Could Your Retention Schedule Stand Up to an Audit?
A digitized filing cabinet will not protect you if you cannot explain why a record still exists, or why it doesn’t.
Written by Chris Oliver
Takeaways
- A document's life cycle runs through four stages, creation, active use, semi-active storage, and final disposition, and a retention policy should follow it through every stage.
- Retention has both a floor and a ceiling. Some records must be kept for a minimum period, while personally identifiable information (PII) and other sensitive content should be deleted as soon as regulations allow.
- Retention obligations are never universal. Regulatory requirements, contracts, and internal business value each set their own clock, and only your organization can weigh all three together.
- Document management software like FileHold automates the schedule once you define it, using schemas and events instead of relying on staff to track policy by hand.
- Skipping a retention policy is still a decision. It just means you have chosen to keep everything, and that choice carries its own risk during an audit.
TL;DR
A document retention schedule is more than a shredding calendar. Every record moves through a life cycle from creation to archival or disposal, and the rules governing that life cycle come from regulations, contracts, and your organization’s own judgment about what still holds value. Software like FileHold can automate the schedule with schemas and events, but the policy itself has to reflect obligations specific to your organization. Treat retention like a disaster recovery plan: something every organization needs, defined before it is tested by an audit.
Why moving to digital filing raises the stakes on retention
Moving from paper to digital filing is one of the smartest decisions a business can make to keep its content protected, accessible, and controlled. But going digital does not remove the responsibility of deciding what to keep and for how long. It just changes how visible that decision becomes. A document retention schedule, done well, works alongside your document management system rather than against it. Here are three factors worth working through first, and what they mean the next time an auditor comes asking.
Your document's life cycle is more than “keep it” or “shred it”
In records management, historian Theodore Schellenberg proposed decades ago that records move through a life cycle modeled on that of a living organism. A record is created or received on the organization’s behalf, then enters an active period where it delivers direct, daily value. Think of this as your current, working files.
From there, the record is reviewed. If it no longer has value, it can be disposed of. If it still matters but is not needed daily, it moves into a semi-active state: retained, but no longer front and center. Eventually it reaches a final stage, preserved permanently as an archival record, or disposed of for good. In rare cases, a record becomes the seed for new content, and the cycle starts again.
That framework is a useful shorthand for how to think about any content your operations generate, whether it is a file, an email, or a report.
Document management software like FileHold can apply life cycle retention policies automatically to everything it stores, whether that content is classified as a document (information captured for reference) or a record (evidence of a transaction between parties). The goal is automation: FileHold enforces the policy so employees are not stuck manually tracking which stage each file has reached. FileHold’s flexibility means there is more than one way to configure these policies depending on how your organization works.
Retention means keeping what you need and disposing of what you don't
Digital storage is inexpensive, and paper is not. Physical records take up space that even the largest office eventually runs out of. Digital content, whether it started as scanned paper or a native electronic file, takes up so little room that keeping everything can feel like the safe choice. After all, you cannot be accused of destroying a record you never deleted.
But volume creates its own problem. Search tools in FileHold make it easy to surface relevant content, but more content in the system also means more results to sort through and more digging to find exactly what you need. This is where the line between active, semi-active, and archival documents earns its keep. Active documents can live in the Library, the space users search by default. Semi-active content can move to the Archive for deeper research when needed, and from there it either stays archived or is deleted according to its assigned policy.
Enforcing a policy that disposes of unneeded records makes the rest of your DMS more useful. Fewer irrelevant results mean faster, more accurate searches, and less time spent separating the wheat from the chaff.
How long should you actually keep a document? (It depends.)
Do regulatory obligations apply, and do they differ from common best practice?
Invoices are often kept for seven years, but that is a recommendation, not a legal requirement in most cases. Payroll records, by contrast, frequently fall under defined regulatory retention periods. Knowing the difference between “best practice” and “required by law” matters for every category of document you manage.
Are there contractual commitments driving your retention policy?
Agreements with third parties, such as unions or government bodies, can specify retention periods for documents or records tied to that relationship or to staffing. These obligations are easy to miss if nobody is specifically looking for them.
Do you have a subject matter expert for retention?
