As the economy continues to improve, we can expect to see increasing merger and acquisition activity. The reality is that the merger and acquisition (M&A) process is often long, difficult, complex, and imperfect. In fact, depending on how you measure it, some 50-80% of all mergers or acquisitions are deemed to be failures. The difficulty is often compounded because, in the complexity and immediacy of "the deal," it is too easy to overlook the fundamentals that will determine the deal's long-term success.

In today's environment of ever-increasing regulation and spiraling costs and risks associated with litigation, it is critical that M&A professionals address information governance fundamentals. After all, in our knowledge-based economy, information is often the asset that we are trying to acquire.

Getting your information house in order should be a standard part of any M&A process. Too often, in the hurry to consummate deals, professionals perform only perfunctory diligence in this area. For example, we have seen information governance due diligence in massive deals that amounted to a single page of rudimentary check-boxes reflecting a na�ve understanding of information governance at best.

Addressing information governance early in the deal provides the best opportunity to identify the value of the asset, root out liability dormant in the information environment, and prepare for the harsh realities of integrating different IT systems, processes, and cultures. In this article, we outline five key lessons that we have learned in helping our clients through these critical business events.

1. Map That Information

A standard part of M&A should be the inventorying of IT systems, applications, and data storage repositories in both organizations. Although this "checkbox" is often checked off when existing inventory data is collected from both organizations, in our experience this approach is inadequate. These lists tend to be outdated. They also reflect an IT-centric worldview that understandably focuses on what IT is responsible for (i.e., the systems) rather than the information that those systems house (which is typically viewed as a business, rather than an IT responsibility). As such, they are typically not sufficient to provide a comprehensive picture of the state of each organization's information "house."

The analysis needs to go further. The focus needs to be on the information itself, not just the systems. You should be doing this work anyway preparing for litigation in the context of the amended Federal Rules of Civil Procedure (FRCP), which require comprehensive knowledge about sources of Electronically Stored Information (ESI) you will produce evidence from.

So, take advantage of the occasion of M&A activity to go deeper in the analysis and "mapping" of information in both organizations. It will make valuation-and if the deal is successful-the integration of organizations much easier and more effective.

• Take an information-centric approach to mapping.
• Don't just "check the box" by gathering existing inventory information.
• Leverage any work that has already been done to comply with the FRCP.

2. Discover Your Dormant Liability

There is huge value in understanding the information environment of each organization involved in the deal. This is especially true in assessing any liability dormant in those terabytes of unmanaged email, shared drives, and legacy backup tapes. Businesses large and small are addicted to storage. More specifically, they are addicted to storing massive volumes of information that has little to no value to them, and which could have been defensibly deleted months or years in the past.  

Although this information may have no value to the business, our ability to properly dispose of it changes dramatically in the context of a legal matter. Now that outdated, useless, and duplicative information may need to be found, captured, processed, and produced to the other side-or to a regulator-in the context of e-discovery.

For example, our analysis of a recent legal matter found that, of the 30 million documents that were produced and reviewed during the course of the matter, over 50% were duplicates. Add that to the number of documents that could have defensibly been deleted prior to the start of the matter, and the amount of information that the organizations should have been retaining and managing was a fraction of the total produced.

The liability associated with unnecessarily retained and poorly managed information can be very high. Don't let it surprise you-discover and evaluate it as part of the deal.

• Poorly managed information is a liability-both from a legal and business perceptive. Don't let it surprise you.
• Ensure that you have a good understanding of the major types of information produced by each company and how that information is stored and managed.
• Look for opportunities to defensibly dispose of unnecessary information as part of the process of integrating systems and repositories, BUT make sure that you are fulfilling legal retention and preservation obligations.

3. Assess Your Legal Matters

Assessing and mitigating information governance risks in M&A depends upon a clear understanding of existing and anticipated legal, regulatory, audit and other formal proceedings that may require the preservation and/or production of information. We call this process "matter assessment," and it involves a focused effort to inventory all relevant matters.

This assessment provides a foundation for assessing dormant liability in stored information, and for building a solid plan for ensuring that information is properly handled during the system integration and decommissioning that is common when two companies become one. We recommend that matter assessments be completed in both organizations as a standard part of the M&A process. Taken together with the information mapping discussed in #1 above, it provides a key piece of the puzzle in ensuring M&A success.

• Understand the information impact of current and anticipated matters. How much data is being preserved? Where is each matter in its e-discovery lifecycle? What are the anticipated e-discovery costs?
• Are their matters that have been resolved but evidence related to them is still being preserved? Perhaps now is the time to dispose of unnecessarily preserved information.
• Is the scope of Legal Hold notices for current matters appropriate? Should they be updated to address the combined organization? Also, in many cases companies put in place overly-broad Holds that can defensibly be scaled back.

4. Whose Program Will Rule?

Long-term information governance success post-M&A is largely determined by the existence of a clear and committed approach to determining which organization's information governance program will take precedence post-integration. Too often we see companies fail to take a firm stand in this area, and as a result the two programs are never fully integrated. This leads to wasteful duplication of efforts and unnecessary retention of information that creates both cost and risk.

• During the M&A process, take a close look at the policies and procedures of each organization to determine where they are materially similar and different. Establish a formal process for resolving differences to ensure that the legal and business requirements of the unified organization are met.
• Avoid the temptation to tolerate significant differences in information governance practices. The time to address these differences is during the deal. After the deal, change in this area will only be more difficult.
• Ensure that the training and experience of personnel are adequate to support the combined organization, especially if a new line of business is added by the merger or acquisition.

5. Think About the Future-Pessimistically

Major business events-such as mergers or acquisitions-are guaranteed to be the period in your history when the other side in litigation or a regulator will aggressively investigate. Experience has taught litigators and regulators that such events are prime occasions for records, information, and evidence to go missing-inadvertently or not. M&A is not the time to play fast and loose with retention and preservation requirements. Rather, it is the time to avoid the appearance of wrongdoing. Doing so will help to inoculate the new organization from future claims.

• Document, document, document. Go above and beyond in creating good evidence that tells the story of what you did to manage and protect information during the merger or acquisition.
• Be especially careful when disposing of information from either company when decommissioning or integrating systems, and when shutting down data centers and offsite storage facilities.
• Proactively create "the bible" of the merger or acquisition that can be referred to when preparing for future depositions or testimony. Record the narrative of what was done in your information environment during the event.

Final Thoughts

M&A's are challenging. The long-term value that they provide to participating institutions is in large part determined by how well their respective information environments are integrated. The time to be surprised by a treasure trove of evidence is not after the deal, when the subpoena arrives on your desk. Address information governance up front. It is a complex, but not an insurmountable task. The simple lessons we have provided here will help get you started.

Good luck. 

Barclay T. Blair

Principal, ViaLumina LLC

btblair@vialumina.com 

Twitter: @btblair

Blog: barclaytblair.com