Data Forensics

Extension of time

Nils Hanfstingl, Senior Director and Thomas Hofbauer, Senior Managing Director, FTI Consulting 

How efficient data forensics establish the base to fill the evidence gaps

IN claim and dispute situations we often find ourselves in front of large amounts of documentation. Despite this, the specific information we need (or seek), is often the famous ‘needle in a haystack’. Even with sophisticated software solutions, valuable industry guidance and availability of experienced external consultancy, storing documentation the right way to manage claim and dispute situations often fails. After all, live projects are structured for the successful completion of a project, meaning that preserving information doesn’t necessarily fulfil evidence requirements during claims and disputes.

To ensure an efficient and successful resolution of the issues, and to understand project delays and deal with extension of time claims, it is necessary to utilise the documentation produced by the parties during a project regardless of structure or accessibility.

With the continued emergence of digital data forensics, masses of information can be structured, filtered, and reduced down to the factual evidence needed to manage a case efficiently. Leveraging these capabilities then not only improves a party’s position in terms of strategy and risk, but also ensures a factual approach to dealing with delays and extension of time, which benefits all involved parties.


Figure 1: Various types of evidence sources.

Several of these capabilities are addressed in the following in the context of common project scenarios which can often lead to opposing views on delay responsibilities and, ultimately, disputes.

Extension of time basics

Simply put, extension of time describes the scenario where a contractor is requesting the change of the agreed completion of the project due to reasons outside of their risk sphere. If granted, this would enable the contractor to finish later than originally agreed, without being liable to pay liquidated or delay damages (depending on the contractual provisions).

From a customer’s view, an extension of time provision means that a defined shift of the project completion is agreed upon, which provides clarity on the new forecasted completion and defines a reasonable time for the contractor to finish after the delaying events occurred. In that regard, the high financial stakes usually result in situations where the delay can result in substantial cost overruns for contractors and customers, especially in large and complex projects.

On that note and depending on the circumstances, extension of time can also mean that the contractor is entitled to be compensated for the cost incurred due to the delay. Naturally, this potential delay compensation places a high burden on the contractor to prove the cause of delay is not in his own risk sphere.

Besides the financial and legal implications, the involvement of other stakeholders, such as lenders and end-product user groups, further complicate the negotiating of extension of time. This often results in an inefficient and expensive process attempting to prove or disprove causal responsibility.


Figure 2: Closing the gap between evidence sources.

Extension of time, a quest for causality

To prove a claim for extension of time, the key question all must answer is causality. Only the demonstration of a factually supported causal chain enables the customer to grant such claim and relieve the contractor from his duty to finish as agreed.

The complexity to collect and demonstrate facts which substantiate the causal chain with clear evidence has led to the following trend:

Naturally, this gap between contractor and customer often results in severe disputes. When the parties end up in a formalised dispute such as litigation and arbitration, it is common to involve the work of expert witnesses for delay and quantum questions to elaborate on delays, potential extension of time and any respective compensation entitlement. The main objective during these proceedings remains the same. To prove causality from the facts within the project documentation.

We emphasise that time schedules are also considered part of the complete documentation, meaning that any type of contemporaneous information (including the time schedules) represents potential evidence for the demonstration of causality. To establish the root cause of project delays, as agreed across the industry, the full set of project documentation is the most important aspect when analysing delays and demonstrating causality. There is, however, a gap between available documentation and relevant evidence. This article provides a practical insight into the various data forensic methods to overcome the evidence gap by introducing efficient IT-supported methods to coalesce the various sets of project documentation.

Practical problems when analysing the complete documentation

Missing documentation within engineering and construction projects has been a problem of the past. This has included:

Setting aside legal relevance, the following two common examples during distressed projects demonstrate how information sources, such as those in Figure 1, represent different views on circumstances and events during the same period. To provide further understanding from a forensic perspective, the documents are separated in two different document types ‘mass’ and ‘single’.

Mass describes documents which, by their nature, appear in large number and with repetitive content structure. Assessing these document types usually requires substantial time and experienced resources that can identify key evidence within huge amounts of information.

Single describes documents which by themselves clearly address issues, by, for example, means of official contractual letters or unambiguous reporting. The reader or analyst is usually able to understand the content of these documents clearly. These single documents often follow events which are recorded in the ‘mass’ documents.

Example 1 – Construction delay


Table 1: Example 1 - Construction delay.


The table above (Table 1) shows an apparently clear case from a construction point of view. By means of official correspondence (letter), it was claimed that missing engineering documents would possibly hinder the works on-site in the future. This was supported by the contemporaneous time schedule and the fact witness statement.

The evidence found within the construction site documentation indicates an entirely different situation. The information sources ‘daily reports’, ‘picture evidence’ and ‘time logs’ show that at least on this day, the disruption on site was caused by work quality issues and suggest that this was a reoccurring issue. As simple as this example might appear, the information sources which provided key evidence against the official letter are all ‘mass’ documents. Meaning that they exist in abundance during projects.

