PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
MEMORANDUM
Date: August 4, 2023
To: Howard Quinn, Partner, Calderwood & Harkness LLP Conrad Ashby, Partner, Calderwood & Harkness LLP
From: Liam Donahue, Senior Associate Steven Hollander, Associate
Re: E-discovery Protocol and Technology-Assisted Review Methodology — Internal Investigation of Verimark Coastal Resorts LLC
Matter Number: 1021-00008
This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared in connection with the internal investigation of Verimark Coastal Resorts LLC conducted by Calderwood & Harkness LLP at the direction of the Audit Committee of the Board of Directors of Verimark Hospitality Group Inc. This memorandum should not be disclosed to any person or entity outside of Calderwood & Harkness LLP without the prior written consent of the undersigned or their designees.
Right-click to update Table of Contents
I. Purpose and Background
This memorandum documents the e-discovery protocol and technology-assisted review ("TAR") methodology adopted for the internal investigation conducted by Calderwood & Harkness LLP ("Calderwood & Harkness" or the "Firm") on behalf of the Audit Committee of the Board of Directors of Verimark Hospitality Group Inc. ("VHG"), a Delaware corporation publicly traded on the Nasdaq Global Select Market under the ticker symbol VMRK, with its principal executive offices located at 4100 Bayshore Boulevard, Suite 1200, Tampa, Florida 33611. The Firm was retained by the Audit Committee pursuant to an engagement letter dated July 20, 2023, and charged with conducting an independent investigation into certain financial-reporting irregularities identified by VHG's internal audit function and brought to the attention of the Audit Committee during its regularly scheduled meeting on July 17, 2023.
The investigation, formally opened on July 24, 2023, examines two distinct but potentially related areas of concern at VHG's wholly owned subsidiary, Verimark Coastal Resorts LLC ("VCR"), a Florida limited liability company with principal offices at 7820 Gulf Breeze Parkway, Suite 400, Destin, Florida 32541:
(1) Premature Revenue Recognition of Timeshare-Interest Deposits. VCR's timeshare sales operations at its flagship properties appear to have recognized revenue from timeshare-interest purchase deposits in advance of the expiration of the statutory rescission period prescribed under the Florida Vacation Plan and Timesharing Act, Florida Statutes § 721.10, and potentially in contravention of ASC 606, Revenue from Contracts with Customers. The period of interest for this workstream extends from approximately the third quarter of fiscal year 2022 through the second quarter of fiscal year 2023 (i.e., Q3 2022–Q2 2023), during which VCR reported materially higher timeshare-interest sales revenue than in comparable prior periods.
(2) Expense-Reporting Irregularities Involving Fictitious Vendor Invoices. VCR's accounts payable and capital-improvement functions appear to have processed invoices from at least three vendors — Gulf Standard Contracting LLC, Clearwater Design Collective Inc., and Suncoast Property Services LLC — that may be shell entities created or controlled by VCR personnel, with payments potentially redirected for personal use. These irregularities appear to have occurred during the period from approximately July 2021 through June 2023. The affected properties include the Coral Dune Resort & Residences, located at 14200 Emerald Coast Parkway, Destin, Florida 32541, and the Palmetto Bluff Club, located at 3950 Longboat Key Drive, Sarasota, Florida 34228.
The protocol described in this memorandum is designed to ensure the defensible, comprehensive, and efficient collection, processing, and review of electronically stored information ("ESI") and hard-copy documents relevant to both investigative workstreams. The protocol has been developed in coordination with Triton discovery Solutions Inc. ("Triton"), the e-discovery vendor engaged under the Master Services Agreement dated August 1, 2023, and with input from Crestline Forensic Advisory LLC ("Crestline"), the forensic accounting firm retained under Kovel doctrine to assist in the investigation.
The investigation time period of interest for document collection purposes is January 1, 2021 forward, a date range selected to encompass the full scope of both the revenue-recognition irregularities (Q3 2022–Q2 2023) and the expense-reimbursement irregularities (July 2021–June 2023), as well as a reasonable period of antecedent communications that may provide context for the conduct under investigation. The collection end date is July 24, 2023, the date on which company-wide and VCR-targeted preservation notices were issued to all VHG and VCR employees who may possess or have access to potentially relevant information.
This memorandum should be read in conjunction with the preservation notices issued on July 24, 2023, copies of which are maintained in the investigation files, and the Firm's interim status report to the Audit Committee dated August 3, 2023.
II. E-discovery Vendor
A. Vendor Identification
The Firm has engaged Triton discovery Solutions Inc. ("Triton") as the e-discovery vendor for this investigation. Triton's principal offices are located at 500 Seventh Avenue, 14th Floor, New York, New York 10018. Triton was selected following a competitive evaluation of three qualified vendors, based on Triton's demonstrated capabilities in handling large-scale internal investigations, its SOC 2 Type II–certified hosting infrastructure, its TAR 2.0 continuous active learning platform, and its competitive fee structure relative to the anticipated scope of this engagement.
B. Engagement Terms
Triton was engaged pursuant to a Master Services Agreement ("MSA") dated August 1, 2023, between Calderwood & Harkness LLP and Triton. The MSA governs the terms of Triton's provision of hosting, processing, de-duplication, de-NISTing, TAR 2.0 predictive-coding platform access, production formatting, and related support services. A project-specific Statement of Work ("SOW") was executed concurrently with the MSA, detailing the technical specifications, timelines, and deliverables for this investigation.
