Keep exception records at least as long as your longest audit lookback and any contractual or legal retention duty, then add a safety margin. Retain closed, expired and denied items, not just active ones. Check the exact period with your auditor and counsel, because it varies.
There is no single number
No universal rule sets one retention period for exception records. The right answer depends on who might ask: auditors, customers, regulators, insurers or litigators. Rather than invent a figure, build the period from your actual obligations.
Where to find your obligations
| Source | What to check |
|---|---|
| Audit scope | The period under review, plus prior periods an auditor may compare |
| Customer contracts | Evidence retention and audit rights clauses |
| Regulation | Sector rules on records and incident evidence |
| Insurance | Policy conditions about security records |
| Internal policy | Your own records schedule |
Take the longest of these and write it down as the retention rule. If you hold a report or attestation from an independent auditor, ask what the next engagement will look back over.
What counts as the record
The exception itself is only part of it. Keep:
- The request, justification and evidence at the time of approval
- Approval and any delegation, with timestamps
- Renewals and changes, as history, not overwrites
- Closure, with the reason
- Denials and appeals
- Notifications sent, if you rely on them as a control
Evidence links are the weak point. A ticket or document may be deleted long before the exception record. Store a copy or a hash with the record, or make sure the linked system has a retention rule at least as long.
Deletion is a control too
Keeping forever is not automatically safe. Records can contain internal architecture details and names. Set an end date, protect access, and delete on schedule, with a legal hold process in case a dispute or investigation freezes deletion. Where personal data appears, such as approver names, apply your privacy retention rules too.
Practical setup
- Decide the retention period with compliance and legal
- Write it into the records schedule
- Configure the tool or archive to enforce it
- Export on a schedule to immutable storage if the tool cannot guarantee history
- Test restoring a record from two years back, if you have one that old
Common mistakes
- Purging closed exceptions to "keep the list clean"
- Relying on chat messages as the only approval record
- Losing history when the tool is replaced, see migrate risk acceptances and exceptions to a new tool
- Evidence that points to a system you later decommission
Safeguard's compliance and evidence automation is designed to collect and organise records for audits, so the retention work starts from a consistent set rather than scattered files.
Try it yourself
Click through it at your own pace, or open it full screen.
See how records map to controls, which helps you spot which evidence has to last longest.
Quick check
Can we delete exceptions once they close?
Not before your retention period ends. Auditors often sample closed items from earlier periods.
Who decides the retention period?
Compliance and legal, using your audit, contract and regulatory obligations. Engineering implements it.
Last reviewed: 19 October 2026.
