Litigation Holds and Evidence Preservation

Why This Topic Matters
In the ACFE CFE exam, Litigation Holds and Evidence Preservation falls under the Law section, within the area of civil (non-criminal) actions. Fraud examinations almost always carry the possibility of litigation: an employer may sue a dishonest employee, a victim may pursue civil recovery, or the organization itself may become a defendant. Once litigation is on the horizon, the law imposes a duty to preserve relevant evidence. Failing that duty can destroy an otherwise strong case, expose the organization to severe court sanctions, and even create criminal exposure for obstruction. A Certified Fraud Examiner is often the first professional on the scene and is therefore expected to recognize when the duty to preserve arises and to help the organization respond correctly. Exam questions on this topic test whether you understand when the duty is triggered, what must be preserved, how a hold is implemented, and what happens when evidence is lost.

What Is a Litigation Hold?
A litigation hold (also called a legal hold, preservation order, hold notice, or document hold) is a formal directive, usually issued by legal counsel, instructing an organization and its employees to preserve all documents, data, and tangible items that may be relevant to pending or reasonably anticipated litigation, a government investigation, or an audit. Its central purpose is to suspend the routine destruction or alteration of potentially relevant information so that it remains available for discovery and trial.

Key characteristics of a litigation hold:
- It is generally communicated in writing to all employees who are likely to possess relevant information (the custodians).
- It describes the subject matter of the dispute, the categories of information to be preserved, and the time period covered.
- It explicitly overrides normal document retention and destruction schedules, including automatic email deletion, backup tape rotation, and shredding programs.
- It covers both hard-copy documents and electronically stored information (ESI) such as emails, text messages, instant messages, voicemail, databases, spreadsheets, accounting system records, social media content, cloud storage, mobile devices, and associated metadata.
- It remains in effect until counsel formally releases it, typically after the matter is fully resolved and appeal periods have expired.

When Does the Duty to Preserve Arise?
This is the single most heavily tested point. The duty to preserve evidence is triggered when litigation is reasonably anticipated or reasonably foreseeable, not merely when a lawsuit is actually filed or a subpoena is served. Events that commonly trigger the duty include:
- Receipt of a complaint, summons, or subpoena.
- A demand letter or a threat of suit from an opposing party or its attorney.
- Notice of a government or regulatory investigation.
- An internal decision to pursue legal action against an employee, vendor, or other party.
- Discovery of a fraud or credible allegation that is likely to lead to litigation.
- Any other circumstance in which a reasonable person would conclude that a dispute is likely to end up in court.

In U.S. practice, the duty applies to parties to the litigation and, in some circumstances, to third parties who have been served with a subpoena or preservation request. The well-known Zubulake v. UBS Warburg line of decisions articulated that once a party reasonably anticipates litigation, it must suspend its routine document retention/destruction policy and put in place a litigation hold.

Spoliation: The Consequence of Failure
Spoliation of evidence is the destruction, alteration, concealment, or failure to preserve evidence that is relevant to pending or reasonably foreseeable litigation. Spoliation can be intentional or negligent. Courts have broad inherent authority, and in the United States specific authority under the Federal Rules of Civil Procedure, to impose sanctions for spoliation. Possible sanctions include:
- Adverse inference instruction: the jury is told it may (or must) presume that the lost evidence was unfavorable to the party that failed to preserve it.
- Monetary sanctions: fines, payment of the other side's attorney fees and costs.
- Evidentiary sanctions: exclusion of evidence or preclusion of certain claims or defenses.
- Dismissal of the case or entry of default judgment: the most severe sanction, reserved for egregious, bad-faith conduct.
- Criminal exposure: destroying documents to impede a government proceeding may constitute obstruction of justice. The Arthur Andersen matter arising from the Enron scandal, in which the firm's shredding of documents under a retention policy led to prosecution, is the classic illustration. The Sarbanes-Oxley Act also created criminal penalties for destroying or altering records with intent to obstruct a federal investigation.

Federal Rule of Civil Procedure 37(e)
The 2015 amendments to the U.S. Federal Rules of Civil Procedure created a specific framework for lost ESI. Under Rule 37(e), if ESI that should have been preserved is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, then:
- If another party is prejudiced, the court may order measures no greater than necessary to cure the prejudice.
- Only if the court finds the party acted with intent to deprive the other party of the information may it impose the most severe sanctions: an adverse inference presumption, dismissal, or default judgment.
The practical lesson is that reasonableness and good faith are the standard; perfection is not required, but a documented, reasonable preservation effort is essential.

Document Retention Policies vs. Litigation Holds
Organizations are legally permitted to have document retention and destruction policies that routinely dispose of records after a specified period. Such a policy is a legitimate defense against spoliation claims only if it is reasonable, consistently applied, and followed in good faith. However, the moment the duty to preserve is triggered, the retention policy must be suspended for all potentially relevant material. Continuing to destroy records under a routine schedule after litigation is reasonably anticipated is a textbook example of spoliation. Exam questions frequently present a scenario in which a company keeps shredding or auto-deleting after receiving a demand letter; the correct answer is that this conduct is improper and sanctionable.

