Governance metrics for data access, retention, and ethical walls

A single misplaced document access in 2018 forced a major US law firm to withdraw from representing a client mid-litigation, because an associate on an "ethical wall" list had opened a file she should never have seen. No malice, no leak to the press, just a permissions gap. The firm's malpractice insurer wanted one thing afterward: proof, in numbers, that it couldn't happen again. That's what this lesson is about.

Law firms sit on some of the most sensitive data in the economy: privileged client communications, M&A deal terms before announcement, litigation strategy, trade secrets. Governance here isn't abstract compliance theater. It's measured, audited, and increasingly demanded by clients before they'll even sign an engagement letter.

The data that matters: key sources

Before metrics, know the systems generating the data:

• Document management systems (DMS): iManage and NetDocuments dominate the market. Every file open, edit, and download generates a log entry.
• Ethical wall / conflicts systems: software (often built into the DMS or via tools like Intapp) that restricts named individuals from accessing specific matters.
• Access control lists (ACLs): the permission tables defining who can see what, at matter, folder, or document level.
• Retention schedules: rules (often in the DMS or a separate records management module) dictating how long client files, billing records, and conflict-check data are kept before deletion or archiving.
• Audit logs: timestamped records of every access attempt, successful or denied, across DMS, email (Outlook/Exchange), and practice management systems.

Client audits (from corporate legal departments or cyber-insurance underwriters) increasingly request extracts from these systems directly, not just policy documents.

Core governance metrics

Access log completeness and audit coverage

Access log completeness rate: the percentage of systems (DMS, email, e-discovery platforms) actually generating retrievable audit logs, versus the total systems holding client data.

A 2023 Association of Corporate Counsel (ACC) survey and multiple legal ops benchmarking reports (e.g., from the International Legal Technology Association, ILTA) suggest large firms aim for near 100% logging coverage on DMS platforms, but coverage on shadow IT (personal cloud drives, unsanctioned messaging apps) is a persistent gap, often unmeasured. Treat any specific percentage here as a firm-reported estimate, not an industry-audited figure.

Worked example: a firm has 40 systems touching client data. Automated audit logging is confirmed active on 34.

Access log completeness rate = 34 / 40 = 85%

An audit report flagging 85% would typically require a remediation plan for the remaining six systems before a client's outside-counsel guidelines are considered satisfied.

Ethical wall breach incidents

An ethical wall (also called a "screen" or "cone of silence") is an internal information barrier preventing conflicted lawyers or staff from accessing a matter, required under professional conduct rules like ABA Model Rule 1.10 (imputation of conflicts) in the US, or the SRA (Solicitors Regulation Authority) Standards and Regulations in England and Wales.

Key metric: breach incident rate, usually tracked as:

Breach rate = (confirmed unauthorized access events) / (total walled matters) over a period

Firms report this quarterly to risk committees. A "breach" isn't always malicious: it often means an automated wall wasn't applied correctly when a new matter opened, or a lateral hire (a lawyer who joined from another firm) wasn't screened in time.

Mean time to detect (MTTD) and mean time to remediate (MTTR) are borrowed from cybersecurity and increasingly applied here: how long between the unauthorized access and its discovery, and between discovery and the wall being corrected.

Retention policy compliance rate

Retention rules intersect with regulation like the EU's GDPR (General Data Protection Regulation, effective 2018), which mandates data minimization and limits on how long personal data is kept, and US state rules plus bar association guidance on client file retention (often 5 to 10 years post-matter-closure, varying by state and practice area).

Retention compliance rate

Compliant records = records deleted/archived on schedule / total records due for action

If a firm has 10,000 closed-matter files due for disposition review this year and only 7,200 were actually processed (deleted, archived, or extended for legal hold) on schedule:

Retention compliance rate = 7,200 / 10,000 = 72%

A 72% rate would be a red flag in most audit frameworks; benchmarks cited informally in legal ops circles (ILTA, Ari Kaplan Advisors surveys) suggest firms target 90%+ for defensible retention programs, though this is an industry estimate, not a regulatory minimum.

Legal hold compliance

When litigation is reasonably anticipated, US case law (notably *Zubulake v. UBS Warburg*, 2003-2004) established the duty to suspend normal deletion via a legal hold. Metric: percentage of custodians (employees holding relevant data) who acknowledged a hold notice within a defined window (commonly 48 to 72 hours). Failure here is a direct spoliation (evidence destruction) risk under Federal Rule of Civil Procedure 37(e).

How these get benchmarked

Corporate clients now formalize this through outside counsel guidelines (OCGs), contractual documents specifying data handling requirements as a condition of engagement. Cyber-insurance underwriters and firms like the Legal Marketing Association and ILTA publish periodic benchmarking surveys (self-reported, treat figures as directional).

External frameworks firms mapmapUtiliser un logiciel pour automatiser les tâches et campagnes marketing répétitives, afin de personnaliser à grande échelle sur des canaux comme l'email, le web et le social.Voir la définition complète → themselves against:

• ISO/IEC 27001 (information security management, international standard)
• NIST Cybersecurity Framework (US, voluntary but widely adopted, nist.gov/cyberframework)
• SOC 2 Type II reports (US audit standard covering security, availability, confidentiality over time, not a point-in-time check)

Many Am Law 200 firms now undergo annual SOC 2 audits specifically because clients demand it before sending sensitive deal data.

A simple governance dashboard

Risk committees typically review a small set of numbers monthly, not raw logs. A minimal dashboard might track:

Metric                         This Qtr   Target    Status
------------------------------------------------------------
Access log completeness         91%        95%       AMBER
Ethical wall breaches (count)    2          0         RED
Avg. MTTD (days)                 6         <2         RED
Retention compliance            88%        90%       AMBER
Legal hold ack. rate (48hr)      94%        95%       AMBER

This format, borrowed from IT operations dashboards, is what General Counsel and Chief Information Security Officers (CISOs) at firms increasingly present to executive committees and, on request, to clients.

🎬 [VIDEO: "What is an Ethical Wall in Law Firms?" — youtube.com — search for law firm compliance vendor explainer videos (e.g., from Intapp or iManage) demonstrating how ethical walls are configured and monitored in DMS platforms]

Key Takeaways

• Governance in law firms is measurable: access log completeness, ethical wall breach rates, retention compliance rates, and legal hold acknowledgment rates are the core auditable metrics, not just policy statements.
• Data sources center on DMS platforms (iManage, NetDocuments), conflicts/ethical wall software (e.g., Intapp), and audit logs across email and practice systems; shadow IT is the biggest unmeasured gap.
• Retention and hold obligations are anchored in real regulation (GDPR in Europe, FRCP Rule 37(e) and case law like *Zubulake* in the US) and in professional conduct rules (ABA Model Rule 1.10, SRA Standards).
• Benchmarks (e.g., 90%+ retention compliance, near-100% log coverage) are industry estimates from surveys (ILTA, ACC), not hard regulatory thresholds, so always flag them as such.
• Clients now enforce these metrics contractually through outside counsel guidelines and require independent verification (SOC 2 Type II, ISO 27001) rather than firm self-attestation alone.