The expression for prosecutors used to be 'follow the money.' These days after cases like that of Wachovia Bank in which senior bank officers readily admitted in e-mails to knowing of a multi-million dollar fraud involving Wachovia accounts, investigators may now have to replace 'follow the money' with 'check the inboxes.' Corporate boards and senior management may have to adopt a new mantra altogether–'update the records retention policy.'

After years of shareholder lawsuits and criminal prosecutions made on the backs of explicit e-mails or executive memoranda, companies appear still to be woefully behind in their awareness and implementation ofpolicies to determine when, how and why records should be retained or destroyed–particularly once you get outside the Fortune 100. "We just completed a survey of in-house counsel at 400 U.S. and U.K. companies," says Michelle Lang, director of legal services at Kroll Ontrack, an IT consultancy specializing in records control. "And I was pretty shocked at the results." She reports that only 25% of corporate counsel offices reported being "up to speed" on Electronically Stored Information (ESI) case law or on how compliant their own companies' policies were. Only half of U.S. companies surveyed had any policy at all for retention or the regular culling and destruction of unneeded records. "That also means," says Lang, "that half the companies in the U.S. probably have no plan for how to handle any ESI litigation that comes their way."

Admittedly in the case of Wachovia, it would seem that the lack of a corporate governance policy or internal controls to detect such fraudulent activity was the real culprit. But legal experts warn that an entire company can sometimes be held financially accountable for the actions of rogue executives simply because of few random remarks electronically preserved for all time.