Ask how long to keep audit evidence and you will usually hear a single number, offered with confidence. There is no single number. Some frameworks set an explicit retention period for specific records. Others say nothing, and the answer comes from how the audit cycle works. And privacy law pushes in the other direction, limiting how long you keep evidence that contains personal data.
This article separates those three sources, so you can set a retention rule for each kind of evidence and defend it.
Where a retention period can come from
Three things can set the period for a given record.
An explicit framework or legal requirement. A rule that names a period for a defined set of records.
The audit cycle. How far back an auditor, a certification body or a customer can reasonably ask about.
Contracts and legal holds. A customer agreement that sets its own period, or litigation that requires you to preserve records.
Privacy law then sets an upper bound on records that contain personal data. A retention rule has to sit between the longest obligation and that bound.
Where the frameworks set a period
Only some frameworks name a period, and each applies to a defined set of records, not to "audit evidence" in general.
| Source | What it requires | Applies to |
|---|---|---|
| HIPAA Security Rule, 45 CFR 164.316(b)(2) | Retain for six years from creation or the date last in effect, whichever is later | Policies and procedures, and records of actions, activities or assessments the rule requires to be documented |
| PCI DSS v4.0, Requirement 10.5.1 | Retain audit log history for at least 12 months, with the most recent three months immediately available for analysis | Audit logs for in-scope system components |
| ISO 27001, clause 7.5.3 | The organization determines retention and disposition of documented information | All documented information the ISMS requires |
| AICPA trust services criteria | No retention period prescribed | Not applicable |
Two points are worth drawing out. The HIPAA period runs from when a document was last in effect, so a policy retired today starts its six years today, not from when it was written. And the PCI DSS period is about logs, not every artifact an assessor might request. The HIPAA and PCI DSS framework pages cover what else each one requires. If you are subject to sector regulation, such as financial services rules, check those too. They can set their own periods.
What the audit cycle implies
Where a framework sets no period, the practical minimum comes from how far back someone can ask.
SOC 2
The trust services criteria do not set a retention period. The practical requirement is that evidence for every instance of every control exists until the auditor has finished sampling the period and the report is issued, because any instance can be selected. As how auditors sample controls explains, you do not choose which ones.
The need does not end with the report. The next year's auditor may ask about items from the previous period: an exception and its remediation, an annual control performed shortly before the new period started, or a change in a system described in both reports. Customers may also ask about a report while it is still the current one. Keeping at least the current period and the full previous period is a common, defensible floor.
ISO 27001
ISO 27001 leaves the period to you, through clause 7.5.3, and Annex A control 5.33 requires that records are protected from loss, destruction, falsification and unauthorized access. A certificate runs for three years, and the recertification audit looks at the performance of the ISMS over the cycle, including the results of surveillance audits. Keeping ISMS records for the full three-year cycle makes that review straightforward. Internal audit results, management review minutes, and corrective action records are the ones auditors most often trace back.
Logs
Logs are both a control and evidence. Their retention belongs in your logging standard, set to the longest requirement that applies, which for card data environments includes the PCI DSS period above. Centralized logging for compliance covers how to set that up.
Contracts and legal holds
Customer contracts can set their own periods. A security addendum may give a customer the right to audit you, or to request evidence of specific controls, for the life of the agreement and some time after it ends. A data processing agreement may require records of processing activities or of sub-processor reviews. Check your largest contracts for retention and audit clauses, and record any period they set against the evidence types it affects.
A legal hold overrides everything else. If litigation, an investigation or a regulatory inquiry is reasonably anticipated, relevant records must be preserved, even when your schedule says to delete them. Your retention process needs a way to suspend deletion for a defined set of records, and a named person who can trigger it.
Why privacy law sets a ceiling
A great deal of audit evidence contains personal data. Access review exports list names and email addresses. Onboarding samples include HR records. Training completion reports name every employee. Screenshots capture whatever was on screen.
GDPR Article 5(1)(e), the storage limitation principle, requires that personal data be kept in identifiable form for no longer than necessary for the purpose. Other privacy laws contain similar principles. "We might need it for an audit one day" is a weak justification for keeping a terminated employee's records forever. A defined retention period tied to the audit cycle is a much stronger one. Confirm with counsel how your obligations apply to your records.
You can reduce the tension at collection time:
Use employee IDs instead of names where the auditor does not need names.
Export only the fields a control needs, not the whole record.
Keep HR documents in the HR system and evidence a reference to them, where your auditor agrees.
Crop or redact screenshots to the setting being shown.
The auditor's records are not yours
Your auditor keeps its own workpapers under its professional standards, and those can include copies of your evidence. That does not help you. You cannot count on access to the firm's files, they will not follow you if you change firms, and they hold only what was sampled. Your retention has to stand on its own.
Setting your own rule
A retention rule you can defend usually comes from a short exercise.
List evidence types, not individual files: access reviews, change approvals, onboarding records, training records, risk assessments, configuration exports, logs, vendor reviews.
Note every obligation that applies to each type: framework, law, contract, audit cycle.
Set the period to the longest obligation, and no longer where the record contains personal data.
Record the rule in your retention policy or schedule, with the reason for each period.
Delete on schedule, and keep a record that deletion happened.
Protect what you keep. Restrict access, and use storage that preserves integrity, so a record retained for six years is still trustworthy at the end of it.
How TrustLynce helps
Evidence collection gathers records on a schedule, timestamped and attributed, and keeps each one with the control it supports. That makes it practical to apply a retention rule per evidence type rather than per folder.