Records Management retention

scheduling
11. Internal audit records

© Crown copyright 2012

You may re-use this information (excluding logos) free of charge in any format or medium, under
the terms of the Open Government Licence. To view this licence, visit
nationalarchives.gov.uk/doc/open-government-licence or email psi@nationalarchives.gsi.gov.uk.

Where we have identified any third-party copyright information, you will need to obtain permission
from the copyright holders concerned.

This publication is available for download at nationalarchives.gov.uk.

Records Management retention scheduling 11. Internal audit records

Contents
1 Introduction ............................................................................................................................. 2

2 Scope and nature of the records ............................................................................................. 3

3 Effects of legislation ................................................................................................................ 4

4 Model retention schedule ........................................................................................................ 5

5 Other publications and further information .............................................................................. 6

1 Introduction

1.1 This guidance is aimed at Departmental Record Officers, Finance Directors and Internal
Audit staff. It covers public records created and received as part of the internal audit
function. It does not cover similar records where external audit (for example, by the
National Audit Office) is involved. It relates closely to the guidelines in Retention
scheduling 3. Accounting records.

1.2 The guidance covers records in all media, although it points to more specialist advice on
electronic records and the framework of the Modernising Government1 agenda.

1.3 It is unlikely that any information management records will be selected for permanent
preservation. Criteria for selecting records for historical purposes can be found in
Acquisition and Disposition strategy and in the more detailed operational selection
policies.

Do not destroy records without reference to these documents. All internal audit records no
longer required for business purposes are subject to the formal appraisal process
(whether by reference to these guidelines or a file-by-file review) to determine whether
they fall within the criteria of selection for permanent preservation.

1
www.archive.official-documents.co.uk/document/cm43/4310/4310.htm

Last updated March 2003 Page 2 of 7

Records Management retention scheduling 11. Internal audit records

1.4 This guidance forms part of a series on retention scheduling (see section 5). For general
information on the compilation of retention schedules see Disposal Scheduling.

1.5 Detailed guidance on the internal audit function can be found in the Internal Audit Guide
and the Government Internal Audit Standards (GIAS).

2 Scope and nature of the records

2.1 Internal audit records include:

reports
terms of reference
programmes/plans
correspondence, including management letters, advice and consultancy
minutes of meetings
working papers

In addition internal auditors may make detailed use of computer audit trails, which may
sometimes be embedded in transaction records and other records such as risk registers.

2.2 Internal auditors will wish to use many other records in government departments and
agencies as part of their work. They will be more concerned with recent records (those
within the last two years) than external auditors.

In this respect the current retention periods of records in government departments will
usually be more than adequate for their needs.

2.3 An important aspect of the internal audit function is the need to refer to documents that
have not been created as part of the internal audit procedures themselves. For example,
internal auditors will make extensive use of contracts, by which they will make an
assessment of value for money and of other matters relating to the execution of the
contract(s).

See Retention scheduling 5. Contractual Records for guidance on their retention.

Last updated March 2003 Page 3 of 7

Records Management retention scheduling 11. Internal audit records

Similar records may include asset registers, stock control records and manuals of
instructions. For all these records the period of retention should be assessed from the
need to retain the records for business purposes, including internal audit.

2.4 Some of these records are still maintained in paper form even though they may have been
created electronically. In accordance with the Modernising Government2 agenda target
(‘By 2004 all newly created public records will be electronically stored and retrieved’), the
records form part of an electronic records management system. Departments and
agencies may wish to digitise the paper records that need to be kept after that date so that
there is a central and corporate collection of these records held electronically.

2.5 Many copies of internal audit reports appear on files in divisions, sections and so on.
Destroy these as soon as their operational needs have expired.

3 Effects of legislation

3.1 Two major pieces of legislation affect the creation and retention of records in general.
However they should not affect current or future retention policies for records. The primary
reason for their retention must still be their use in the conduct of the current business of the
department or agency.

3.2 Data Protection Act 1998

3.2.1 Records managers need to understand the general principles that govern personal data and
its management. They must also ensure that their handling of personal data complies with the
Act.

3.2.2 The areas where information management records may contain personal data include:

assessment of performance management systems and other human resources

functions
contracts with outside companies
finance (for example, pay, travel, subsistence)
health and safety

2
www.archive.official-documents.co.uk/document/cm43/4310/4310.htm

Last updated March 2003 Page 4 of 7

Records Management retention scheduling 11. Internal audit records

3.2.3 The Code of practice for Archivists and Records Managers under section 51(4) of the
Data Protection Act 1998 gives a detailed explanation of how data protection must be
incorporated into corporate policies and guidance on information management processes
relevant to the Act.

3.3 Freedom of Information Act 2000 (FOI Act)

3.3.1 For records managers the main effects of the legislation are contained in the Lord
Chancellor's Code of Practice on the Management of Records under section 46 of the
Freedom of Information Act 2000.

The Code sets out the framework for the management of records by public authorities. For
public record bodies, it describes requirements for the review and transfer of public records.

3.3.2 Some internal audit records may need to be kept for up to six years in accordance with the
Limitation Act 1980. Internal auditors and records management staff should ensure that
they store and manage those records, not in current use, in such a way that they are
readily accessible in the event of FOI requests.

4 Model retention schedule

4.1 The retention of internal audit records should be considered in the light of both business
and legislative requirements, taking into account the cost of retention and the use to which
the records might be put in the future.

4.2 This schedule shows maximum retention periods for internal audit records. The disposal
period covers completed years' records (it does not include the current year).

Type Item Description Disposal

Reports 1 Audit reports (including interim), Six years

where these have included the
examination of long-term contracts
2 Report papers used in the course Six years after legal
of a fraud investigation proceedings have been
completed
3 Other audit reports (including Three years
interim)

Last updated March 2003 Page 5 of 7

Records Management retention scheduling 11. Internal audit records

Type Item Description Disposal

Undertakings 4 Terms of reference Three years

5 Programmes/plans/strategies One year after the last

date of the plan
6 Correspondence Three years

Record keeping 7 Minutes of meetings and related Three years

(continued) papers, including those of the
Audit Committee
8 Working papers Three years

Other records 9 Internal Audit guides When superseded

10 Manuals and guides relating to When superseded

departmental procedures
11 Local auditing standards When superseded

Disposal 12 Annual reports to Accounting Three years

Officers

5 Other publications and further information

5.1 The National Archives produces records management standards and guidance which aim to
promote good practice in the management of public records throughout all stages of their life
cycle. The following are likely to be most relevant to the disposal of internal audit records:

5.1.1 Record keeping

Documentation of records work

5.1.2 Acquisition and appraisal

Acquisition and Disposition strategy

Disposal Scheduling
Retention scheduling 3. Accounting records
Retention scheduling 5. Contractual records
Retention scheduling 6. Project records
Retention scheduling 11. Information management records

Last updated March 2003 Page 6 of 7

Records Management retention scheduling 11. Internal audit records

5.1.3 Access

Access to Public Records

Data Protection

5.1.4 Further information on these and other aspects of the management of public
records is available at nationalarchives.gov.uk/information-management/ or from:

Information Management and Practice Department

The National Archives
Kew
Richmond
Surrey
TW9 4DU

email: information.management@nationalarchives.gov.uk
telephone: +44 (0) 20 8876 3444
fax: +44 (0) 20 8392 5283

Last updated March 2003 Page 7 of 7