What is a data-retrieval plan worth to a company caught up in litigation? For Morgan Stanley, US$15 million.

In 2006, the Wall Street firm agreed to pay that sum in fines to resolve an investigation by US regulators into its failure to retain e-mail messages.

E-mail played a central role in the (later overturned) US$1.58 billion judgment in favor of Ronald Perelman in the case of MorganStanley v. Coleman. Perelman is a billionaire investor who said he was defrauded by the firm over the sale of a business. The judge, frustrated by Morgan Stanley's inability to produce e-mails demanded by Perelman's lawyers (the firm said backup tapes had been overwritten), took the unusual step of shifting the burden of proof to Morgan Stanley, so that the firm had to prove its innocence.

The case was sobering for some, but the vast majority of companies still aren't getting the message. In fact, in one survey, some 94 percent of those responsible for e-mail policy said they don't feel their organizations are fully prepared to meet the revised Federal Rules of Civil Procedure (FRCP), which require companies to be able to quickly find electronic data when ordered by a federal court. The survey was conducted by archive outsourcing firm Fortiva Inc. three months after the new requirements took effect Dec. 1, 2006. In another finding, only 38 percent of the 118 respondents said they were familiar with the changes.

Companies in regulated industries, such as financial services, health care, pharmaceuticals and telecommunications, are more likely to find themselves in the cross hairs of lawsuits, but all companies risk an e-discovery legal challenge. More than 60 percent of organizations have been ordered by a court or regulatory body to produce corporate e-mail, according to Osterman Research.

And when an e-discovery request lands at your door, you had better be able to show that you can produce documents in a reasonable time frame. Heavy fines and penalties may be levied by the court, which in the case of Serra Chevrolet v. General Motors were as high as US$50,000 per day for each late response to a discovery request. What's more, companies may have to reach back three to five years for relevant e-mail, because some cases can take years to reach the courts.

Most companies today find themselves in one of two situations, says Alan Armstrong, vice president of business development at Ontario-based Fortiva. "Larger companies are in a constant cycle of litigation and are so busy that they are reactive," he said. "If they could get ahead of the curve, they could save a lot of money, but getting ahead is always a challenge."

Other companies haven't faced any lawsuits since the new FRCP requirements took effect, but they need to weigh the risks and benefits of indexing stored tapes while introducing new e-mail archiving procedures.

In either case, here's how to prepare so you can quickly -- and economically -- lay your hands on what you need.

Create a data-retrieval plan

A data-retrieval plan includes an understanding of what data and e-mail the company has and where it is located, as well as a strategy for preserving and identifying that data and being able to collect it when needed. It may also include methods for reviewing and producing documents in-house.

"The more relevant the information that you start with, the more quickly you can find a subset of information," explains Brian Babineau, a senior analyst at Enterprise Strategy Group.

The IT department, business units and corporate counsel all share responsibility for data and e-mail. But corporate counsel is ultimately responsible for managing litigious risk, says Babineau. Counsel should lead planning for data retrieval -- a process that includes determining where records are kept and for how long -- with input from IT, records managers and business analysts. In a regulated industry, the compliance officer should also be involved in data-retrieval planning.