Organizations with a dedicated records manager benefit from someone who already knows most obligations and can anticipate new ones. Without that role, lean on your accountant, lawyer, or HR lead, whoever has the closest relationship to a given type of content, and ask what should be kept, for how long, and whether that is a best practice or a legal requirement.
Does the document still hold business value?
Once a document stops offering organizational value, it should be purged, and only your organization can define what “value” means in context. A useful rule of thumb: if a document costs more to index and store than it will ever be worth, deletion is probably the right call. FileHold’s default setting is to retain everything until an administrator applies a deletion policy, so nothing disappears without warning.
The other side of retention is the maximum: content that should be deleted as soon as possible, provided no regulation requires you to keep it longer. Personally identifiable information (PII) is the clearest example. Whether PII identifies someone directly, like HR files, or indirectly, like a list of IP addresses, it needs restricted access and a clear disposal timeline. The GDPR’s “right to be forgotten” is the sharpest version of this rule, and an organization without a disposal process for PII risks real fines and sanctions.
Turn a manual policy into an automated one
- FileHold applies life cycle retention through schemas and events, so staff don't have to remember or manually enforce the schedule.
- A schema controls the metadata and rules for a specific document type, like an invoice versus an onboarding form.
- Because events are dynamic, updating one piece of metadata, like a new SOP review date, automatically resets the retention clock.
Building a retention schedule in FileHold: three steps
With those factors defined, a DMS like FileHold gives you the tools to automate retention so it matches your regulatory, legal, and operational obligations. Here is a straightforward way to build a complete document lifecycle retention policy.
1. Use a separate schema for each policy.
A schema in FileHold reflects the use case for a document type. An invoice needs different metadata and control fields than an onboarding form, and schemas keep that distinction clear for every user.
2. Create an event based on what the document needs.
FileHold automates retention through four event types, three of which apply directly to retention:
- Convert to record: locks the document as a record to prevent future modification.
- Archive: moves the document from the active Library to the Archive.
- Delete: places the document in soft delete, to be purged on the hard delete schedule.
- User defined: sends a reminder to the document’s owner.
3. Apply the event to the schema.
FileHold allows only one delete, one convert to record, and one archive event per schema, which keeps the policy unambiguous. Once the event is attached, the retention policy is live for that document type: new documents inherit it automatically, and legacy content can be updated if circumstances change.
Doing nothing is still a decision
Skipping a life cycle policy out of neglect or indecision is itself a decision, and it is the decision to keep everything by default. Good document and records management means keeping what is important, preserving what is obligatory, indexing what is operationally useful, and purging the rest. As the volume, velocity, variety, and value of enterprise content keeps growing, a defined retention schedule stops being optional.
Not knowing your data management obligations does not exempt your organization from the consequences of violating them. A clearly defined policy that matches industry standards, enforced by a system built for it, lets you sidestep most of that risk, and turns an audit from a scramble into a formality. Every organization plans for disaster recovery. A document lifecycle policy deserves the same priority.
Frequently Asked Questions
What is a document retention schedule?
A document retention schedule defines how long each type of document or record should be kept, based on regulatory requirements, contractual obligations, and internal business value, and what happens to it (archive, convert to record, or delete) once that period ends.
How does a retention schedule help me pass an audit?
An auditor does not just want your records; they want proof you can explain why each one exists and where it stands in its life cycle. A documented, consistently enforced retention schedule gives you that proof and shows you are applying policy evenly rather than making decisions ad hoc.
How long should I keep invoices and payroll records?
Invoices are commonly kept for seven years as a best practice, though this is rarely a strict legal requirement. Payroll records more often fall under defined regulatory retention periods, so check applicable regulations before setting a policy.
What is the difference between a document and a record?
A document is information captured as content for reference. A record is evidence of a transaction between two parties. Both need retention policies, but the obligations attached to each can differ.
What happens if my organization doesn’t have a retention policy?
By default, you keep everything indefinitely. That avoids the risk of destroying something you needed, but it creates its own risks: slower searches, ballooning storage, and exposure if you are retaining regulated data like PII longer than allowed.
How does FileHold automate document retention?
FileHold ties retention to schemas and events. Each document type (schema) gets one archive, one delete, and one convert to record event, triggered by system or metadata fields. Once configured, retention runs automatically without staff tracking individual documents.
