing an investigation of a single custodian or hundreds, thoroughness is key because scope, scale, and parties involved can shift on a dime.

• • Cast a wide net: At the outset of an effective internal investigation, it helps to be overinclusive on legal holds issued and data identified and preserved. An investigation team scrambling after the fact to expand the custodians under legal hold, or recover data following the accidental or normal course of business deletion, to avert a claim of spoliation down the road will end up spending substantially more than if the custodian list was broader at the outset. Retention of data in and of itself does not necessarily mean that the case team must incur processing and review costs down the road. I tend to recommend rolling and prioritizing the introduction of data into the active review set as the subject matter, custodian, or data range is identified as potentially relevant in lieu of processing the entire corpus of data at the outset when dealing with large numbers of custodians and data types.
  • Be Laparoscopic While it pays dividends to cast the net broadly in terms of data identification and preservation, being overinclusive in the data promoted to processing and review can muddy the waters in an investigation. I recommend using something like Reveal-Brainspace's social network analysis to identify which custodians are communicating about the issues relating to an investigation as well as tools like the brain explorer to identify relevant topics for further review. Taking a more precise approach to data exploration and limiting what must be manually reviewed by a human helps investigations teams quickly uncover relevant documents and fact patterns.
  • Go All-in-on-AI - Investigations by their very nature are more about finding the needle in the haystack than organizing and categorizing each piece of hay. As a result, the pattern recognition, semantic insights, and amplification of decisions made by case teams by various applications of AI is especially impactful in the context of an investigation.
  • Circle of trust - Given the sensitive nature of many investigations, the likelihood that in instances of alleged misconduct the potential culprit is still actively employed and the reputational damage the claims being investigated might cause, keeping the people involved and aware of the investigation limited is optimal. The fewer people in the know, the better.
  • Employ scalable tools - No matter how limited an investigation begins, there is always the potential for the scope to increase, for follow-on litigation or government investigations. As a result, it is important to have a review and analysis tool in place that can scale in the event your 1 custodian investigation expands to hundreds. Many times, when a bootstrap approach is taken on a matter that expands, the investigation team ends up wasting valuable time and resources after the fact to move the matter to a new more robust platform. I always recommend taking the approach that the matter could expand when planning and scoping at the outset.
  • Document, document, document - Because follow-on litigation and future government investigation is often a reality after the conclusion of an investigation, it is very important to ensure a clear chain of custody with an audit trail of both AI-driven data exclusion and document review coding decisions. Reconstructing the steps, process, and tools used to generate the written report at the conclusion of an investigation and/or justification for any remedial action taken is massively helpful when responding to any follow-on actions.

Judge Andrew Peck embraces is inner Sherlock Holmes, so should you!

Embrace Your Inner Sherlock!

Investigations, while a bit of a horse of a different color, often face many of the same challenges as more traditional litigation-driven discovery matters. At the end of the day, the tools and techniques employed to quickly identify relevant information for litigation can equally benefit an investigation team. In many instances, the increased time, confidentiality, and cost pressures of an investigation make them a prime target for applying advanced AI-powered eDiscovery software solutions. Taking a broad and auditable approach is important regardless of the scale or subject matter of an investigation and can help practitioners avoid sanctions or spoliation down the road in follow-on litigation or investigations driven by regulators. Experienced software and service providers can help ensure the right scalable technology is employed at the outset of any investigation.