How a Litigation Hold Works: Step-by-Step
1. Recognize the trigger. Identify the event that makes litigation reasonably foreseeable. Fraud examiners should alert management and counsel as soon as an examination suggests legal action may follow.
2. Involve legal counsel. Counsel determines the scope of the hold and typically issues it. This also helps protect the examination under attorney-client privilege and the work-product doctrine.
3. Define the scope. Identify the relevant subject matter, time frame, and categories of documents and ESI. Err on the side of inclusiveness; it is far easier to preserve too much than to explain why relevant data vanished.
4. Identify custodians and data sources. Determine which employees, departments, systems, servers, mobile devices, cloud accounts, backup media, and third-party vendors may hold relevant information. Include former employees' data where it still exists.
5. Issue a written hold notice. The notice should explain what to preserve, why, how long, and whom to contact with questions. It should instruct recipients not to delete, modify, discard, or overwrite anything covered. Require acknowledgment of receipt.
6. Suspend automatic destruction. Work with IT to disable auto-delete functions, stop backup tape recycling, halt mailbox purges, and suspend shredding for affected records.
7. Collect and secure evidence. Where appropriate, make forensic images of hard drives and devices rather than working on originals, preserve metadata, and secure physical documents in a controlled location. Maintain a documented chain of custody for every item: who collected it, when, from where, how it was stored, and every subsequent transfer.
8. Monitor, remind, and update. Send periodic reminders, re-issue the hold when new custodians are identified, and track compliance. Document every step taken so the organization can later demonstrate it acted reasonably.
9. Release the hold. When counsel confirms the matter is fully concluded, formally release the hold in writing and allow normal retention schedules to resume.

The Fraud Examiner's Role
The CFE is frequently the person who first recognizes that evidence is at risk. Best practices include:
- Recommending that counsel issue a litigation hold at the outset of any examination likely to lead to civil or criminal proceedings.
- Preserving original documents and working from copies; never marking, stapling, or altering originals.
- Using qualified digital forensic specialists to image computers and mobile devices so that ESI and metadata remain intact and admissible.
- Documenting chain of custody meticulously, because gaps can lead to evidence being excluded or challenged as tampered.
- Avoiding any action that could be characterized as destroying, hiding, or altering evidence, even informally, such as advising an employee to "clean up" files.
- Understanding that evidence preservation obligations can also exist in non-U.S. jurisdictions, though specific rules vary; the general principle that a party may not destroy relevant evidence once a dispute is foreseeable is widely recognized.

Key Terms to Memorize
- Litigation hold / legal hold: directive to preserve relevant evidence.
- Duty to preserve: arises when litigation is reasonably anticipated.
- Spoliation: destruction, alteration, or loss of relevant evidence.
- Adverse inference: presumption that lost evidence was unfavorable to the party who lost it.
- ESI: electronically stored information, including metadata.
- Custodian: person or system holding potentially relevant information.
- Chain of custody: documented history of evidence handling.
- FRCP 37(e): rule governing sanctions for failure to preserve ESI; severe sanctions require intent to deprive.
- Document retention policy: routine destruction schedule that must be suspended once the duty to preserve arises.

Exam Tips: Answering Questions on Litigation Holds and Evidence Preservation
Tip 1 – Watch for the timing trap. If an answer choice says the duty to preserve begins only when a lawsuit is filed or a subpoena is received, it is almost certainly wrong. The duty begins when litigation is reasonably anticipated.
Tip 2 – Routine destruction after a trigger is always wrong. Scenarios describing continued shredding, email auto-deletion, or backup tape recycling after a demand letter or complaint are describing spoliation. Select the answer that identifies the conduct as improper and sanctionable.
Tip 3 – Know the sanction hierarchy. Adverse inference instructions and monetary sanctions are common; dismissal or default judgment is the most severe and is reserved for bad-faith or intentional conduct. Under FRCP 37(e), the harshest sanctions for lost ESI require a finding of intent to deprive.
Tip 4 – "Reasonable steps," not perfection. If a question asks what standard a party must meet, look for language about reasonable, good-faith efforts to preserve. Inadvertent loss despite reasonable steps generally does not warrant severe sanctions.
Tip 5 – Remember that a hold covers more than paper. Answer choices that limit preservation to hard-copy files or to the accounting department are incomplete. The correct answer will include ESI, metadata, mobile devices, and all relevant custodians.
Tip 6 – Written and documented beats verbal. When asked how a hold should be communicated, prefer the answer involving a written notice to identified custodians with acknowledgment and ongoing follow-up.
Tip 7 – Counsel issues, the fraud examiner recommends and supports. Questions about who should direct a litigation hold generally point to legal counsel. The examiner's role is to recognize the need, advise promptly, and preserve evidence properly.
Tip 8 – Preserve originals, image devices, document custody. Any question about handling seized computers or documents is answered by forensic imaging, working from copies, and maintaining chain of custody.
Tip 9 – Retention policies are a shield only when applied consistently and in good faith. If a question asks whether a company may defend against a spoliation claim by pointing to its retention policy, the correct answer depends on whether the policy was reasonable, consistently followed, and suspended once the duty arose.
Tip 10 – Eliminate absolutes carefully. Choices stating that spoliation always results in dismissal, or that negligent loss can never be sanctioned, are usually wrong. Sanctions are proportional and depend on culpability and prejudice.
Tip 11 – Link to adjacent topics. Expect this material to blend with questions on civil discovery, electronic evidence, attorney-client privilege, work product, and obstruction of justice. Read each scenario to identify which legal principle the question is actually testing.

Quick Self-Check
Ask yourself before answering any question in this area: (1) Has litigation become reasonably foreseeable? (2) Has routine destruction been suspended? (3) Has a written hold been issued to all relevant custodians? (4) Have originals and ESI been preserved with a documented chain of custody? (5) If evidence was lost, was it through intentional conduct or despite reasonable steps? Answering these five questions will lead you to the best answer on virtually every CFE exam item concerning litigation holds and evidence preservation.