Depending on the project duration, reading all the daily reports can be immensely time-consuming, likewise screening all pictures and gaining efficient access to time log data. This is one example, where causality was not as clear as it might be suggested. If quality issues were in fact an ongoing problem, based on the probability of having identified three data points which disprove the official letter, it can be expected that the parties would not have agreed on an extension of time easily.

Example 2 – Engineering delay


Table 2: Example 2 - Engineering delay.

The scenario above (Table 2) is reasonably common during engineering, procurement, and construction projects (EPC), where the substantial responsibility and risk lies with the contractor to design and build the project on time. Often the contractual provisions ensure the involvement of the customers for the alignment and control of the engineering.

Besides ensuring availability of the customer in case of technical queries this often results in complex discussions between project participants from both sides. As shown in the table below, there is a severe disparity between the information and instruction received directly between participants (off-record) and the official submission with all participants involved. This, of course, results in a difficult situation for the contractor.

The official correspondence demands the contractor to proceed with the design as proposed, whereas the off-record email clearly states that this would not be approved. It can be assumed that proceeding with the work within his risk sphere, which will effectively not be approved, is the least favourable situation for the contractor. This is also reflected by the changes identified within the design documents (e.g. drawings) as well as the minutes of the meeting.

With the customer’s letter stating that engineering progress is concerning as documents are repeatedly revised, the contractor’s situation becomes even more complicated. Not only is the contractor trying to fulfil ‘off-record instructions’, but the customer is also ensuring that communication reserves their future options with by indicating contractor’s lack of progress and quality. From an evidence collection perspective, this potentially represents a difficult situation.

In case the off-record mails were not stored or flagged by the respective engineer, this person is of utmost importance for the proceedings to point out such mail correspondence. However, if it is not available anymore, this crucial information is difficult to obtain.

Under these circumstances only the application of forensic investigation methods and tools would enable an efficient search for evidence within standalone email accounts. Investigating the complete mail folder in combination with information identified within minutes of meetings and engineering documents can be a difference-maker when using IT to support the search for evidence in cases like this.

How data forensics support scenarios like these

The examples in Figure 2 show that key evidence is often found within the document types where evidence collection is most difficult. On that note, it should be emphasised that this is not considering the legal relevance of certain documents. Still, when analysing the root cause for delays, respectively extension of time, all evidence must be considered by project teams or external expert analysts to understand the situation based on facts.

The following introduction of data forensic methods should be understood as a combination of tools and methods, as, until now, the complexity of the work has prevented the availability of one, single solution. It must be emphasised that each data forensic approach must be flexible enough to adjust to specific cases and provide the possibility to combine different methods and strategies. The data forensic strategy must always be adjusted to reflect the requirements set out by the data content and quality.

Extraction and combination of key information

For the assessment of the contemporaneous project situation, it is often necessary to combine data from different sources. Data extraction methods combined with tailored combination codes enable the connection of key data points, such as progress information in various reports from different trades and contractors.

One practical example is the automated extraction of manpower-related information obtained from each trades reporting, which is then combined to form one complete database. Depending on the project size, this task can automatically process thousands of documents to heighten the efficiency of the assessment.

Transparency and searchability

If key-knowledge carriers are not available or the documentation is too extensive, virtual review environments enable efficient and collaborative casework for parties, legal teams, and experts. The range of forensic review tools which provide a searchable and transparent data set of documentation varies. Running from case specific customised programs as well as large scale e-discovery platforms. Both approaches are valid depending on the circumstances of the case, and both can ensure an efficient and collaborative claim or case preparation phase. It should however be emphasised that experienced forensic teams can actively coordinate the data search and review to ensure a focused and lean process.

Visual analytics

The more trades and contractors that are involved to deliver the project works; the more sources of information are available. Examining these can become an overwhelming task to not only analyse the number of documents but also understand the story behind any issues and topics.

In claim and dispute situations we often find ourselves in front of large amounts of documentation. Despite this, the specific information we need (or seek), is often the famous ‘needle in a haystack’.

Digitalisation has enabled the automated analysis of various types of visual evidence such as drone pictures, satellite pictures or stationary photographs. This can be used to access indisputable evidence by utilising IT-supported tools to scan the entirety of visual documents and, depending on the quality of evidence, count manpower, machinery or analyse progress.

Closing the gap by utilising data forensics

Accessing information in an efficient way helps uncover crucial causal evidence and helps to understand the case based on the set of documentation. With increasingly extensive and manifold documentation during engineering and construction projects, efficient forensic data management not only facilitates the work of analysts, but also becomes a key difference-maker during and before dispute proceedings when it comes to risk mitigation.

Experience shows that the most advanced project management system does not always capture all the project knowledge and collection of key evidence. The main purpose of engineering and construction projects is not the development of documents, it is the successful completion of a usually unique product, so this is understandable.

From a customer’s side, extension of time claims are often scrutinised to the point where data forensics help to disprove unsubstantiated claims. On the other side, for the contractor, it is certain that efficient data forensics improves the availability of evidence to demonstrate causality.

In summary, this means that professional and sophisticated data forensics not only closes the evidence gap with respect to a thorough causal chain, but also closes the knowledge gap between contractors and customers. 

Nils Hanfstingl, Senior Director and Thomas Hofbauer, Senior Managing Director, FTI Consulting