A government subpoena or civil investigative demand has a way of arriving at the worst possible moment — midway through a product launch, at the end of a fiscal year close, or when outside counsel is already deep in a large transaction. For in-house legal teams, the first response question is almost always the same: how quickly can we understand our document exposure before we commit to an outside-counsel review budget?
SEC formal orders of investigation, DOJ Civil Investigative Demands under the False Claims Act, and FTC second requests all carry procedural requirements and response timelines that don't accommodate a slow discovery ramp-up. The in-house teams that manage these productions most effectively have built a review workflow before they need it — one that lets the general counsel's office control the initial privilege cut while outside counsel prepares substantive responses.
The Privilege Exposure Problem
Government investigations create a specific privilege risk that routine civil litigation does not: the requesting agency is not a party subject to FRE 502(d) orders in the same way a civil litigant is. Inadvertent production to a government investigative body — particularly the DOJ or SEC — carries waiver risk that is litigated in a very different procedural environment than a 502(b) motion in district court.
The priority in the first week after receiving a government demand is not to produce documents — it is to understand the privilege landscape. That means identifying which custodians have the highest density of potentially privileged communications, running an initial attorney-communication filter, and ensuring the litigation hold is extended to cover all potentially responsive ESI before any data is collected for production. The hold obligation under the Federal Rules (and the SEC and DOJ procedural frameworks) attaches when litigation is reasonably anticipated, which in a formal investigation context typically means the moment the subpoena arrives.
In-house counsel who have established an ESI protocol for government response matters — custodian lists mapped to communication systems, pre-agreed collection methodology, known attorney email domains for privilege filtering — can execute the first-week privilege assessment without waiting for outside counsel engagement. That initial assessment is not a production-ready privilege review; it is a triage exercise that tells outside counsel where to focus.
Building the Initial Review Workflow
The practical structure for in-house management of a government production typically runs in three tracks:
Track 1: Litigation hold and collection. Extend the litigation hold to all potentially responsive custodians identified in the demand. Issue written hold notices with specific instructions about what not to delete or modify. Collect ESI from the identified custodians using a forensically defensible collection method — email archive exports, document management system pulls, or IT-assisted collections depending on the data environment. Document the collection methodology, date, and chain of custody.
Track 2: Initial privilege filter. Run the collected ESI through an automated attorney-communication filter using the company's known attorney roster (outside counsel, in-house attorneys, any retained experts). Flag documents in which a licensed attorney appears in the To, From, CC, or BCC metadata fields. This does not constitute a privilege determination — it is a triage to identify the population that needs attorney review before production. The metadata fields in native ESI (To/From/CC/BCC/Subject/Date, plus document author and application metadata) are the primary inputs for this initial pass.
Track 3: Responsiveness determination. Apply the demand's scope criteria to the collected documents. Most government demands define scope by date range, custodian, and subject matter. TAR can execute the responsiveness determination efficiently on large populations — the in-house team seeds the classifier with clearly responsive and clearly non-responsive examples that the company's attorneys have reviewed, validates the model output with a statistical sample, and produces a scored population for further review. The responsive, non-privileged documents form the initial production candidate set for outside counsel review.
Scenario: SEC Formal Order Response
Consider a scenario representative of how this plays out in practice: a publicly traded mid-market company receives an SEC formal order of investigation related to its revenue recognition practices over a three-year period. The general counsel has three days before an outside-counsel team can be staffed. The head of legal operations — working with the IT security team and the company's document management platform — can execute the following in that window: preserve all email and file-share ESI for the eleven custodians identified in the order; run an initial attorney-communication filter against the company's known attorney email domains; and produce a document count by custodian showing how many total documents, how many flagged for privilege review, and a preliminary responsive population estimate based on search term hits against the key terms specified in the order.
When outside counsel arrives, they are not starting from scratch. They have a custodian-by-custodian inventory, a preliminary privilege flag population ready for attorney review, and a responsiveness-screened document set that reduces the initial review population from the full ESI collection to the subset that cleared the preliminary responsive filter. That is a meaningful reduction in outside-counsel hours before substantive privilege review begins.
We're not saying in-house teams should be making final privilege determinations in government investigation contexts — the risk of inadvertent waiver and the complexity of the agency-specific procedural rules around privilege logging mean that outside counsel's involvement in final privilege determinations is essential. The point is that the substantial volume of clearly non-privileged, non-responsive documents in any large ESI collection can be identified and extracted from the review population by an in-house team using the right tools, before outside counsel billing begins.
ESI Protocol Design for Government Response
Companies that face recurring government inquiries — regulated industries (financial services, healthcare, defense contracting) or companies with active government contracts — benefit from having a standing ESI response protocol rather than designing one under response-timeline pressure. The standing protocol should address:
- Custodian identification methodology: who is in the company's directory as having potentially relevant custodian responsibilities for common inquiry categories, with a process for expanding the list when a new demand arrives
- Data source inventory: email archives, collaboration platforms (Teams, Slack, etc.), document management systems, contract management systems, and any cloud storage environments that custodians use for business documents
- Attorney roster for privilege filtering: maintained and updated to include all in-house attorneys, outside counsel firms on retainer, and any regulatorily-required legal advisors
- Litigation hold notice template and distribution protocol: who issues holds, what the notice contains, what the confirmation mechanism is
- Escalation protocol to outside counsel: under what circumstances does the in-house team escalate privilege questions or scope disputes to outside counsel, and who makes that call
Production Format for Government Productions
Government agencies have their own technical production specifications, and those specifications often differ from the TIFF-with-load-file conventions that prevail in civil litigation. The SEC's standard production format, set out in its document request forms, typically calls for native format production of electronically stored information with metadata intact — not processed TIFF images. The DOJ's Electronic Production Standards similarly prefer native format where available.
In-house teams managing the initial collection and processing need to ensure that their collection methodology preserves native format capability. Collections that immediately convert to TIFF at the collection stage may create compliance problems with agency production specifications. Confirm the agency's specific technical requirements before beginning collection, and document that confirmation in the matter file.
The role of privilege log in government investigations is also more complex than in civil litigation: some agencies have specific log format requirements, and some assertions of privilege that are well-established in civil litigation (common-interest privilege, deliberative-process privilege for regulated entities) may be treated differently by the investigating agency. Outside counsel familiar with the specific agency's enforcement practice is essential for privilege log sign-off — the in-house team's role is to generate the initial log entries with the metadata fields, not to make the final log-adequacy determination.
For companies navigating an active government inquiry or building a response protocol in advance, the walkthrough request form provides a starting point for understanding how a structured review workflow can be integrated with your existing document management environment.