Confidentiality walls that survive an audit, not just a policy binder

The common failure mode across all of these: firms write the policy but never instrument it. A memo saying "the lateral will not access Matter X files" is a promise. A system log showing zero access events to Matter X's document management system folder by that person's credentials for eighteen months is evidence.

Designing a wall that produces evidence

A defensible barrier needs four layers, not one.

1. Data inventory and mapping. Before you can wall something off, you need to know where it lives: document management system (DMS) folders, email, shared drives, CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → records, calendar invites, Slack/Teams channels, even printed files in physical storage. Most disqualification motions succeed because firms walled the DMS folder but forgot the email distribution list or the billing system, which still shows the screened person's name on time entries.

2. Access control implementation. This is technical, not just administrative:

• Role-based access control (RBAC) at the folder and system level, not just "please don't look" instructions.
• Automatic exclusion from matter-specific distribution lists.
• Conflict flags in the practice management system that block the screened individual's login from even opening the matter record.

3. Logging and monitoring. Every access attempt, successful or denied, should generate a timestamped log entry: user ID, resource, action, result. This is the raw material for the audit trail.

4. Periodic testing. Someone independent (often a firm's General Counsel, risk officer, or a compliance function separate from the deal team) actually tries to breach the wall on a schedule, and reviews logs for anomalies.

A simple audit query, illustrated

Here is the kind of check a firm's information governance team should be able to run on demand, conceptually (actual systems vary: iManage, NetDocuments, Relativity for law firms; SharePoint/Purview for many consultancies):

A firm that can run this query and produce a clean (or honestly explained) result set has an audit trail. A firm that can only produce a signed memo does not. This is the single biggest differentiator when a judge, regulator, or opposing expert witness asks "prove it."

What regulators and courts actually probe

When a wall is challenged, the questions are consistently data questions:

• Timing: was the screen implemented before the lateral had any access, or retroactively after the conflict was noticed? Courts (see the reasoning in *Kirk v. First American Title Ins. Co.*, a frequently cited California case on screening timeliness) weigh this heavily.
• Completeness: did the screen cover every system, or just the obvious one?
• Verifiability: can the firm produce logs, not just attestations?
• Enforcement: were there any breach attempts, and if so, what happened next? A single logged denial that was investigated and closed out actually strengthens credibility; an unmonitored system that shows nothing because nothing was tracked looks worse under scrutiny, not better.
• Ongoing certification: many firms require screened individuals and supervising partners to re-certify quarterly that no discussion of the matter has occurred. Missing certifications are a red flag auditors specifically look for.

For a practical reference on how conflicts and screening obligations interact with data controls, see the ABA's guidance on Model Rule 1.10 screening and, for EU-context data access control obligations, the European Data Protection Board guidelines on Article 32 security measures.

Building the audit muscle: a practical checklist

Treat wall verification as a recurring control, not a one-time setup:

1. At screen creation: inventory all systems touching the matter, implement technical access blocks (not just instructions), document the effective date and time.

2. Weekly or monthly: automated log review for access attempts by screened individuals; exception reports routed to compliance, not the deal team.

3. Quarterly: re-certification from the screened individual and from colleagues who might inadvertently loop them in (email cc mistakes are the most common real-world breach).

4. At matter close or lateral departure: formal wind-down log showing the screen was maintained for its full duration, archived for the firm's document retention period (often 6 to 10 years depending on jurisdiction and matter type).

5. Annual internal audit: an independent test, sometimes literally a red-team style attempt to access walled material, to confirm controls still function as systems change (a DMS migration is a classic moment where walls silently break).

This is the same logic as SOC 2 (System and Organization Controls 2, a US auditing standard for service organizations' data controls) evidence gathering: continuous logging beats point-in-time assertions every time an examiner shows up.

🎬 [VIDEO: "Ethical Walls Explained" - youtube.com - search for law firm and compliance channels covering information barrier implementation and conflict screening in practice; look for content from bar association CLE providers or legal ops vendors]

Key Takeaways

• An information barrier is only as strong as its audit trail: a signed memo is a policy, a timestamped access log is evidence.
• MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → every system the walled information touches (DMS, email, billing, calendars, chat) before declaring a screen complete; incomplete inventories are the most common cause of failed walls.
• Build technical access controls (RBAC, automated exclusions, login blocks), not just verbal instructions, and log every access attempt and denial.
• Test the wall periodically with independent review or red-team style checks, especially around system migrations, which routinely break controls silently.
• Regulators and courts (under ABA Model Rule 1.10, SEC/PCAOB independence rules, FCA SYSC 10, or GDPR Article 32) all ask the same underlying question: can you prove it, not just assert it.