10 steps to modern ESI investigations

Modern electronically stored information (ESI) investigations – interrogating a large collection of electronic documents to quickly answer the key questions and locate the critical evidence…

OpenText profile picture

June 26, 20205 minute read

Modern electronically stored information (ESI) investigations – interrogating a large collection of electronic documents to quickly answer the key questions and locate the critical evidence – are intensely demanding in every sense of the word. Whether minimizing risk or maximizing positive outcomes, optimizing the “time to results” is critical for the success of any investigation.

Many legal and investigative teams approach an internal, compliance or regulatory investigation like a typical litigation production context. However, the goals of each differ. Recognizing this difference and the unique challenges of an investigation is the key to designing an effective, efficient data investigation process that maximizes the “reward” (such as a fully informed favorable settlement) over expensive and protracted litigation.

How an investigation differs from a litigation production review—and why it matters

The objective of a typical litigation document review is to proceed, from a reasonably known set of facts, to locate most of the relevant documents relating to the dispute, with the least amount of review effort. The emphasis is on document review in the context of the known underlying fact pattern. To that end, a litigation review is loosely designed to develop a model of positive, or relevant, documents and find most of the similar documents quickly. Locating most of the relevant documents, particularly where matters involve terabytes of data, requires substantial attorney effort and can be very expensive.

In an investigation, the underlying fact pattern is either not known or not well developed. As a result, an investigation review is crafted to quickly find pertinent documents, including the “unknown unknowns,” that will establish that fact pattern or otherwise answer the critical questions. It is not necessary to locate all, or even most, of the documents that may ultimately pertain to the fact pattern. It is most important to be certain that the critical documents are uncovered quickly. An investigation is an effort to find the pieces of a puzzle and put them together to define a cohesive fact pattern.

10 steps to finding the facts swiftly

Given this difference in objectives, there are several steps that can be taken to refine and implement a document investigation protocol to achieve the objectives underlying an investigation—while eliminating the extra costs and time of a full production review.

  1. Control data proliferation for security and access: A considered approach that recognizes and addresses the need for both security and timely availability of the ESI being created, stored, transferred and managed remotely.
  2. Establish policies for remote operations: This includes the scope of personal devices and approaches to balancing privacy rights with legitimate organizational interests in critical data, along with scope considerations such as ephemeral messaging app data.
  3. Take advantage of seamless end-to-end cloud-based capabilities: The cloud provides ease of use and remote access. In an investigation, it’s particularly important for data transfer, access and analysis and review, such as the capabilities offered in OpenText™ eDiscovery platforms.
  4. Preserve and collect immediately, expansively—and discreetly: Using automated legal hold tools like OpenText™ Legal Hold, often integrated with remote collection tools, teams can quickly obtain information and leverage the knowledge of those known custodians to expand the scope of the investigation while collecting documents for review.
  5. Use communication analytics to locate additional witnesses: These tools give investigators a macroscopic view of the entire social network of communication, identify critical individuals and focus on their individual communication patterns. Using analytics to drill even deeper into the communications between specific individuals, the process can quickly uncover witnesses that can be integrated into the interview and document collection process, ensuring a comprehensive investigation.
  6. Use efficient machine learning techniques: Technology-assisted review (TAR) rapidly locates critical documents. TAR based on the continuous active learning protocol is especially effective in an investigation, as it overcomes the delays inherent in training earlier TAR systems and allows teams to start review well before all the documents have been collected.
  7. Effectively explore the unknown: When a review focuses purely on what is perceived to be within the current scope of the inquiry, there is a very real possibility that documents that will help define the full fact pattern will be missed. Effectively explore the unknown with TAR tools that include functionality that is directed at locating documents that are contextually diverse from everything that is known to that point in time.
  8. If you can’t find relevant documents, prove a negative: Sometimes, there simply are no documents to be found. When documents are the object of the investigation, as in governmental and regulatory investigations, that means reviewing the entire document population only to come up empty-handed. Leverage advanced analytics and TAR to “prove a negative” efficiently and cost-effectively.
  9. QC every investigation with TAR: Continuous active learning is equally essential to ensure the quality of an investigation that does find the relevant documents and answer the underlying information needs, ensuring consistency, that there is no new information and nothing to controvert the team’s actual findings.
  10. Proactively design a streamlined investigation: Finally, effectively addressing the unique challenges of an investigation necessitates the need for proactive, careful, streamlined coordination of every component of the investigation, beginning at the earliest stage of the process. Consider a dedicated team experienced in data investigations that works under the guidance of counsel to develop a proactive plan, manage the technology and the moving parts, including collections and enhanced managed document review, execute the data investigation and provide the uncovered facts to client and counsel.

At the end of the day, a well-designed process designed to meet the specific goals of an investigation review will mean saved time, money and better outcomes. Download the full whitepaper here.

Interested in learning more about the OpenText™ Recon investigations service?  Contact us.

Share this post

Share this post to x. Share to linkedin. Mail to
OpenText avatar image


OpenText, The Information Company, enables organizations to gain insight through market-leading information management solutions, powered by OpenText Cloud Editions.

See all posts

More from the author

Manutan combines digital services with the human touch to delight customers

Manutan combines digital services with the human touch to delight customers

At Manutan, we equip businesses and communities with the products and services they require to succeed. Headquartered in France, our company has three divisions, serving…

4 minute read

Reaching new markets in Europe and beyond

Reaching new markets in Europe and beyond

How information management specialists at One Fox slashed time to market for innovative products with OpenText Cloud Platform Services At One Fox, we’ve driven some…

4 minute read

SoluSoft helps government agencies tackle fraud faster

SoluSoft helps government agencies tackle fraud faster

Fraud, in all its forms, is a pervasive problem, spanning industries and preying on vulnerabilities in federal and state government systems. Each year in the…

3 minute read

Stay in the loop!

Get our most popular content delivered monthly to your inbox.