C. Estimated Fees
The estimated fees for Triton's services under the SOW are approximately $487,000, which covers the following service categories:
• Hosting of the document population for the anticipated duration of the investigation (estimated at four to six months);
• Processing services, including ingestion, de-duplication, de-NISTing, date and file-type filtering, and metadata extraction;
• TAR 2.0 licensing and continuous active learning platform access;
• Review-platform access for up to 25 concurrent users (including contract review attorneys, Firm attorneys, and authorized Crestline personnel);
• Production formatting, including TIFF conversion, Bates numbering, and load-file generation; and
• Project management and technical support.
These estimated fees are subject to adjustment based on actual data volumes, the duration of the investigation, and any expansion of the document population or production requirements. All Triton fees are included in the total estimated investigation cost discussed in Section XI of this memorandum.
D. Security and Confidentiality
Triton has executed a separate confidentiality undertaking, attached to the MSA as Exhibit B and reproduced in relevant part in Appendix E to this memorandum, acknowledging that all materials collected, processed, hosted, and produced in connection with this investigation are subject to attorney-client privilege and work-product protection. Triton has agreed to the following security measures, among others:
• All investigation data is hosted in Triton's SOC 2 Type II–certified data center facilities, which are subject to annual third-party audits and maintain industry-standard physical and logical access controls, encryption at rest and in transit, intrusion detection systems, and environmental safeguards.
• Access to the investigation data within the Triton platform is restricted to authorized Calderwood & Harkness personnel and authorized Crestline Forensic Advisory LLC personnel, as designated by Calderwood & Harkness in writing. No Triton personnel may access the substantive content of investigation documents except as necessary for technical processing and support, and only under the direction of Calderwood & Harkness.
• Triton will not disclose the existence of the engagement, the identity of the client, or any information relating to the investigation to any third party without the prior written consent of Calderwood & Harkness, except as required by applicable law or court order.
E. Crestline Forensic Advisory Coordination
Crestline Forensic Advisory LLC ("Crestline") was retained by Calderwood & Harkness under the Kovel doctrine, pursuant to an engagement letter dated July 21, 2023, to provide forensic accounting and financial analysis services in support of the investigation. Crestline's engagement is identified by engagement number CFA-VHG-2023-0089. The Crestline engagement team is led by Douglas Reinhardt, CPA, CFF (Managing Director), and Priya Venkatesh, CPA (Senior Manager).
Crestline personnel will have read-only access to financial records, transactional documents, and related materials within the Triton platform, as designated by Calderwood & Harkness. This access is necessary to enable Crestline to perform its forensic analysis of VCR's revenue-recognition practices, accounts-payable transactions, vendor relationships, and general-ledger entries under the direction and supervision of the Firm. All work performed by Crestline in connection with this investigation is undertaken at the direction of counsel and is protected by the attorney-client privilege and work-product doctrine.
III. Custodian Identification and Collection
A. Custodian Identification
Calderwood & Harkness identified eleven (11) custodians whose files are potentially relevant to one or both investigative workstreams. Custodian identification was conducted through the following methodologies:
• Review of VHG and VCR organizational charts, reporting structures, and corporate hierarchy documents provided by VHG's General Counsel, Patricia Navarro;
• Interviews with VHG General Counsel Patricia Navarro and VHG Chief Financial Officer Thomas Rhett Griffith, conducted on July 25 and July 26, 2023, respectively, during which both individuals identified key VCR and VHG personnel involved in the revenue-recognition and accounts-payable functions under investigation;
• Review of the VCR organizational hierarchy, including the reporting lines within the VCR finance department, controller's office, and division president's office;
• Analysis of the preservation-notice recipient lists compiled by VHG's IT department and legal department on July 24, 2023, to confirm coverage of all potentially relevant individuals; and
• Preliminary review of VCR financial records and vendor-management documentation to identify individuals involved in the approval chains for timeshare-interest revenue booking and vendor-invoice processing.
The key custodians identified for this investigation include the following individuals, who are central to one or both investigative workstreams:
Garrett W. Daskine — Division President, Verimark Coastal Resorts LLC. Mr. Daskine is a 17-year veteran of VHG who has served as Division President of VCR since 2018. He has ultimate operational and financial oversight responsibility for all VCR properties, including the Coral Dune Resort & Residences and the Palmetto Bluff Club. Mr. Daskine is a subject of the investigation with respect to both the revenue-recognition and expense-reimbursement workstreams. He was placed on administrative leave, with pay, effective August 7, 2023, at the direction of the Audit Committee.
Nicole Prescott — Vice President of Finance, Verimark Coastal Resorts LLC. Ms. Prescott is a 9-year VHG veteran who reports directly to Mr. Daskine and is responsible for the financial planning, analysis, and reporting functions at VCR, including oversight of the revenue-recognition process for timeshare-interest sales and the preparation of VCR's quarterly financial reports for consolidation into VHG's SEC filings. Ms. Prescott is a subject of the investigation. She was placed on administrative leave, with pay, effective August 7, 2023.
Ryan Mateo Serrano — Controller, Verimark Coastal Resorts LLC. Mr. Serrano is a 5-year VHG veteran who reports to Ms. Prescott and is responsible for VCR's general-ledger maintenance, accounts-payable operations, and vendor-management functions. Mr. Serrano is a subject of the investigation, particularly with respect to the expense-reimbursement workstream. He was placed on administrative leave, with pay, effective August 7, 2023.
