Retire a control only after something else covers the same risk, and record the decision with a date, an approver and the reason. Keep the old control's evidence through the audit period it belonged to. Tell your auditor, because a control that disappears mid-period looks like a failure unless it is explained.
When teams retire controls
Common reasons: a tool is replaced, a manual step is automated, a process is merged with another, or a system is decommissioned. All are normal. The finding risk comes from gaps and silence, not from change.
The safe sequence
- State the risk the control addresses, from its narrative.
- Identify the replacement: a new control, a stronger preventive check, or evidence that the risk no longer exists.
- Run both in parallel for a period if possible, so you can compare.
- Get a documented approval from the control owner and the person accountable for the risk.
- Set an effective date and update the narrative, the control list and the evidence calendar.
- Notify the auditor before the date, especially during an observation window.
- Keep the old control's evidence for the portion of the period it operated.
Tracking the change
Keep a short record per retired control:
| Field | Example |
|---|---|
| Control | Quarterly manual review of production database accounts |
| Risk covered | Accounts with excess access |
| Replacement | Monthly automated access report with ticketed review |
| Approver | Head of Platform |
| Effective date | Date of the last manual review plus one day |
| Overlap | One quarter of both |
| Evidence location | Link to archived folder |
What auditors look at
- Was the control operating until the retirement date? They may sample records up to that date.
- Is the new control designed to cover the same risk?
- Is there a gap between the two? Even a short gap can be an exception.
- Was the change approved, or did it just stop?
Things to avoid
- Letting a control lapse because nobody owned it. Check the owner list for controls whose owners have left.
- Deleting evidence when the control is retired. Evidence is tied to the period, not to the control's current existence.
- Changing the narrative without changing the practice, or the reverse.
A quick test before you retire
Ask: if this control had been missing for the last month, what would have gone wrong, and which other control would have caught it? If no other control would have, you are not ready to retire it.
Quick check
Do I need to keep a retired control's evidence?
Yes, for the period it operated, following your retention policy.
Can I retire a control mid-period?
Yes, with a documented replacement and notice to the auditor. Expect them to test both the old and the new.
Safeguard compliance and evidence automation can keep control records and their history together. Try a free scan.
Last reviewed: 19 October 2026.
