An audit or inspection may examine both what a business did and the records needed to demonstrate it. The two are closely linked. In many regulated industries, keeping certain records is itself a requirement: California’s cannabis law, for example, requires licensees to keep accurate records of commercial cannabis activity. A recordkeeping gap can therefore be a finding on its own, and it can also weaken the evidence for controls that were working.

Most recordkeeping problems come down to retention, access, format, or custody, and each has an ordinary fix. The sections below cover where retention rules come from, a small illustrative retention schedule, who should have access, how legal holds fit in, and a simple retrieval test you can run this week.

Records are part of compliance, not only proof of it. A gap in the file can be a finding by itself and can undermine the evidence for other controls.

Start with where each rule comes from

Retention and format rules can come from several places, and they do not carry equal weight. For each record type, work through them in this order:

Statutes and regulations for your license type and jurisdiction, at the state or provincial level and sometimes the federal level
Conditions on your specific license or permit, including local permits
Other legal obligations outside your license, such as tax and employment recordkeeping
Contractual commitments, such as lease, lender, insurance, or vendor terms
Your internal policy, which can set a longer period or a stricter format but cannot shorten a legal requirement

Record which source applies to each record type, with a citation and the date you last checked it. Where two sources set different periods, the schedule should say which one governs and why; where that is unclear, confirm it with counsel or the relevant authority. Periods vary by record type and jurisdiction, and they change, so treat any figure in a template as a placeholder until you have confirmed it yourself.

An illustrative retention schedule entry

Here is what one line of a retention schedule might look like. It shows structure only. It is not a statement of what any law requires, and the bracketed items are for you to fill in from your confirmed sources.

Record type: Staff training sign-off records, Location A
Source: [regulation or license condition, cited], confirmed on [date] by [name]; internal policy applies if no external rule is found
Retention period: as stated in the cited source, counted from the trigger that source specifies, such as the date of training or the end of employment
Format: signed original, or an approved electronic signature stored as PDF
Location: shared compliance drive, Training folder, one subfolder per person
Accountable role: compliance lead, with the current named assignee and a named backup
Access: site manager can add; compliance lead can edit; owner can view; changes logged
Legal hold: none open
Last retrieval test: [date], result recorded
Disposal: only after the period ends, no hold applies, and the compliance lead approves

Retention periods that don’t match the rule

A common gap is a single retention period applied to all record types, when the actual requirements vary by category and jurisdiction. A shredding or archiving routine built around convenience rather than the confirmed rule can remove records that still needed to be kept.

Give each record type its own entry, keep the schedule where managers can see it, and review it when the underlying rules change, rather than setting it once during onboarding. Adding that review to your compliance calendar keeps it from depending on memory.

Access: who can see, change, and remove records

Access permissions are part of the record’s reliability. Decide, for each record type, who can create entries, who can edit them, who can only view them, and who can delete or dispose of them. Keep that last group small. Where your systems allow it, log changes so you can show who altered a record and when.

Access also needs managing when people change roles or leave. A record held only in a former employee’s inbox or laptop is hard to produce and hard to vouch for. Moving records to shared, controlled locations, and removing departing staff’s access promptly, addresses both problems.

Checklist of five recordkeeping gaps that cause problems in an audit or inspection: retention period mismatched or no set schedule, records that cannot be produced on demand, wrong format or missing signature, no record of who handled a document and when, and records scattered with no single source of truth. — Five common recordkeeping gaps, each with an ordinary fix.

Legal holds come before the schedule

A retention schedule tells you when a record may be disposed of. A legal hold stops that. If the business receives notice of an investigation, audit, claim, or lawsuit, or expects one, related records may need to be preserved even after their normal retention period ends. Counsel should decide when a hold starts, what it covers, and when it can be lifted.

The schedule’s job is to make a hold easy to apply: a hold field on each record type, a named person who can apply it on counsel’s instruction, and a rule that disposal pauses while any hold is open.

Test retrieval before someone else does

A record that exists but cannot be found is of little use during an inspection. A simple retrieval test shows where you stand:

Pick a record type from the schedule, plus a specific date and location.
Ask the person on duty, not the person who set up the system, to produce it.
Time it, and note where they looked and whether the record was complete, signed, and in the expected format.
Record the result against the internal retrieval target you set for that record type. If a rule sets a response period, record that separately; the two are not the same thing.
Log any failure on your Corrective Action Log with an owner, a due date, and a date to re-test.

The Inspection Readiness Checklist includes records retrieval alongside the other items worth confirming before a visit.

Format problems worth checking

Some records fall short not because the information is missing, but because the format does not meet the requirement. Gaps worth checking before an inspector does:

Signatures or initials missing on records that require them
Digital records saved in a format the regulator’s system cannot open or verify
Timestamps that do not match the activity being documented
Templates that were updated for one location but never rolled out to the others

Chain of custody needs an owner

Even a complete, well-formatted record can raise questions if nobody can say who created it, who has accessed it since, or whether it has been altered. That applies to inventory logs, training records, and other documents a regulator might treat as evidence of compliance over time.

The fix is rarely technical. Assign each record category to an accountable role with a current named assignee and a backup, and log access and changes as a routine, not only after something has gone wrong.

Why this happens even in careful operations

Recordkeeping rarely fails because an owner decided it was unimportant. It slips because it is invisible day to day. A missing signature or an inconsistent retention schedule does not slow down a shift or show up on a sales report, so it can persist for years before anyone checks.

Multi-site operators face a compounding version. A workaround at one location can spread to each new site, because new managers copy what they see rather than what a written standard requires. A single written playbook across locations is the usual remedy.

Sources

California Business and Professions Code, Section 26160 (accessed September 26, 2026)

Talk through your recordkeeping

SPL Management sets up and maintains recordkeeping systems as part of Compliance Management for licensed businesses in the United States and Canada, from retention schedules and access rules to retrieval tests. SPL does not decide legal holds or give legal advice on retention; those stay with your counsel. A 30-minute consultation is a chance to discuss whether a scoped records review would be useful.

Request a Consultation

General information only, current as of the last review on September 26, 2026. Rules vary by jurisdiction and change often. This is not legal, tax, or real estate advice; confirm current requirements with the regulator or a qualified professional before acting. How we write and review articles.