Thomas Rhett Griffith — Chief Financial Officer, Verimark Hospitality Group Inc. Mr. Griffith serves as VHG's CFO and is responsible for the oversight and consolidation of financial reporting from all VHG subsidiaries, including VCR. Mr. Griffith is not a subject of the investigation but is a key custodian due to his role in reviewing and certifying VCR financial data for inclusion in VHG's consolidated financial statements and SEC filings.
The remaining custodians include additional VCR finance, operations, and accounting personnel who are directly involved in timeshare sales processing, purchase-order approvals, and vendor management at the Coral Dune Resort & Residences and the Palmetto Bluff Club, as well as selected VHG corporate accounting and internal audit personnel who participate in the consolidation and review of VCR financial data. The full custodian list, including names, titles, departmental affiliations, and the basis for each individual's identification as a custodian, is set forth in Appendix A to this memorandum.
B. Custodians Collected
Of the eleven (11) custodians identified, eight (8) custodians were ultimately selected for collection. The decision to collect from eight rather than all eleven custodians was made following a proportionality and relevance assessment conducted by Liam Donahue and Steven Hollander, in consultation with Howard Quinn, and documented in a collection memorandum dated July 31, 2023.
Three custodians were excluded from the initial collection based on the assessment that their roles — which were limited to administrative support and facilities management at VCR properties — were unlikely to yield material, non-duplicative evidence beyond what would be captured from the eight collected custodians. Specifically, the excluded custodians occupied positions with no direct involvement in financial reporting, revenue recognition, vendor selection, purchase-order approval, or invoice processing. Additionally, any communications between the excluded custodians and the investigation subjects or other collected custodians would be captured in the mailboxes of the collected custodians, further reducing the marginal informational value of collecting from the excluded individuals.
These collection decisions have been documented in the investigation files, and the Firm retains the ability to revisit and expand the custodian collection if the investigation scope expands, if witness interviews reveal additional areas of concern, or if the forensic accounting analysis identifies additional individuals whose files warrant collection.
C. Data Sources Collected
The following categories of data sources were collected from the eight collected custodians and relevant non-custodial sources:
Email. Ashgrove Software / Exchange mailboxes for all eight collected custodians were collected in full, including sent items, received items, drafts, deleted items (to the extent recoverable), archived folders, and any journal or retention-policy archives maintained by VHG's IT department. The collection period for email data is January 1, 2021 through July 24, 2023. Collection was performed using Triton's forensic collection tool, which captures mailbox data in a forensically sound manner with full metadata preservation.
File Shares and Network Drives. The following shared network locations were collected:
• VCR shared drives maintained on VHG's file server infrastructure, including the finance department shared folder, the controller's office shared folder, and the division president's office shared folder;
• VHG corporate finance shared folders relating to VCR consolidation, including quarterly close workpapers, intercompany reconciliation files, and budget-to-actual variance analyses; and
• Individual user directories (home drives) for the three investigation subjects (Daskine, Prescott, and Serrano).
Financial Systems. Structured data exports were obtained from VHG's enterprise resource planning ("ERP") system (Northgate Solutions), covering VCR-specific data including purchase orders, vendor master files, accounts payable records, general-ledger entries, and the revenue-recognition subledger for timeshare-interest sales. These exports were performed by VHG's IT department under the supervision of Triton and Calderwood & Harkness, and the resulting data files were ingested into the Triton platform for review.
Hard-Copy Documents. VCR's Destin office maintained certain hard-copy records relevant to the investigation, including executed vendor contracts, original invoices, capital-improvement budget binders, and property-specific financial files. These hard-copy documents were identified during a site visit conducted by Steven Hollander and a Triton collection specialist on July 28, 2023, and were subsequently imaged (scanned to TIFF with OCR text extraction) for ingestion into the Triton platform. Chain-of-custody documentation was maintained for all hard-copy materials, and the original documents were returned to secure storage at VCR's Destin office following imaging.
Mobile Devices. Company-issued mobile devices for the three investigation subjects — Garrett W. Daskine, Nicole Prescott, and Ryan Mateo Serrano — were collected on August 7, 2023, concurrent with the commencement of their administrative leave. Forensic images of the devices were created by Triton using Drayton Technologies technology. The collected data includes text messages (SMS and Westmark Software), messaging-application data (including Northgate Data Systems mobile and Meridian Services Inc., where present), call logs, and photographs. The mobile-device data was processed and ingested into the Triton platform in a separate data set for review.
Personal Devices and Accounts. Personal devices and personal email or messaging accounts of any custodian have not been collected at this stage. The Firm has determined that the collection of personal devices and accounts is not warranted at this time based on the currently available information. However, this determination is subject to further assessment if witness interviews, forensic analysis, or other investigative findings indicate that relevant communications or documents may reside on personal devices or in personal accounts. The Firm will revisit this issue and document any supplemental collection decisions in a subsequent memorandum.
D. Collection Volume
The total volume of documents collected across all data sources is approximately 1.2 million documents, inclusive of emails, email attachments, standalone electronic files from network drives and file shares, structured data exports from the ERP system, imaged hard-copy documents (vendor contracts, invoices, and budget binders), and mobile-device content (text messages and messaging-application data).
