Infotech and the Law: Documents--Know when to hold 'em, when to destroy 'em

In the wake of the Enron scandal and the obstruction of justice verdict against Arthur Andersen, corporate conduct and compliance are coming under increasing scrutiny. Government contractors, such as WorldCom Inc. and Global Crossing Ltd., are having their contracts reviewed or have lost contracts because they have been found not to be responsible in light of financial and ethical problems.Among the business practices under examination are document retention policies. Prudent companies are taking a fresh look at their document management policies to make sure they are reasonable and comply with all state, federal and other regulations.No document retention policy applies to all companies. Defensible retention practices should have legitimate business purposes at their core. No policy will shield a company if its purpose is to eliminate documents that might harm the company.There are two main considerations in deciding how long to hold documents: the regulatory requirements of the industry and jurisdiction in which the business or particular unit operates, and the business needs of the company. Documents should not be retained beyond their usefulness to the company or the legal requirements for retention.State or federal law, as well as various agency regulations, require particular types of businesses to keep certain records for a specific time. Such affirmative legal obligations should be a primary consideration in drafting a document retention policy.The Federal Acquisition Regulations, for example, requires that all sealed bid and negotiated procurement contracts contain clauses requiring the contractor to retain all records related to proposals, pricing, discussions and performance of the contract and subcontracts for not less than three years after final payment. Businesses with numerous units operating in different industries and within different jurisdictions may well have to further customize their retention policies to each particular unit.In addition to explicit statutory or regulatory requirements, document retention periods also should be defensible on business grounds. One of the lead federal appeals court cases discussing retention provided a three-part test to determine whether a company is properly maintaining its documents:Document retention policies should not distinguish between electronic and hard-copy documents. It's unnecessary to keep the same document in electronic and hard copy, but if there is no hard copy, the electronic copy must be protected.When the retention policy calls for documents to be destroyed after a proscribed time, it should ensure destruction of all electronically stored copies and versions of the documents wherever they are kept, and in a fashion that prevents them from being restored.Companies can avoid significant trouble implementing and monitoring compliance with document retention policies as a part of their normal business practice before disputes arise. The case against Andersen demonstrates the catastrophic risks of poorly timed internal memos reminding employees to comply with the firm's document retention policies.Finally, once litigation or an investigation is anticipated, the company must be able to stop document destruction. If it does not, the company risks sanctions for spoliation of evidence or obstruction of justice. This stop function must be communicated immediately to every person in the organization in a position to destroy documents.