Audit evidence and record retention should be managed according to the information’s purpose, applicable obligations and the organisation’s controls. ISO 9001 does not justify inventing one universal retention period for every audit record. Customer, legal, regulatory and certification arrangements may affect particular information and need to be evaluated in context.
The external audit guide explains how evidence supports assessment and response. Retention is useful when records remain reliable and retrievable, not merely when the organisation keeps everything indefinitely.
Identify which records are needed
Distinguish operational records used as evidence from records of the audit itself. An inspection result may already have its own control and retention arrangement. An audit report, response record or acceptance communication serves another purpose.
Identify what information is necessary to explain the assessment and follow-up. This can include scope, criteria, selected evidence references, findings, actions and review decisions. The exact set depends on the activity and applicable requirements.
Avoid copying every source record into a separate audit archive without considering duplication. Controlled references may preserve traceability while reducing unnecessary copies, provided the underlying information remains available for the required purpose.
Set retention using actual obligations
Review relevant legal, regulatory, customer, contractual and certification requirements. Consider the period needed for investigations, recurring problems and decision review. Where obligations conflict or are uncertain, obtain appropriate specialist advice.
Do not assume that a common practice in another sector applies automatically. A generic number in an online template may be unsuitable for the organisation’s products, services, jurisdiction or customer commitments.
Document the rationale and responsibility for the decision. A retention schedule can identify the record category, owner, storage location, access, retention basis and disposal authority. These are useful implementation fields rather than a prescribed universal form.
Preserve integrity and context
Evidence needs identifiable context. Record versions, dates, case references and relevant criteria help later reviewers understand what was evaluated. A screenshot detached from its system filters or timestamp can be difficult to interpret accurately.
Protect records from unauthorised alteration or deletion. Where corrections are made, preserve an appropriate trail so that the original meaning is not silently replaced. Never reconstruct a record and present it as contemporaneous evidence when it is not.
| Information type | Control consideration |
|---|---|
| Audit report | Approved version and distribution |
| Evidence reference | Link to the correct case and period |
| Corrective-action record | Relationship between finding, response and review |
| Acceptance communication | Formal status and any remaining conditions |
| Exported system data | Definitions, filters and integrity |
The relevant controls depend on format and consequence. Paper and electronic records can both require deliberate handling.
Limit access without obstructing legitimate review
Audit records may contain customer information, personal data or commercially sensitive details. Give access to people who need the information and use suitable transfer arrangements when sharing with the certification body.
Agree controlled viewing or redaction where appropriate. Ensure the remaining evidence still supports evaluation. Removing the context needed to understand a finding can make a redacted record unusable.
Do not assume that every auditor can retain every document they view. Clarify copying, recording and transfer arrangements through the relevant agreement and organisational controls.
Test retrieval and continuing availability
A retention rule is ineffective if information cannot be found. Check that the organisation can retrieve relevant records after staff changes, system migration or archival transfer. Include necessary formats, permissions and links in planning.
Backups and archives serve different purposes. A backup intended for disaster recovery may not provide practical routine retrieval of a particular evidence record. Understand the actual capability rather than treating the existence of a backup as proof that every retention need is met.
If an evidence reference depends on a system scheduled for replacement, plan how context and access will be preserved. Test the arrangement before the original source becomes unavailable.
Dispose deliberately and preserve necessary holds
When a retention period ends, confirm that disposal is authorised and that no relevant investigation, dispute or other applicable hold requires preservation. Avoid indefinite retention by default, particularly for unnecessary personal information.
The finding closure article explains why formal acceptance records need to remain connected to the response. Closure does not automatically mean every supporting record can immediately be deleted.
A reliable arrangement balances traceability, access, integrity and justified retention. Its purpose is to preserve the evidence needed for decisions and obligations while avoiding uncontrolled accumulation or disposal that makes later evaluation impossible.
Does electronic storage remove the need for a retention decision?
No. A system may keep information by default without ensuring suitable access, integrity or eventual disposal. Define responsibility for the evidence and check what happens when accounts close, software contracts end or formats change. An export should preserve enough context to remain interpretable rather than retain only an unlabelled data file.
Where duplicate copies exist, identify the authoritative record and how conflicting versions will be handled. Uncontrolled copies can make a later investigation harder, especially when each appears to show a different action status. Retention planning should preserve the decision trail as well as the file.