Collection was performed by Triton in coordination with VHG's IT department, under the supervision of Calderwood & Harkness. All collections were conducted using forensically sound methodologies, and chain-of-custody documentation was maintained for each collection event. A detailed collection log, including dates, times, data sources, collection methodologies, and the identity of the collecting personnel, is maintained in the Triton platform and in the investigation files.
IV. Processing and Culling
Following collection, Triton processed the approximately 1.2 million collected documents through a series of automated and semi-automated culling steps designed to reduce the document population to a manageable review set while preserving all potentially relevant materials. The processing steps are described below.
A. De-Duplication. Triton performed global de-duplication across all custodian data sets using MD5 hash values at the family level. Under this approach, each parent email and its associated attachments are treated as a single "family unit," and the MD5 hash value is computed for the family as a whole. Exact-duplicate families — i.e., families with identical MD5 hash values appearing in the data sets of multiple custodians — were suppressed, with the earliest-dated instance of each unique family retained in the review population. All custodians who possessed a copy of each unique document family are mapped to that family in the Triton platform, enabling custodian-overlap tracking without the need to retain and review multiple identical copies of the same document.
This global de-duplication approach is appropriate for an internal investigation of this nature, where the goal is to review each unique document once while maintaining the ability to track which custodians possessed the document. Global de-duplication also provides significant cost savings by eliminating redundant review of identical documents.
B. De-NISTing. Triton applied the National Institute of Standards and Technology ("NIST") National Software Reference Library ("NSRL") hash list to the collected data to identify and exclude known system files, application files, and other non-user-generated content. This process, commonly referred to as "de-NISTing," removes files such as operating system components, software installers, help files, default templates, and other standard application files that have no evidentiary value in an investigation context. The NSRL hash list used for this purpose was the most current version available as of the date of processing (Version 3.76, released June 2023).
C. Date Filtering
Documents bearing creation dates, last-modified dates, or sent/received dates outside the collection date range — i.e., prior to January 1, 2021 or after July 24, 2023 — were filtered out of the review population. An exception was made for email threads in which the thread as a whole (i.e., the most recent message in the chain) falls within the date range but the thread contains earlier messages with dates prior to January 1, 2021. In those cases, the entire email chain was retained to preserve thread integrity and context. This exception ensures that responsive communications within the date range are not severed from their conversational context.
D. File-Type Filtering
Certain known non-responsive file types were segregated from the primary review population and designated for secondary review only if flagged by the application of search terms. The file types subject to this filtering include:
• Calendar entries (ICS files and Outlook calendar items) with no substantive body text or attachments;
• Voicemail notification stubs (email notifications generated by VHG's voicemail-to-email system containing only metadata and no audio content);
• Automated system alerts, including server health notifications, backup confirmations, and system-generated security alerts; and
• Application log files and system-generated temporary files.
These file types were identified through a preliminary sampling analysis conducted by Triton as part of the initial processing workflow. Documents of these types that are flagged by the application of search terms will be promoted to the primary review population for manual review.
E. Post-Processing Volume
After the application of de-duplication, de-NISTing, date filtering, and file-type filtering, the document universe was reduced from approximately 1.2 million documents to approximately 620,000 documents available for search-term application and TAR-based culling. This represents a reduction of approximately 48% from the raw collection volume, which is within the expected range for a collection of this size and composition. The 620,000-document post-processing universe constitutes the population to which the search-term protocol and TAR 2.0 methodology described in Sections V and VI below were applied.
V. Search-Term Protocol
A. Development of Search Terms
The search-term protocol for this investigation was developed by Liam Donahue and Steven Hollander, in consultation with Howard Quinn and with input from the forensic accounting team at Crestline Forensic Advisory LLC, specifically Douglas Reinhardt and Priya Venkatesh. The search terms were designed to identify documents relating to both investigative workstreams — the revenue-recognition irregularities and the expense-reimbursement irregularities — while balancing the competing objectives of precision (minimizing false positives) and recall (minimizing false negatives).
The search-term development process involved the following steps:
1. Identification of key concepts, entities, individuals, transactions, and terminology relevant to each investigative workstream, based on the Firm's preliminary understanding of the facts as developed through initial interviews with VHG management, review of VCR organizational documents, and Crestline's preliminary analysis of VCR financial data;
2. Translation of those key concepts into specific search terms and search-term combinations, incorporating known terminology used within VCR's finance and operations departments, relevant statutory and accounting-standards references, property names and addresses, vendor names and identifiers, and other terms of art;
3. Application of Boolean connectors and proximity operators to refine search-term combinations and reduce over-inclusiveness; and
4. Validation of the search terms through a search-term testing exercise on a random sample of 500 documents from the post-processing universe, as described in Section V.D below.
The complete search-term list, including all Boolean syntax and proximity operators, is set forth in Appendix B to this memorandum. The following subsections summarize the principal categories of search terms organized by investigative workstream.
