About Board and Fraud

Board and Fraud is a blog that aims to bring a practical approach to issues facing the board of directors and the audit committee specifically in the area of governance, risk management, compliance, and internal audit, with a strong focus on fraud, ethics, and internal controls.

Fraud Tip Friday: Investigation Planning – Preserving Evidence

Investigations in General

Poorly executed investigations can often increase the risk of scrutiny from government investigators, disruption to supply or distribution chains, and disgruntled employees venting on social media. So understanding the nuances of an investigation is critical.


I’m often in a position to evaluate the allegation review or triage and investigation processes. More often than not, I find that many don’t think about document retention or preserving evidence until it’s too late.

For example, you plan to perform an email review of 8 (eight) people or custodians at the company for the past two (2) years and you arrive on scene only to learn that off-site backup tapes cannot be located and the email server rewrites over files every sixty (60) days.

The Planning Phase of the Investigation Process (see above) should include the preservation of evidence.  The preservation process should include a written directive, called a “Litigation Hold Notice ” or “Litigation Hold Letter”.  Also called “preservation letters” or “stop destruction requests,” these communications basically advise of the possibility of future litigation and identify relevant documents and electronically stored information, which should be preserved.  In addition, the communication suspends routine document retention/destruction policies and implements a legal hold on all evidence which may be relevant.

Document retention practices represent a complex area, and counsel should always be consulted in this regard to ensure compliance with policies and all applicable laws and regulations.

Practice Pointers

A good Litigation Hold Notice or Process…

  • Clearly identifies the reason for the hold, should prohibit the destruction of relevant documents
  • Identifies what sort of information is considered relevant.
  • Does not use voicemail to communicate the litigation hold
  • Contains clear instructions to suspend automatic deletion and clear instructions on what should be preserved
  • Ensures the distribution of the legal hold notice to only those key individuals or departments who need to know. Unless it is deemed necessary, avoid the temptation to send company-wide notices.
  • Includes reminders to ensure compliance.

Open Pantone catalogue.

Sample: Litigation Hold Notice or Letter

From: General Counsel

Subject: Legal Hold Notice / _______________________(name) / Attorney-Client Communication, Privileged

(Name) Legal Hold Notice:

This email shall serve as notice that Legal has received information alleging a possible litigation claim involving former employee ___________________(Name). At this time, we are taking steps to preserve any documents that may exist that relate to this claim.

This email will serve as the Company’s official Legal Hold notice that requires all records associated with (Name), and certain other categories of documents described below, be preserved until further notice.

Please read the email below in its entirety prior to searching for or moving any documents.

In the event the Company receives a request for documents, the request will require the collection and production of certain company documents. You have received this email because Legal has been informed that you have access to information relevant to (Name) termination, departure, performance, or (state reason). It is our responsibility to reach out to everyone who may have been involved in this issue, even if that involvement was very small. Please let me know immediately if you believe any other employees may have information relating to (Name’s) performance or termination.

In order to fully comply with this request, it is vital that all documents, data, and information relating to this matter be preserved and all routine destruction or discarding of any such documents or data, whether pursuant to formal company policies or otherwise, be suspended until further notice. The following information has specifically been requested to be preserved:

  1. Any and all documents, communications, and Emails pertaining to any aspect of (Name) employment at (name of company), including his/her termination.
  2. All documents and communications related to any complaints of policy violations related to the Company’s sale practices or retaliation reported by (Name), including any investigations into such allegations.
  3. All documents and communications related to any evaluations of (Name) for promotion to VP of Sale (state action).

If you have a question about whether or not a document should be preserved, please err on the side of preserving it until advised otherwise by legal counsel. This notice includes not only formal company documents but also materials such as drafts, calendar entries, voicemail messages, text messages, LinkedIn messages, and the like.

In the event a request to produce documents is received, detailed instructions regarding the procedures for collection of documents will follow, and will be designed to minimize disruption of your daily business activities. Until such instructions are provided, all documents and files should be maintained as they are kept in the ordinary course of business or as needed to prevent destruction of the document.

This letter suspends operation of the company’s usual document retention policies with regard to documents covered by this letter.  At this time, It is CRITICAL that you:

  • DO NOT PURGE any information (emails, voicemail messages, electronic files, manual/paper files, loose file documentation, notes, text messages, etc.) with respect to this request. We understand that email limitations can be challenging at times; however, DO NOT delete any items from your in-box, sent items, or individual folders that are related to this request.
  • DO NOT ALTER any documents in files – electronic or paper. This includes any documents you may have access to, including those that may be located on your hard drive.
  • DO NOT DESTROY any manual/paper loose files or employee folders that you may have in your office related to this request. This includes any handwritten notes/comments, voicemail messages, text messages, or audio recordings that may exist.
  • Move all emails related to this request into a separate folder in Outlook. This should include emails in your Inbox, Sent Items, and Deleted Items folders. IT can assist you if you have questions about how to do this. Feel free to create subfolders as you see fit to more easily identify specific documents later.

Standard Legal Reminders:  

  • Internally, please refrain from having ANY conversations regarding this matter unless General Counsel is included.
  • Do not discuss this issue with anyone outside of the firm, including friends and family.
  • Do not forward the litigation hold notice to anyone inside or outside the company.
  • Do not release any information without the express consent of General Counsel. Direct all phone calls, emails or questions from the press, outside firms, etc. to the General Counsel.
  • DO NOT send any emails related to this matter to anyone other than the General Counsel. All of this information is subject to discovery unless counsel is present. When communicating in writing to any of these individuals regarding this matter, include “Attorney-Client Communication, Privileged and Confidential” in the email header.

If you have any questions or concerns regarding this request, please feel free to contact ___________________________________. Please do not ignore this communication.

Thank you,

/Signature/ General Counsel

Please Acknowledge your understanding and willingness to comply by replying back to this email.


There are some good tools out there that can automate this process like Total Discovery and others.

I welcome all thoughts, comments, and suggestions.






Jonathan T. Marks, CPA, CFF, CFE

Guide to Forensic Accounting Investigations
Please follow and like us:

Articles You Might Like

Share This Article

Share on facebook
Share on twitter
Share on linkedin
Share on tumblr

More Stories

%d bloggers like this:
Skip to toolbar