First Reference company logo

Inside Internal Controls

News and discussion on implementing risk management

machine cogs image

A new age of records retention: good policy more than worth the effort

Earlier this year, I wrote about proposed new legal requirements with respect to the destruction of records. Those amendments (An act to amend the Personal Information Protection and Electronic Documents Act (Bill C-29)) died with the 40th Parliament, but organizations should still make sure they understand their obligations with respect to destroying documents.

documentNow the other side of the coin—retaining documents—which is equally important and perhaps equally difficult to navigate.

There are a number of potentially troublesome issues associated with retaining records. For example: there are storage and privacy concerns; organizations must ensure they keep records secure in accordance with relevant privacy laws. At the same time, organizations might not have considered the self-incriminating information that records might hold, and they will want to ensure they don’t keep potentially incriminating records any longer than the law requires.

Not that I think our readers are up to no good! But when it comes to audits, organizations are likely better off providing the least amount of information they are legally required to, rather than all of the information they have in their possession covering the audit period. That means implementing a records management policy—and making sure to follow the policy.

A policy will help you understand which documents and information you need to keep and for how long, and which you can destroy. A policy will also force you to manage your electronic documents: Can you account for every copy of a document? Do you erase files securely, so that no trace of them remains, even to special data recovery software? Are your documents stored securely, so that no unauthorized persons can access them?

Find a detailed outline of the issues and obligations in policy 3.06 – Records management and retention of Finance and Accounting PolicyProVolume II — Corporate Governance. Policy 1.11 – Confidentiality and privacy is relevant. Information Technology PolicyPro also offers commentary and sample policies on data security.

Adam Gorley
First Reference Internal Controls, Human Resources and Compliance Editor

Follow me

Adam Gorley

Editor at First Reference
Adam Gorley, B.A. (Phil.), is a researcher, content provider and editor. He contributes regularly to First Reference Talks and Internal Control blogs, HRinfodesk and other First Reference publications. His areas of focus include broad human resources issues, corporate social responsibility, corporate governance and government policies, information technology and labour market trends.Read more
Follow me
Send to Kindle

, , , , , , , , , , , ,

Comments are currently closed.