How long should you keep audit evidence? A decision guide

There is no single answer. Keep audit evidence at least as long as your own policy says, your customer contracts demand and the laws that apply to you require, then pick the longest of those. Write the period down, and delete on schedule once it ends.

Three sources of a retention period

1. Your own policy. Many programs set a period covering at least the prior audit cycle plus the current one, so a new auditor can look back if needed.
2. Contracts. Customer agreements may ask you to keep records for a period or to provide them on request.
3. Law and regulation. Some sectors set record keeping rules. I did not confirm specific periods for this post, so check the rules for your sector and country with counsel.

Choose the longest applicable period. Document how you reached it.

What to keep

• Final reports and the management letters or responses that go with them.
• The evidence supplied for each control, with metadata.
• The PBC list and tracker.
• Correspondence with the auditor about exceptions and decisions.
• The control register as it stood during the period.

Keep drafts and scratch files only when they matter. Throwing out duplicates reduces risk and cost.

Mind the personal data

Evidence often holds personal data. Data protection law generally expects you not to keep personal data longer than needed for its purpose, so a long retention period needs a reason. Redacting personal data in archived evidence helps. Ask your privacy lead or counsel how to reconcile the two.

Protect it while it is stored

Archived evidence still needs controls: restricted access, integrity protection, a backup and a record of who looked. A hash of each file recorded at archive time lets you show later that it did not change.

Deleting on schedule

Set an annual review that lists evidence past its retention date. Delete it, record that you did and note any legal hold. If there is an investigation or dispute, pause deletion for the relevant material.

Make it easy to follow

Put the retention period in the folder index and in your policy. People follow rules they can find. Safeguard's compliance and evidence automation can keep versioned evidence records, though you still set the retention rules.

Practical tip: store evidence in a way that keeps deletion simple. If everything for one audit period sits under one dated folder, removing it when the period expires is a single action with a clear record. Scattering copies across mailboxes and personal drives makes the retention period impossible to enforce, so tell staff to share links to the archive, not attachments.

Quick check

Last reviewed: 19 October 2026.