Evidence Retention and Access

Evidence retention and access is about keeping the resilience trail in a form that can be found, read, and relied upon long after the people who created it have moved on. Retention decides what is kept, for how long, and in what form, while access decides who can find it, under what conditions, and how quickly. Together, they determine whether a firm can produce its trail when an auditor, supervisor, or board asks for it, or whether it must reconstruct its history from scattered files and fading memories.

The principle is simple: keep the records that support a claim about a service for as long as that claim may need to be checked, keep them readable, and keep them findable by someone other than their author. The practice is less simple, because it requires decisions about formats, locations, ownership, and security, and those decisions need to be made deliberately, before the trail is needed, rather than improvised when a request arrives.

The firm should keep the records that make up the service trail: maps, tolerances, test records, incident records and reviews, audit reports and their follow-up, examination responses and findings, and the owned actions that arose from each of them, with their closure evidence. It should also keep the versions that matter: the map and tolerance in force at the time of a test or incident, not only the current version, because a later reader needs to judge the test against the standard that applied when it was run.

How long evidence should be kept depends on the regime that applies, the firm's own policies, and the period over which a claim about a service may need to be checked. Under DORA in the EU and under the FCA and PRA regime in the UK, the expectations and the relevant periods are set separately, and the firm should label which regime its retention approach serves where both apply. Beyond any regime expectation, the firm should consider how long it takes for a service, a supplier, or a tolerance to change so much that the old trail no longer describes the current service.

The retention approach should be written down, applied consistently, and reviewed when the regime or the firm's services change. It should state, for each kind of record, how long it is kept and why, and it should be followed even when disposal would be convenient, because selective disposal undermines trust in the trail that remains. A firm that cannot explain why a particular record is missing, whether it was disposed of under its approach or simply lost, has a gap in its trail, whatever the reason for the absence.

Evidence should be kept in a form that remains readable without the original author, the original system, or a special tool. That means preferring stable, widely readable formats for the core trail, keeping the original record when a format is changed, and recording the context that makes the record intelligible, such as the service name, the date, the owner, and the version of the map or tolerance it relates to. A record that can only be read by the person who wrote it, or by a system that has since been replaced, is not retained in any useful sense.

Access should be wide enough that the trail can be produced without its author, and controlled enough that sensitive material is not exposed unnecessarily. The service owner, the second person on the relevant rota, internal audit, and the firm's senior managers responsible for resilience should all be able to find the trail for the services they oversee, without needing to ask the author for a location or a password. An auditor or supervisor, when entitled to see the trail, should be given it in an organised form, rather than being left to search for it.

Trails survive change when they are owned by roles rather than by individuals, filed against services rather than against people or projects, and reviewed when ownership changes. When a service owner leaves, the incoming owner should be able to find the trail, understand its current state, and take ownership of its open actions, without a handover that depends on personal memory. A handover that consists of pointing to the trail, and walking through its open items, is a test of the trail itself, and it should be treated as such.

System change poses a similar test. When a filing system, a testing tool, or a supplier platform is replaced, the trail should be migrated deliberately, with a check that the migrated records remain complete and readable, and that their links to services, maps, and tolerances survive the move. A migration that loses links, dates, or versions has damaged the trail, even if every file was technically copied. The firm should therefore treat retention and access as part of every change programme that touches service records, not as an afterthought to be addressed when the old system is already gone.