B. Revenue-Recognition Workstream Terms
The search terms developed for the revenue-recognition workstream are designed to capture documents relating to the premature recognition of timeshare-interest deposits, rescission-period practices at VCR properties, and related financial-reporting issues. The principal categories of terms include:
• Timeshare deposit terminology: "timeshare deposit" and "timeshare deposits," "rescission," "rescission period," "10-day," "ten-day," "ten day," "Florida 721," and "§ 721.10" (referencing the Florida Vacation Plan and Timesharing Act's mandatory rescission period for timeshare purchasers);
• Revenue-recognition terminology: "revenue recognition," "completed sale," "booking" and "booked revenue," and variations thereof, designed to capture communications discussing the timing and criteria for recognizing timeshare-interest revenue;
• Property-specific terms: "Coral Dune," "Palmetto Bluff," "Phase II," and "Phase III," referencing the specific properties and development phases at which the revenue-recognition irregularities are believed to have occurred;
• Financial-reporting and close-process terms: "quarterly close," "quarter-end," "quarter end," "revenue target," and "revenue adjustment," designed to capture communications relating to quarter-end revenue-recognition decisions and potential pressure to meet revenue targets;
• Accounting-standards terms: "ASC 606," "performance obligation," and related terms referencing the applicable accounting standards for revenue recognition; and
• Custodian-specific combinations: Combinations of key custodian surnames (e.g., "Daskine," "Prescott," "Serrano") with the financial terms described above, using proximity operators to capture documents in which custodian names appear in close proximity to revenue-recognition terminology.
C. Expense-Reimbursement Workstream Terms
The search terms developed for the expense-reimbursement workstream are designed to capture documents relating to the fictitious vendor invoices, the potentially shell entities used to submit those invoices, and related personal-expense concealment. The principal categories of terms include:
• Vendor entity names and abbreviations: "Gulf Standard," "Gulf Standard Contracting," "GSC," "Clearwater Design," "Clearwater Design Collective," "CDC," "Suncoast Property," "Suncoast Property Services," and "SPS" — the three vendors identified in the preliminary investigation as potentially fictitious or shell entities;
• Capital-improvement and procurement terminology: "capital improvement," "renovation," "lobby renovation," "purchase order," "PO," and related terms capturing the types of expenditures through which fictitious invoices were submitted;
• Vendor-management terminology: "vendor approval," "new vendor," "vendor setup," and related terms designed to identify communications relating to the onboarding and approval of the suspect vendors;
• Specific invoice identifiers: Known invoice numbers and invoice-number ranges (e.g., "GSC-2023-007"), based on invoices already identified by Crestline in its preliminary review of VCR accounts-payable data;
• Custodian-specific combinations: Combinations of investigation-subject surnames ("Daskine," "Prescott," "Serrano") with vendor and expense terms, using proximity operators;
• Corporate-formation and registration terms: "Panhandle Agent," "registered agent," and related terms that may appear in documents relating to the formation and registration of the suspect vendor entities in Florida;
• Personal-benefit indicators: "312 Harbor View" (the personal residence address of Garrett W. Daskine), "boat slip," and "marina," which are included based on preliminary indications from Crestline's analysis that certain payments to suspect vendors may have been redirected toward personal expenditures by Mr. Daskine, including renovations at his personal residence and marina-related expenses; and
• Related terms and variations of the foregoing, as set forth in full in Appendix B.
D. Boolean Connectors and Proximity Operators
The search terms described above employ Boolean connectors (AND, OR, NOT) and proximity operators (w/5 and w/10, indicating that specified terms must appear within five or ten words of each other, respectively) to achieve an appropriate balance between precision and recall. The use of proximity operators is particularly important for search-term combinations involving custodian surnames and subject-matter terminology, where a simple AND connector would generate an unacceptably high number of false-positive hits by capturing documents in which the terms appear in unrelated portions of a lengthy document.
A search-term validation exercise was conducted prior to the full application of the search-term protocol. A random sample of 500 documents from the post-processing universe was run against the proposed search terms, and the results were manually reviewed by Liam Donahue and Steven Hollander to assess the precision and recall of each term and term combination. Based on the results of this validation exercise, certain overly broad terms were narrowed (e.g., the standalone term "booking" was restricted to a proximity search with revenue-related terms to avoid false hits on hotel-booking and reservation-related documents), and certain terms that failed to capture known-relevant documents were expanded. The final search-term list reflects these refinements and is set forth in Appendix B.
VI. Technology-Assisted Review (TAR) 2.0 Protocol
A. Selection of TAR 2.0 (Continuous Active Learning)
The investigation team selected a TAR 2.0 continuous active learning ("CAL") methodology for the document review, rather than a TAR 1.0 simple passive learning methodology (also referred to as a "seed-set" approach). This decision was based on the following considerations:
(1) Volume. The post-processing document universe of approximately 620,000 documents is sufficiently large that a TAR-assisted approach offers significant efficiency and cost advantages over a purely manual linear review, while the two-stage nature of TAR 2.0 (in which the algorithm continuously retrains based on reviewer coding decisions) allows for a more responsive and adaptive model than TAR 1.0.
(2) Multi-faceted investigation. The investigation encompasses two distinct workstreams — revenue recognition and expense reimbursement — with meaningfully different document characteristics, vocabulary, and custodian-concentration profiles. TAR 2.0's continuous active learning approach is better suited to investigations with multiple issue categories because the model adapts in real time to the characteristics of documents coded across different issue areas, whereas TAR 1.0 relies on a fixed seed set that may not adequately represent the diversity of relevant documents across multiple workstreams.
(3) No fixed control set required. TAR 2.0 does not require the construction and coding of a fixed control set at the outset of the review, which is a significant advantage in the context of an internal investigation where the scope of relevant issues may evolve as the investigation progresses. TAR 2.0 allows the investigation team to begin review immediately using judgmental sampling and to refine the model continuously as additional documents are coded.
