Internal Audit Records Retention Policy

In accordance with the University’s Record Retention Policy, this policy addresses the requirements for record retention for the Office of Internal Audit (“Internal Audit” or “IA”) and those at the University who receive documents from Internal Audit, including but not limited to audit work papers and communication, issues lists, draft and final reports. The policy applies to the entire University community, including faculty and staff.

The purpose of this policy is to set forth principles and procedures that are designed to ensure that Internal Audit complies with the University’s Record Retention Policy’s requirement to protect and manage the records it needs to maintain, while disposing of records that are no longer legally or operationally required.  This will help ensure that the University is following all applicable laws and regulations governing records retention.  

The following is a list of items that cannot be purchased on the P-Card. This list is not all-inclusive; if there are any questions about whether or not the P-Card can be used for a purchase, please contact the P-Card staff at [email protected] or contact the Finance Service Center at 212-854-2122.

  • Personal items
  • Items requiring governmental licenses or permissions or that are controlled under U.S. export controls
  • Split transactions*

Primary Guidance to Which This Policy Responds

This policy responds to the various local, state, and federal statutes and regulations and internal policies that apply to records retention.

Roles and Responsibilities

Office of Record

The Office of Record is responsible for identifying the records to be retained and determining, in collaboration with OGC, the period of retention.  The Office of Record must also make arrangements for the proper storage of the records and coordinate with outside vendors for that purpose, where appropriate. Finally, the Office of Record arranges for the handling of the disposal of records whose retention period has expired.

Office of the General Counsel

The Office of the General Counsel (OGC) is responsible for providing guidance regarding the legal retention requirements for documents and coordinating document holds when litigation is ongoing, pending, threatened, or likely.  The University’s General Counsel will designate one or more individuals to serve as the point of contact. 

Responsible University Office

The Office of Internal Audit is the Office of Record for all documents and communication that are created in Internal Audit and, together with the Associate Vice President of Internal Audit, is responsible for this policy. 

Revision History

This policy revises an earlier version, dated May 2011. The May 2011 policy codified existing retention policies and procedures under the University’s standard policy format.

What Is Governed By This Policy

This policy applies to all University employees, including student workers and temporary workers, who create, use, or store the University’s records for which there is a legal, regulatory, or management retention requirement. It also applies to any contractors, consultants, vendors involved in the creation, use, or storage of any paper and electronic records that belong to the University.

Who Should Know This Policy

  • All University employees, including student workers and temporary workers
  • All contractors who create, use, or store University records
  • All consultants who create, use, or store University records
  • All vendors who create, use, or store University records

Exclusions & Special Situations (Document Holds)

Any records relevant to pending or ongoing litigation, government investigation, or audit MUST BE RETAINED until such matters have been resolved, all appeals are exhausted, and the retention period has expired. All disposal of relevant records must cease, including the disposal of records according to approved retention periods, when such a document hold is in place.  In cases where litigation is threatened or likely, consult the Office of the General Counsel to determine whether a litigation hold is required.

Important Note: Any records that pertain to administrative functions of Internal Audit, such as purchasing, accounts payable, human resources, etc., are not covered by this policy. Such records are instead governed by the appropriate record retention policy for that type of record. Examples of such documents include invoices, purchase orders, budgets, payroll records, etc.

Full Policy Text

Please see the Full PolicyText link to the right for a complete text of this policy.