"Never write when you can talk. Never talk when you can nod. And never put anything in an e-mail." That was New York State Attorney General Elliot Spitzer's response when asked what advice he had for business leaders. It's a nice thought, but practically impossible. Today, e-mail is the primary way companies communicate and -- judging by the 30 percent growth of e-mail volume every year -- that shows no sign of changing.

Recognizing the staggering growth and impact of e-mail in business, many companies have implemented e-mail archives from vendors such as EMC, HP, and KVS/Symantec to store large volumes of e-mail. That way, when the Security and Exchange Commission (SEC), Food and Drug Administration (FDA), Federal Energy Regulatory Commission (FERC), or even Elliot Spitzer comes calling, companies have all e-mail readily at hand to fulfill their legal obligations to provide all relevant information. Or do they? The reality is a little more complex.

E-mail storage

Storing all e-mail is only part of the equation. The volume of e-mail a company stores can be so great that storage merely shifts the problem. Prior to archives' availability, companies struggled to gather all the e-mail messages from many different repositories -- tape, personal folder files on user machines, messages on live Microsoft Exchange servers, and so on. But consolidating all e-mail in an archive to solve that problem only creates a new challenge: In that huge, growing mass of e-mail messages, how do you find the small number relevant to the issue at hand? Put another way, thanks to an archive, lawyers no longer have to gather straw to create a haystack. But the haystack has now grown so large, you can't find the needle buried within it.

This "e-mail in a haystack" problem is the single largest driver of the cost of responding to a regulatory inquiry or legal e-discovery request. Effective archiving solutions are so costly because, until recently, companies have had no choice but to adopt the most expensive solution: Hire teams of people to sift through large volumes of e-mail. These people can be employees, contractors, or legal discovery services; they reside in the legal organization or as part of compliance or information security.

My company's research, based on interviews with more than 50 enterprises, suggests that after you count all the hidden costs, responding to a typical information request from a regulator involves an average of 10 people, more than 1,300 hours of work, and a monetary cost of more than US$100,000.