(4) Prioritized review. TAR 2.0 continuously ranks the unreviewed document population by predicted relevance, allowing reviewers to prioritize the review of documents most likely to be relevant. This prioritization enables the investigation team to gain early insight into the key documents and issues, which is particularly valuable in an investigation context where the Audit Committee has requested regular interim status reports.
The TAR 2.0 platform used for this investigation is hosted and operated by Triton discovery Solutions Inc. and is integrated into Triton's Relativity-based review environment. The platform's continuous active learning engine employs a logistic regression classifier that retrains after each batch of coded documents to update the relevance scores for all unreviewed documents.
B. Training and Workflow
The TAR 2.0 training and review workflow was structured as follows:
Subject-Matter Expert ("SME") Reviewers. Liam Donahue and Steven Hollander served as the primary subject-matter expert reviewers for the training phase of the TAR 2.0 workflow. Both attorneys have extensive familiarity with the factual background of the investigation, the key custodians and entities, the relevant accounting standards and statutory provisions, and the document types likely to be encountered in the review. Howard Quinn and Conrad Ashby provided spot-check oversight of the SME reviewers' coding decisions during the training phase to ensure consistency and accuracy.
Initial Training Round. The first 200 documents for the initial training round were selected through judgmental sampling from the search-term hit population — i.e., from the subset of documents within the 620,000-document post-processing universe that were flagged by one or more of the search terms described in Section V. This judgmental sampling approach ensured that the initial training set included a meaningful proportion of potentially relevant documents, providing the TAR 2.0 algorithm with a sufficient foundation of positive examples to begin building a predictive model. The 200 initial training documents were coded by Liam Donahue and Steven Hollander along two dimensions:
• Relevance coding: Each document was coded as Relevant or Not Relevant, based on whether the document was responsive to one or both investigative workstreams.
• Issue coding: Each document coded as Relevant was further coded to one or more of the following issue categories: Revenue Recognition; Expense Irregularity; Both; Privileged; and Other.
Continuous Active Learning Iterations. Following the completion of the initial 200-document training round, the TAR 2.0 algorithm assigned predicted relevance scores to all remaining unreviewed documents in the 620,000-document universe and ranked them in descending order of predicted relevance. Reviewers then coded documents in ranked order, working from the highest-scored documents downward. After each batch of newly coded documents (batch sizes ranged from 50 to 200 documents depending on the stage of the review), the algorithm retrained using the full set of all documents coded to date and updated the relevance scores for all remaining unreviewed documents. This iterative cycle of coding, retraining, and re-ranking continued throughout the review, with the model's predictive accuracy improving with each iteration as the volume of training data grew.
Dual-Issue Coding. As noted above, documents were coded to one or both investigative workstreams (Revenue Recognition and/or Expense Irregularity). This dual-issue coding enables the investigation team to analyze the revenue-recognition and expense-reimbursement document populations separately, facilitating the preparation of workstream-specific analysis for inclusion in the Firm's reports to the Audit Committee and for use by Crestline in its forensic accounting analysis.
Privilege Screening. In addition to the relevance and issue-coding described above, a separate privilege-prediction layer was applied within the TAR 2.0 platform to flag documents potentially containing communications protected by the attorney-client privilege or the work-product doctrine. This privilege-prediction layer was trained on a seed set of known-privileged and known-non-privileged documents identified during the initial training round, and it assigns a privilege-prediction score to each document in the review population. Documents flagged by the privilege-prediction layer as potentially privileged — i.e., those receiving a privilege-prediction score above a designated threshold — were automatically routed to a dedicated privilege-review queue. All documents in the privilege-review queue were reviewed and coded by Liam Donahue, who has primary responsibility for privilege determinations in this investigation.
C. Review Population
Following the application of the search-term protocol and TAR 2.0 prioritization, the total number of documents reviewed (i.e., subjected to manual coding by human reviewers) was approximately 347,000 documents. This represents approximately 56% of the 620,000-document post-processing universe. The remaining documents — those that received relevance scores below the TAR relevance-score threshold established through the quality-control procedures described in Section VII — were excluded from full manual review after validation through statistical sampling, as described below.
The 347,000-document review population encompasses the full range of document types collected in this investigation, including email communications, standalone electronic documents, financial records, structured data exports, imaged hard-copy documents, and mobile-device content.
D. Review Team
First-Level Review. First-level review of the 347,000-document review population was conducted by a team of contract review attorneys engaged through Triton's managed-review services. The contract review team consisted of six attorneys, all of whom are licensed to practice law in at least one U.S. jurisdiction and have significant prior experience in document review for internal investigations and regulatory matters. The contract review team was supervised by Steven Hollander, who conducted daily quality-check reviews, answered coding questions, and resolved escalated documents.
Second-Level Review. All coding decisions made by first-level reviewers on documents from the files of the three key custodians — Garrett W. Daskine, Nicole Prescott, and Ryan Mateo Serrano — were subject to mandatory second-level review by Liam Donahue. Additionally, all documents coded as "Needs Further Review" by first-level reviewers were escalated to Liam Donahue or Steven Hollander for disposition.
Reviewer Training. All members of the review team, including contract review attorneys, received comprehensive training prior to commencing review. The training session, conducted by Liam Donahue and Steven Hollander on August 10, 2023, covered the following topics:
• Factual background of the investigation, including the two investigative workstreams, the key custodians and entities, the relevant properties, and the time periods of interest;
• Coding protocols, including the relevance-coding taxonomy, issue-coding tags, privilege tags, and confidentiality designations described in Section VIII of this memorandum;
• Upjohn considerations, including the importance of identifying and preserving communications reflecting Upjohn warnings delivered to investigation subjects and VHG employees during witness interviews;
• Privilege-identification criteria, including the criteria for identifying communications protected by the attorney-client privilege, the work-product doctrine, and the joint-defense or common-interest privilege; and
• Platform training, including instruction on the use of the Triton review platform, coding interfaces, search functionality, and document-family navigation tools.
