How to Build a Document Retention Schedule That Survives Audits
Auditors rarely question the periods on your schedule. They ask who owns each record series, why it is kept that long, and how you can prove records were kept, held and destroyed the way the schedule says.
In short
A retention schedule survives an audit when it is backed by evidence, not just periods. Each record series needs a named owner and a documented legal or business basis. Legal holds must stop destruction and be released in writing. Every disposal should be logged with what, when, by whom and under which schedule entry. And the schedule itself needs dated, approved reviews.
This guide covers the evidence that makes a schedule defensible. For which regulations set retention periods in your sector, see how to build a records retention schedule by industry.
What an auditor actually asks to see
Having a schedule is the easy part. The questions that cause trouble are about whether anyone is accountable for it and whether practice matches the document.
The approved schedule in force
Not a draft, and not last year’s copy. Which version applied on a given date, who approved it, and when.
An owner for each series
A named role responsible for applying the schedule to that series, who can explain where the records live and how disposal works there.
Why each period was chosen
The law, contract or business need behind each retention period, written next to it rather than held in someone’s memory.
Records of what was destroyed
Evidence that disposal happened on schedule, that nothing under a hold was destroyed, and that the gaps in your files are explained.
Give every record series an owner and a legal basis
A record series is a group of records that are created, used and disposed of together, such as payroll registers, signed customer contracts or incident reports. The schedule should be organised by series, and each row should carry more than a number of years.
At a minimum, each row should name the series and where it is held, the retention period and the event that starts the clock (creation, contract end, employee termination), the owner by role rather than by person, the basis for the period with a reference to the specific law, contract clause or documented business reason, and the disposal method.
The basis column is the one most schedules leave blank. When an auditor or opposing counsel asks why invoices are kept for one period and not a shorter one, “that’s what we’ve always done” is a weak answer. A reference to the requirement, or a short written business reason approved by the schedule owner, is a strong one. Where you are not sure what applies, record that counsel was consulted and when.
Assign owners by role. A schedule that names individuals goes out of date the first time someone leaves. Name the role (“Payroll Manager”), and keep a separate, current list of who holds each role.
Legal holds override the schedule
A legal hold suspends destruction for records relevant to litigation, an investigation or an audit, even when their retention period has ended. Destroying held records is one of the fastest ways to turn a routine dispute into a serious one, so the hold process should be written into the retention policy itself, with these four stages.
Trigger
Who can issue a hold, and when
Usually legal or compliance, as soon as litigation or an investigation is reasonably anticipated, not only once papers are served.
Scope
Which series, people and dates
Define the hold by record series, custodians and date range so owners know exactly what to stop disposing of.
Notice
Written instruction to owners
Send each affected owner and custodian a written notice and keep confirmation that they received it. Automated deletion in the systems involved needs to be suspended too.
Release
Lifted in writing
Only the issuer releases a hold, in writing. Normal retention then resumes, and records past their period become eligible for the next disposal cycle.
Some holds are required by regulation, not just good practice. For example, where a charge of discrimination has been filed, EEOC regulations require the employer to “preserve all personnel records relevant to the charge or action until final disposition of the charge or the action” (29 CFR § 1602.14).
Check holds before every disposal run. The most common failure is not a missing hold policy but a disposal cycle that ran without anyone checking the list of active holds first.
Keep a destruction log
When records are missing, the question is whether they were destroyed under the schedule or lost. A destruction log answers it. Run disposal as a regular, documented cycle rather than an occasional clear-out.
- 1
Identify eligible records
The series owner lists records whose retention period, counted from the trigger event, has ended.
- 2
Check against active holds
Compare the list with every open legal hold and remove anything in scope. Note that the check was done and by whom.
- 3
Get sign-off
The owner, and for sensitive series a second approver such as legal, authorises the disposal in writing.
- 4
Destroy using the stated method
Shredding, certified destruction by a vendor, or deletion in the system that holds the records. Keep vendor certificates where they are issued.
- 5
Write the log entry
Record the series, date range or identifiers, quantity, the schedule entry relied on, the method, the date, and who approved and carried it out.
Log the series and range, not the contents. The log is a record of disposal, and it should not recreate the personal or confidential information you just destroyed.
Proving the schedule was actually followed
A schedule applied in one department and ignored in another is harder to defend than a modest schedule applied everywhere, because inconsistency looks like selective destruction. Three habits produce the evidence auditors look for.
Disposal on a fixed cycle. Annual or quarterly runs, each with log entries, show the schedule is operating. Long gaps followed by large clear-outs suggest it is not.
Periodic spot checks. Once a year, pick a few series and confirm that records older than their period are gone (unless held) and records within it are still there. Write up what you found and what you fixed.
Owner acknowledgment. The people who apply the schedule should confirm, with a date, that they have read the current version. If an owner later says they never knew the period had changed, the acknowledgment record settles it.
Reviewing the schedule itself
Laws change, systems are replaced, and new record types appear. Review the schedule on a set cycle, and also whenever one of these happens: a new law or regulation affects a series, the business enters a new state or line of work, a system holding records is migrated or retired, or an audit finding points at retention. Each review should end with an approved new version or a dated note that no changes were needed.
This is the part of retention that policy management software is built for. The retention policy and schedule can live in PolicyTrak:
Version control
Each save creates a numbered version with the author’s name and a timestamp, and nothing is overwritten. Earlier versions can be opened in full and compared side by side.
Approval workflows
Approval chains can be set by category, department or sensitivity, with reminders for approvers. Status changes are recorded in the audit log with their timestamp.
Distribution and tracking
Send the schedule to the record owners who apply it and record each person’s acknowledgment with a date. Acknowledgment reports can be exported for auditors.
NotePolicyTrak manages the retention policy and schedule as documents. It does not apply retention periods, place holds on records or destroy anything. That happens in the systems that hold the records, and the destruction log is kept alongside them.
Keep Your Retention Schedule Audit-Ready
Numbered versions, approval chains and dated acknowledgments for the policy behind your records. Sign up and see plans without booking a call.
