# Confidentiality walls that survive an audit, not just a policy binder
A partner at a mid-sized law firm hires a lateral from a competitor. Six weeks later, opposing counsel in an active litigation files a motion to disqualify the entire firm, arguing the lateral worked on the other side of the same matter eighteen months earlier. The firm produces its "ethical wall" memo: a one-page PDF, signed, dated, filed in a drawer. The judge asks a simple question: how do you know the wall actually held? Nobody in the room can answer with data. The firm settles rather than risk disqualification. That is the cost of a policy that exists only on paper.
This lesson is about building information barriers (also called ethical walls or confidentiality walls) that produce evidence, not just intentions.
An information barrier is a set of controls that stops specific people from accessing specific client or matter information, usually because of a conflict of interest. Professional services firms (law, accounting, consulting, investment banking) rely on them constantly: they let a firm keep a merger client and an activist investor client simultaneously, or let a lateral hire join without forcing the firm to drop existing work.
The regulatory logic varies by sector but the mechanism is the same everywhere:
The common failure mode across all of these: firms write the policy but never instrument it. A memo saying "the lateral will not access Matter X files" is a promise. A system log showing zero access events to Matter X's document management system folder by that person's credentials for eighteen months is evidence.
A defensible barrier needs four layers, not one.
1. Data inventory and mapping. Before you can wall something off, you need to know where it lives: document management system (DMS) folders, email, shared drives, CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète → records, calendar invites, Slack/Teams channels, even printed files in physical storage. Most disqualification motions succeed because firms walled the DMS folder but forgot the email distribution list or the billing system, which still shows the screened person's name on time entries.
2. Access control implementation. This is technical, not just administrative:
3. Logging and monitoring. Every access attempt, successful or denied, should generate a timestamped log entry: user ID, resource, action, result. This is the raw material for the audit trail.
4. Periodic testing. Someone independent (often a firm's General Counsel, risk officer, or a compliance function separate from the deal team) actually tries to breach the wall on a schedule, and reviews logs for anomalies.
Here is the kind of check a firm's information governance team should be able to run on demand, conceptually (actual systems vary: iManage, NetDocuments, Relativity for law firms; SharePoint/Purview for many consultancies):
-- Flag any access to a walled matter by a screened individual
SELECT access_log.timestamp, access_log.user_id, access_log.resource_id,
access_log.action, access_log.result
FROM access_log
JOIN screened_individuals ON access_log.user_id = screened_individuals.user_id
JOIN walled_matters ON access_log.resource_id = walled_matters.matter_id
WHERE screened_individuals.matter_id = walled_matters.matter_id
AND access_log.timestamp BETWEEN screened_individuals.screen_start_date
AND screened_individuals.screen_end_date
ORDER BY access_log.timestamp DESC;A firm that can run this query and produce a clean (or honestly explained) result set has an audit trail. A firm that can only produce a signed memo does not. This is the single biggest differentiator when a judge, regulator, or opposing expert witness asks "prove it."
When a wall is challenged, the questions are consistently data questions:
For a practical reference on how conflicts and screening obligations interact with data controls, see the ABA's guidance on Model Rule 1.10 screening and, for EU-context data access control obligations, the European Data Protection Board guidelines on Article 32 security measures.
Vérification des acquis
1. In the disqualification motion scenario, why did the firm's signed and dated wall memo fail to protect it?
2. What is the common mechanism underlying information barriers across law, accounting, and investment banking, despite different regulatory sources?
3. Why does ABA Model Rule 1.10's screening provision matter for a firm hiring a lateral with a prior conflict?
4. Select ALL correct answers about what would make an information barrier defensible in an audit or court challenge, based on the lesson's argument.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about why different sectors (law, audit, banking) all require information barriers despite having separate regulators.
Sélectionnez toutes les réponses correctes.
Treat wall verification as a recurring control, not a one-time setup:
1. At screen creation: inventory all systems touching the matter, implement technical access blocks (not just instructions), document the effective date and time.
2. Weekly or monthly: automated log review for access attempts by screened individuals; exception reports routed to compliance, not the deal team.
3. Quarterly: re-certification from the screened individual and from colleagues who might inadvertently loop them in (email cc mistakes are the most common real-world breach).
4. At matter close or lateral departure: formal wind-down log showing the screen was maintained for its full duration, archived for the firm's document retention period (often 6 to 10 years depending on jurisdiction and matter type).
5. Annual internal audit: an independent test, sometimes literally a red-team style attempt to access walled material, to confirm controls still function as systems change (a DMS migration is a classic moment where walls silently break).
This is the same logic as SOC 2 (System and Organization Controls 2, a US auditing standard for service organizations' data controls) evidence gathering: continuous logging beats point-in-time assertions every time an examiner shows up.
🎬 [VIDEO: "Ethical Walls Explained" - youtube.com - search for law firm and compliance channels covering information barrier implementation and conflict screening in practice; look for content from bar association CLE providers or legal ops vendors]