Modern investigations involving vast stores of potentially relevant, electronically stored information (ESI) are intensely demanding and regulatory-driven in response to data privacy, cybersecurity breaches, suspicions of IP theft, C-suite vetting, pre-mergers, and more. Timely, cooperative self-reporting is critical in today's heightened global regulatory environment and can help organizations avoid a sweeping agency investigation that drains valuable company time and resources. Finding the facts early can mean the difference between a fully informed, favorable settlement and overly expensive and protracted litigation.
Unfortunately, multiple factors are working against investigators, including tight timelines, large amounts of data, data complexity, and stretched resources-all making it increasingly difficult for investigation teams to zero in on the key facts in a timely, efficient, and cost-effective manner.
And it's the key facts that matter.
WHY INVESTIGATIONS ARE DIFFICULT
Many investigation teams approach an investigation just like a litigation review-throwing bodies of reviewers at the document collection to sift through one by one, even when starting points in an investigation may not be known and the facts are not well developed or understood. Unlike a litigation review, it's not necessary to locate all or even most of the documents that may ultimately pertain to the fact pattern. Rather, it is most important that the critical documents are uncovered quickly.
Recognizing this difference and the unique challenges of an investigation-including the unknown unknowns in which there may be little to go on, which make investigations so challenging-is the key to designing an efficient and effective document investigation protocol.
The skillful application of technology to good processes and expertise in designing an appropriate protocol, managing execution of all the pieces, and experience in unstructured data interrogation is key to a successful investigation-making the jobs of investigators easier and more productive, regardless of where the data or the investigators are located.
Here's how to rapidly surface the facts and shave time off the investigation.
GET THE DATA YOU NEED
The first step is getting the data investigators need, and while it might seem counterintuitive, collecting as much data as possible is often the best way to start an investigation. Ensuring fulsome collection at the beginning helps reduce the risk of overlooking key evidence and saves time associated with multiple, piecemeal collections. Investigative experts can implement processes and leverage technology to avoid review of extraneous data.
LEVERAGE THE CLOUD
Information in any business is spread far and wide-across systems, servers and geographies-making it challenging to collect all the data you may need in an investigation. Cloud-based technology makes it possible to collect and host substantial amounts of data for easy access and analysis, reducing the risk of overlooking key evidence that tells the story.
As the harvested data begins to flow into the cloud-based technology, investigators can almost immediately start the job of analyzing it. And once again, cloud technology can help to optimize analysis processes and ensure all members of an investigation team can have access, no matter where they are.
CONNECT THE DOTS
Good investigators are trained to look for connections in the data, exploiting the subtle ways multiple pieces of information relate to each other to form a more complete picture. For example, communications analytics can allow the investigation team to drill into communications between specifical individuals and identify critical individuals connected to data already flagged as important. Following those connections provides a more thorough understanding and leads to other critical data more quickly.
REVIEW THE EVIDENCE
A key to rapidly finding critical documents in the masses of collected data may be to deploy an appropriate technology-assisted review (TAR) protocol. Modern TAR tools based on machine learning find documents that are most likely to be relevant-even those hidden in corners of the document collection that are contextually diverse from everything that is known to that point in time. This means it's less likely that the investigation will miss critical issues that were unknown at the start of the review. And that means a better chance of turning up unknown unknowns.
PROVE A NEGATIVE
Even coming up empty-handed can be important to an investigation. A government or regulatory investigation, for example, might be searching for certain documents. Using TAR on a contextually diverse sample of the data can offer a reasonable and defensible way to show the absence of responsive documents without having to review the complete collection.
The store of data amassed by organizations is only going to continue to increase. As new laws and regulations come into effect, or as organizations expand into new jurisdictions, investigations are going to become more frequent. The good news is that it is possible to meet the rising tide of data and the increasing demand for investigations. And those investigations can be run from anywhere, accessing data from anywhere, with the right expertise, technology, and processes.
Originally published by FastCo Works.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
