Records compliance audit

Why run this

What this checklist is for

Most agencies have a documented retention schedule and, in practice, delete nothing. The consequence arrives with the next records request, when the scope includes fifteen years that should have been disposed of a decade ago.

This audit distinguishes a schedule that exists from a schedule that operates. The distinction is usually uncomfortable and always useful.

Run it with

Head of Information Governance

And with

Records officers

And with

IT administrators

The checklist

20 checks, in the order we would run them

Tick only what you can genuinely evidence today. An item you intend to do is not an item you have done, and scoring yourself generously here only produces a comfortable number and an uncomfortable project.

Section 1

The schedule itself

Whether what you are automating is worth automating.

The retention schedule has been reviewed within the last three yearsImplementing an obsolete schedule automates the wrong thing at scale, which is worse than manual inconsistency.
Records series are grouped by retention behaviour rather than mirrored one-to-oneA schedule with two hundred series becomes two hundred labels and an unusable interface.
Event-based triggers are identified where the schedule is event-drivenMost public sector schedules retain from case closure or contract end, not from creation.
Legal hold requirements are documented and understoodHold overrides disposal. If nobody knows how, disposal either stops entirely or proceeds when it should not.
Somebody is accountable for the schedule, distinct from ITRecords management is a professional discipline. Delegating it to IT produces technically correct disposal of the wrong things.

Section 2

Application coverage

Whether the schedule reaches your actual content.

A baseline retention policy covers all locations including Teams messagesTeams chat is routinely missed and routinely subject to disclosure.
Labels are applied automatically by location wherever possibleAsking users to classify produces inconsistent classification. Automatic application by location is the highest-value, lowest-effort route.
Auto-application was simulated before enforcementSimulation shows what would have been labelled. It is almost always wrong the first time.
Unlabelled content is measured and reducingTrack it as a metric. A retention programme where unlabelled content is the majority state has not started.
Content in unmanaged locations is identifiedPersonal drives, departmental file shares and third-party systems. Out of scope is not the same as not existing.

Section 3

Disposal in practice

The part that separates a working schedule from a documented one.

Something has actually been disposed of in the last twelve monthsThis single question distinguishes most agencies. If the answer is no, the schedule is not operating.
Disposition review is enabled with named reviewers per seriesDeletion approved by a named person and timestamped is defensible. Silent policy deletion is harder to explain.
Reviewers have deputies and the queue depth is monitoredItems accumulate quietly, the queue becomes daunting, and reviewers stop opening it.
Disposal decisions are logged and the log is retainedThe record of destruction is itself a record, and it is what an audit of your disposal practice examines.
Disposal is suspended correctly when a hold is appliedTest this rather than assuming. It is the interaction most likely to be configured incorrectly.

Section 4

Disclosure readiness

The practical benefit that justifies the whole programme.

A records request can be scoped and searched within your statutory windowTime it on a synthetic request. The finding is usually about scope size rather than search capability.
Search covers every in-scope location including Teams and shared mailboxesTwo locations routinely missed, both routinely disclosable.
Redaction and exemption handling has a defined processTechnical search is the easy half. The review is where the time goes.
Somebody other than one person understands the whole processStatutory deadlines do not wait for somebody to return from leave.
Response times are measured and trending in the right directionThis is the metric that demonstrates the programme worked, and the one members will ask about.

What your score means

Read this against the number above

These bands are deliberately blunt. The middle band is where most organizations honestly sit, and it is a perfectly reasonable place to proceed from — provided the gaps are written down with owners rather than carried as optimism.

0–59%Significant gaps

Do not proceed yet. More than four in ten items are unaddressed, and the ones that fail here are usually the foundational ones that make everything after them harder.

60–84%Mostly ready, with known gaps

Proceed on a defined scope, with the outstanding items written into the plan as risks with owners and dates. This is the most common honest position.

85–100%Ready

The remaining gaps are small enough to handle during delivery rather than before it. Confirm the unticked items are genuinely minor rather than simply unexamined.

Your score highlights automatically as you tick items above. Nothing is saved, sent or tracked — refreshing the page clears it.

Closing the gaps

If you could not tick these, start here

The four items below are the ones whose absence causes the most trouble downstream. If your unticked items include any of these, they are worth addressing before the rest.

Nothing disposed of in a year

This is the finding. Start with one records series, enable disposition review, and complete one full cycle to prove the mechanism works.

Users asked to classify

Switch to automatic application by location. Manual classification at scale produces inconsistency that undermines the whole schedule.

Hold interaction untested

Test it deliberately. Disposal proceeding during a hold is a serious finding and it is entirely preventable.

Single person dependency

Document and cross-train. Statutory windows are unforgiving of annual leave.

Want a second opinion on your score?

We will run a scoped review against one department, including what a records request currently pulls in and what it would pull in after remediation.

Talk through your result Read the related guides We reply to every message within one business day.

Keep going

Related checklists

azure

public-sectorReadiness

Cloud migration readiness checklist

Twenty checks covering the governance, procurement and technical questions a council review will ask.

June 27, 2026 · 20 checksOpen

power-bi

public-sectorReadiness

Public reporting publication readiness

Twenty checks before publishing spending or performance data, covering accuracy, accessibility and the questions members will ask.

December 13, 2025 · 20 checksOpen

defender

public-sectorReadiness

Supplier and third-party access audit

Twenty checks on who outside your organization can reach your systems, and what would happen if one of them were compromised.

November 15, 2025 · 20 checksOpen

What this checklist is for

Run it with

And with

And with

20 checks, in the order we would run them

The schedule itself

Application coverage

Disposal in practice

Disclosure readiness

Read this against the number above

If you could not tick these, start here

Nothing disposed of in a year

Users asked to classify

Hold interaction untested

Single person dependency

Want a second opinion on your score?

Related checklists

Cloud migration readiness checklist

Public reporting publication readiness

Supplier and third-party access audit

Tell us what you're trying to fix

Let’s get started on something great

Phone

Email