A copy of the training materials and coding manual distributed to the review team is maintained in the investigation files and is referenced in Appendix D to this memorandum.
VII. Quality Control and Validation
The Firm implemented a multi-layered quality-control and validation program to ensure the accuracy and defensibility of the TAR 2.0 review. The key components of this program are described below.
A. Elusion Testing
Upon stabilization of the TAR 2.0 model — defined as the point at which fewer than 5% of newly reviewed documents in a given coding batch were coded as Relevant by the reviewers — an elusion test was performed to validate the model's performance. The elusion test was designed and overseen by Liam Donahue in consultation with Triton's TAR analytics team.
The elusion test was conducted as follows: a statistically significant random sample was drawn from the documents that received relevance scores below the TAR relevance-score threshold — i.e., the documents in the "discard" or "not-reviewed" set that were excluded from full manual review based on their low predicted relevance. The sample size was calculated to achieve a 95% confidence level with a margin of error of ±2%. The sampled documents were manually reviewed by Liam Donahue and Steven Hollander (the SME reviewers) to determine whether each document was in fact relevant or not relevant.
The purpose of the elusion test is to estimate the rate of relevant documents remaining in the unreviewed population — i.e., the "elusion rate." The target elusion rate for this investigation is 3% or less, meaning that no more than 3% of the documents in the unreviewed set would be expected to be relevant. An elusion rate at or below this target confirms that the TAR 2.0 model has achieved a sufficient level of accuracy to support the decision to exclude the below-threshold documents from manual review. The actual elusion rate achieved will be documented upon completion of the review and reported to the Audit Committee in the Firm's final investigation report.
B. Recall Estimation
Recall — the proportion of all relevant documents in the collection that were identified and reviewed by the investigation team — was estimated based on the results of the elusion test and the number of relevant documents identified during the review. Specifically, recall is calculated by dividing the number of relevant documents identified in the review by the sum of (a) the number of relevant documents identified in the review and (b) the estimated number of relevant documents remaining in the unreviewed set (as derived from the elusion rate).
The target recall rate for this investigation is 85% or greater, consistent with the recall rates accepted by courts and commentators as reasonable for technology-assisted review in the context of litigation and investigations. The actual recall rate achieved will be documented and reported alongside the elusion-test results.
C. Richness Assessment
Document richness — the proportion of the overall document collection (or a defined subset thereof) that is relevant — was tracked throughout the review to calibrate expectations for review volume, cost, and timeline. Richness was measured at multiple stages: (1) an initial estimate based on the results of the judgmental sampling used for the first 200-document training round, (2) updated estimates based on the coding results from the continuous active learning iterations, and (3) a final richness assessment based on the combined results of the full review and the elusion test.
Richness tracking also served as an input for cost and budget management, as the total volume of relevant documents directly affects the time and expense required for second-level review, privilege review, and potential production.
D. Inter-Reviewer Agreement
To ensure consistency in coding across the review team, a random sample of documents coded by first-level contract review attorneys was independently re-coded by Liam Donahue or Steven Hollander. The inter-reviewer agreement rate was calculated as the percentage of sampled documents on which the first-level reviewer's relevance coding (Relevant or Not Relevant) agreed with the SME reviewer's independent coding of the same document.
The target inter-reviewer agreement rate for this investigation is 90% or greater. Where disagreements were identified, the SME reviewer's coding determination was treated as the correct coding, and the disagreement was analyzed to identify potential patterns (e.g., specific document types or issue areas generating disproportionate disagreement). Coding guidance was provided to the review team as needed to address any identified patterns of inconsistency.
E. Privilege QC
All documents coded by first-level reviewers as potentially privileged — whether through the privilege-prediction layer, manual coding, or both — were subject to mandatory second-level review by Liam Donahue. This second-level privilege review is a critical quality-control safeguard designed to minimize the risk of inadvertent privilege waiver, particularly in the event that documents are produced to the SEC or other regulatory bodies.
Documents confirmed as privileged upon second-level review were withheld from any production set and either fully withheld or redacted, depending on the nature and extent of the privileged content within each document. All withheld or redacted documents were logged on the investigation privilege log, which identifies the document by Bates number (or document-control number), date, author, recipient(s), document type, and the basis for the privilege assertion (attorney-client privilege, work product, or both).
As of the close of the investigation on January 9, 2024, 4,218 documents were withheld or redacted on the basis of attorney-client privilege and/or work-product protection and catalogued on the final privilege log dated December 22, 2023. The privilege log is maintained in the investigation files and is available for production to any court or regulatory body as required.
VIII. Document Coding and Issue Tagging Taxonomy
The following coding taxonomy was applied to all documents reviewed in the investigation. The taxonomy was designed to facilitate both the investigation team's analysis of the document population and the potential production of documents to the SEC or other regulatory bodies.
A. Relevance Coding
All documents in the review population were coded to one of the following three relevance designations:
• Relevant — The document is responsive to one or both investigative workstreams and contains information that is material to the investigation. Documents coded as Relevant were further coded to one or more issue tags, as described in Section VIII.B below.
