Record keeping and retention procedure
SOP template
Check this template against your local regulations and your own policies before you use it.
| SOP no. | Version | Effective date | |||
|---|---|---|---|---|---|
| Owner | Approver | Review date |
Purpose
To make sure the business keeps the records it needs, for as long as the law and its contracts require, where they can be found and kept safe, and destroys them securely when they're no longer needed.
Scope
Every record the business creates or receives, on paper or in any system, including financial, employment, customer, health and safety and compliance records. Policies and procedures themselves follow the document control procedure.
Responsibilities
| Role | Responsibility |
|---|---|
| Records owner (a manager for each type of record) | Decides how long their records are kept, and makes sure they're stored, protected and destroyed on time. |
| All staff | Create complete, accurate records, store them in the right place and don't keep private copies. |
| Compliance lead or office manager | Keeps the retention schedule, runs the yearly review, and keeps the destruction log. |
Definitions
- Retention period
- How long a type of record must be kept, counted from an event such as the end of a financial year or the day someone leaves.
- Legal hold
- An instruction to keep records, even past their retention period, because of a claim, investigation or audit.
What you need
- The retention schedule (each record type, its owner, where it's kept and for how long)
- Secure storage, and a shredding or secure destruction service
Procedure
List your record types
Write down each kind of record the business keeps, such as invoices, payroll, contracts, incident reports, training records and customer files.
Set a retention period for each
For each type, find how long the law, your licenses, insurers and contracts require you to keep it, and record the longest in the retention schedule.
Caution: Retention periods differ by country, state and industry, and some records, such as children's or health records, must be kept for many years. Check the rules that apply to you.
Create complete records
Record what happened, when and who was involved, at the time or as soon as you can. Don't change a record after the event without noting the change.
Store them securely
Keep each type where the schedule says, in a locked cabinet or an access-controlled system, backed up, and not on personal devices or email.
Control who can see them
Give access only to the people who need it for their job, and remove access when people leave or change role.
Apply legal holds
When there's a claim, complaint to a regulator or investigation, the compliance lead tells records owners which records to keep, and they're not destroyed until the hold is lifted.
Review once a year
Each year, each records owner finds the records past their retention period and checks none are under a legal hold.
Destroy them securely
Shred paper, securely delete electronic records and their backups where possible, and record what was destroyed, when and by whom.
Records
- The retention schedule.
- The destruction log.
- Legal hold notices and when they were lifted.
Related documents
- Document control procedure
- Privacy policy
- Data breach response procedure
Revision history
| Version | Date | What changed | Approved by |
|---|---|---|---|
