We use cookies to understand which pages and tools are useful, nothing more — no ad tracking across other sites. You can change this later from the footer.

Skip to content
Lekhya.in

Guide3 min readPublished

Data retention policy audit: what a statutory auditor should check

What a statutory auditor should check about a client's own data retention practice: whether the stated policy covers the statutory minimum retention periods, and whether records were actually retained in a retrievable form.

A data retention policy audit checks two things that are easy to conflate but need to be tested separately: whether the entity's written retention policy actually meets or exceeds the statutory minimum retention periods applicable to books of account, vouchers, and other records under the Companies Act and tax law, and whether records from earlier in that retention window can actually be retrieved intact and in a readable form today — a policy that states the right number of years is not evidence that a specific record from several years ago still exists, is complete, and is accessible.

Policy coverage against statutory minimums

  • Confirm the entity's written retention policy explicitly covers books of account and relevant vouchers for the minimum period required under the Companies Act, and separately covers the retention period for records relevant to tax assessments and GST, since these minimums differ from each other and from any internal records-management default.
  • Check whether the policy distinguishes between physical and electronic records — a policy that only addresses paper retention, while the entity has moved to electronic accounting records and digitally signed invoices, leaves the digital records effectively unaddressed.
  • Where the entity uses a third-party cloud accounting or ERP provider, confirm the retention commitment made by that provider, in its own terms of service or SLA, is at least as long as what the entity's own policy requires — a mismatch here means the entity's policy is aspirational rather than operative.

Testing actual retrievability

Retrievability tests
TestWhat it confirmsCommon failure
Retrieve a record from the earliest year still within the retention windowRecord exists, opens, and is completeRecord exists as a file but is corrupted, password-protected with a lost password, or in a deprecated file format nothing can open
Confirm retrieval includes supporting attachments, not just the primary ledger entryUnderlying vouchers, not just summary postings, were retainedSummary accounting data retained while scanned supporting documents were purged separately on a shorter cycle
Check retention after a system migrationHistorical data survived the migration to a new accounting system without lossPre-migration data left in an unsupported legacy system that is no longer actively maintained or even accessible
Retrievability tests

Regulatory requirement

Minimum retention periods for books of account and vouchers are prescribed under the Companies Act, and separate minimum periods apply for records relevant to income tax and GST assessments and appeals. Confirm the current minimums for each applicable law before concluding the entity's policy is adequate.

A system migration is one of the most common points at which historical data quietly becomes unretrievable, because migration projects are usually scoped around getting current, active data into the new system correctly, with historical archive data treated as a lower priority that is sometimes left behind entirely.

This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.

Related resources

Free tools, no signup

Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.