• Not Relevant — The document is not responsive to either investigative workstream and does not contain information material to the investigation. Documents coded as Not Relevant were excluded from further review and analysis, subject to quality-control sampling as described in Section VII.
• Needs Further Review — The document could not be definitively coded as Relevant or Not Relevant by the first-level reviewer due to ambiguity, complexity, or the need for additional context. Documents coded as Needs Further Review were escalated to an SME reviewer (Liam Donahue or Steven Hollander) for disposition.
B. Issue Tags
Documents coded as Relevant were further tagged with one or more of the following issue codes, which correspond to the key subject-matter categories of the investigation:
• Revenue Recognition — Documents relating to timeshare-interest deposit recognition, rescission-period timing, quarterly revenue adjustments, ASC 606 compliance, financial-reporting disclosures for timeshare-interest revenue, and related communications among VCR and VHG personnel regarding the timing and criteria for recognizing timeshare-interest sales revenue.
• Expense Irregularity — Documents relating to purchase orders, vendor invoices, payments to Gulf Standard Contracting LLC, Clearwater Design Collective Inc., or Suncoast Property Services LLC, capital-improvement budgets and expenditures at Coral Dune Resort & Residences and Palmetto Bluff Club, the creation or management of potentially fictitious vendor entities, and the concealment of personal expenses as legitimate business expenditures.
• Internal Controls — Documents relating to VCR or VHG internal controls over financial reporting, including Sarbanes-Oxley Act Sections 302 and 404 compliance, management certifications, internal-controls testing, deficiency assessments, and related communications with management and the Audit Committee.
• Auditor Communications — Correspondence and other communications with VHG's independent registered public accounting firm, Hargrove, Steen & Aldrich LLP ("HSA"), including management representation letters, audit planning materials, audit inquiries, and any communications relating to VCR's revenue-recognition practices or expense-reimbursement processes.
• Regulatory — Documents relating to VHG's filings with the U.S. Securities and Exchange Commission, disclosure obligations under the Securities Exchange Act of 1934, Regulation S-K, and other applicable securities laws and regulations, or any communications relating to regulatory inquiries or investigations.
• Personnel — Documents relating to the employment, compensation, performance evaluations, or disciplinary history of the three investigation subjects (Daskine, Prescott, and Serrano), as well as any other VCR or VHG personnel whose employment status is relevant to the investigation.
Documents may be coded to multiple issue tags where appropriate (e.g., a document relating to both the timing of timeshare-deposit recognition and internal-controls deficiencies would be tagged with both "Revenue Recognition" and "Internal Controls").
C. Privilege Tags
All documents were assessed for privilege and coded to one of the following privilege designations:
• Attorney-Client Privilege — Communications between VHG or VCR personnel and their legal counsel (whether in-house or outside counsel) made for the purpose of seeking or providing legal advice, and documents reflecting the substance of such communications.
• Work Product — Documents prepared by or at the direction of an attorney in anticipation of litigation or for the purpose of providing legal advice, including legal memoranda, attorney notes, litigation strategies, and investigation work papers.
• Joint Defense / Common Interest — Communications shared between VHG and co-parties or their respective counsel under a joint-defense or common-interest agreement, where applicable.
• Not Privileged — Business Communication — Documents that do not fall within any applicable privilege or protection. This designation was applied to the vast majority of documents in the review population.
D. Confidentiality Designations
All documents hosted in the Triton review platform are treated as confidential investigation materials, subject to the security and access-control measures described in Section II.D of this memorandum. In addition, the following supplemental confidentiality designations were applied to specific categories of documents as warranted:
• PII — Documents containing personally identifiable information of VHG or VCR employees, customers, or third parties, including Social Security numbers, financial account numbers, and other sensitive personal data. Documents bearing this designation are subject to enhanced access restrictions and redaction requirements for any production.
• Third-Party Confidential — Documents containing confidential business information of third parties, including vendor pricing, contractual terms, and proprietary financial data. Documents bearing this designation may require notification to or consent from the relevant third party prior to production, depending on the applicable contractual and legal requirements.
IX. Production and Export Protocols
A. Internal Production to Crestline
Relevant financial records, transactional documents, purchase orders, invoices, vendor-related communications, and other documents identified as pertinent to Crestline's forensic accounting analysis are produced to Crestline Forensic Advisory LLC on a rolling basis via secure export from the Triton platform. All documents produced to Crestline are subject to privilege screening prior to export; no document coded as privileged or potentially privileged is included in any production to Crestline until the privilege determination has been finalized through the second-level privilege review described in Section VII.E.
The production format for the Crestline production is as follows:
• Native files: Where feasible, documents are produced to Crestline in their native file format (e.g., Excel spreadsheets, PDF documents, and Word documents), which enables Crestline to perform its forensic analysis using the documents' embedded data, formulas, and metadata.
• TIFF images with extracted text and metadata: Email messages and their associated attachments are produced as TIFF images, accompanied by extracted text files and metadata load files (in Ashgrove Technologies DAT format), to facilitate review and integration into Crestline's analysis workpapers.
Crestline's access to investigation documents is limited to read-only access within the Triton platform and the documents produced to Crestline via the secure-export process described above. Crestline is not authorized to further disseminate or produce investigation documents to any third party without the prior written authorization of Calderwood & Harkness.
B. Potential External Productions