Operational evidence · not certification

Business Records Retrievability Audit

Use this business records retrievability audit to check whether important company records have a clear owner, an accepted version, controlled access, reliable backups, and a practical retrieval path.

This self-reported evidence checklist covers ongoing record custody rather than formation consent or tax-deadline calculations. It looks for an operating recordkeeping practice: people know where the recordkeeping copy lives, how accepted records differ from drafts, who can search and retrieve them, how changes are tracked, how access is limited, how backups are made, and whether restoration has been tested. A gap is a prompt for a concrete next action, not a legal, tax, financial, security-certification, or legal-review conclusion. Government guidance supports keeping records that substantiate business activity and using controlled, retrievable, backed-up systems, but it does not establish that a particular company’s records are complete or legally sufficient.

By Lovie · Checklist version 1.0.0 · Sources checked 2026-10-13

Start the eight checks
Self-assessment · 8 checks

What can you verify today?

Choose Yes only when you can point to evidence. No means missing; Unknown means not yet checked. Do not enter documents, account details, or credentials.

0 of 8 answered. No score is shown until every check is answered.

1. Does each important record have a named custodian?

Think about formation records, ownership records, contracts, finance records, policies, and key operating decisions.

Priority check
Evidence and next action

Create a simple register listing each record group, its accountable custodian, and the approved storage location.

Source and scope
2. Can you identify the accepted recordkeeping copy?

For each record group, can a founder tell which copy is authoritative and which copies are drafts, duplicates, or reference material?

Priority check
Evidence and next action

Label the official or recordkeeping copy and define how a draft becomes accepted.

Source and scope
3. Can an authorized person find and retrieve it without asking one person?

Use a plain search or folder path and consider whether another authorized teammate could locate the record.

Priority check
Evidence and next action

Write a short index with record names, search terms, location, and the person responsible for keeping it current.

Source and scope
4. Is the record’s version or change history understandable?

Check whether you can distinguish current, superseded, and draft versions and see who changed an important record when practicable.

Evidence and next action

Use stable filenames or system history and record approval or supersession status for material changes.

Source and scope
5. Are access rights limited to people who need them?

Consider viewing, editing, deleting, and sharing separately; include former team members and outside administrators.

Priority check
Evidence and next action

Review the access list, remove stale access, and document who may view or change the recordkeeping copy.

Source and scope
6. Are important records backed up separately from the primary system?

Look for a documented backup scope, schedule, separation from primary storage, and a way to reach critical records if the main system is unavailable.

Priority check
Evidence and next action

List the protected record groups and confirm that a separate backup exists and is secured.

Source and scope
7. Has someone recently tested finding or restoring a representative record?

A test should show what was selected, who performed it, what worked, and what failed—not just that a backup job reported success.

Priority check
Evidence and next action

Run and log a small search-and-restore exercise, including a partial restore where useful.

Source and scope
8. Is there a documented retention and disposition rule for each record group?

The rule should state how long the record is kept, who approves disposal, and what happens when a hold or business need prevents disposal.

Evidence and next action

Create a plain-language retention schedule and pause disposal when a legal hold or unresolved business need applies.

Source and scope

How the score works

Coverage = yes answers / applicable checks × 100, rounded to the nearest whole percent. Every check has equal weight. No and unknown remain gaps. Only an explicitly permitted not-applicable answer is excluded. Priority gaps are displayed separately and do not change the formula. Answer all eight checks before a score appears.

Example: six Yes answers, one No, and one Unknown produce 75% evidence coverage, not a 75% chance of success. A missing priority item stays visible even at a high score.

This is self-reported evidence coverage, not an independent audit, legal or tax advice, a security certification, or a prediction of financial outcomes. Sources explain the practices; they do not validate your answers or certify any product.

How do I audit whether my business records can be retrieved?

Map each important record to an owner, official location, accepted version, access rule, change history, backup, retention rule, and recent retrieval test. Mark unsupported items as gaps and document the next action; this is an operational check, not legal or tax advice.

  • Name the recordkeeping copy and its accountable owner.
  • Separate accepted records from drafts and preserve useful version history.
  • Test search and restoration instead of assuming backups work.

Custody, accepted records, and searchability

Start with a record register. For each important record group, name the custodian, approved location, and recordkeeping copy. A draft folder, email attachment, or personal drive should not silently become the company’s only evidence of an important action.

Make retrieval repeatable. Use meaningful names, an index or metadata, and a short instruction for how an authorized person searches and retrieves the record. IRS guidance says a business may choose a system suited to its operations when it clearly shows income and expenses; that does not by itself validate every record category or make a system legally sufficient.

Minimum record register fields
FieldFounder-friendly test
Record groupWhat kind of record is this?
CustodianWho keeps it current and answers questions?
Recordkeeping copyWhich copy is accepted rather than draft?
Location and search termsHow can another authorized person find it?
Retention ruleWhen is review or approved disposition considered?

Versions, access, and protection

A retrievable record should remain understandable over time. Preserve version history or a change log for material records, identify superseded copies, and document acceptance or approval. NIST’s data-integrity guidance describes capabilities such as identifying altered data, timing, and associated users; it is a technical practice guide, not proof that a company’s records are authentic.

Separate permission to view from permission to edit, delete, or share. Review access after role changes and use protected backups. CISA recommends identifying critical data, keeping separate backup copies, securing them, and documenting recovery procedures. Those recommendations do not certify a provider, system, or company as secure.

Retrieval testing and retention discipline

Treat a backup as an unproven assumption until a person can restore and use a representative record. Record the test date, record selected, source backup, result, and corrective action. Test both a whole set and a single important item when practical, and include an offline path if the primary service is unavailable.

Set retention rules by record group and identify who can approve disposition. IRS guidance says retention depends on the action, expense, or event documented and that records should be kept as long as needed to substantiate tax-return items. That tax guidance does not supply a universal retention schedule for every corporate record, so verify rules that apply to the company and pause disposal when a hold or unresolved business need applies.

Sources and what they establish

The cited sources support the underlying practices. The checklist and equal-weight formula are Lovie’s educational framework, not a government scoring system.

  • Back Up Business Data

    CISA recommends inventorying critical data, separate backups, securing them, documenting recovery, and scheduled recovery tests. It does not establish a company’s records are complete or certify a specific backup system.

  • Recordkeeping

    IRS explains why businesses keep records, that systems should clearly show income and expenses, and that retention depends on the documented action or event. It does not provide a universal corporate-record schedule or legal advice.

  • IRM 1.15.6, Managing Electronic Records

    IRS internal policy illustrates controlled access, search and retrieval, integrity, backup and recovery, and lifecycle concepts for federal records. It applies to IRS personnel and contractors; it does not impose the same policy on private companies.

  • NIST SP 1800-11B, Data Integrity

    NIST describes a reference design for detecting alteration and recovering trusted data using logging, secure storage, integrity checking, and backups. It is guidance, not a guarantee of compliance, authenticity, or security certification.

Questions founders ask next

What does a business records retrievability audit measure?

It measures self-reported evidence coverage for custody, accepted-versus-draft status, search ownership, version history, access, backups, retrieval testing, and retention rules. It does not determine legal, tax, financial, or security outcomes.

What counts as an accepted record?

An accepted record is the copy the company has designated as its recordkeeping copy for an activity. The designation should be understandable to authorized users and should distinguish it from drafts, duplicates, and superseded versions.

Is a cloud folder automatically a records-management system?

No. A cloud folder may be useful storage, but the company still needs ownership, accepted-copy rules, searchability, access controls, version history, backups, retention instructions, and tested retrieval.

How often should we test retrieval?

There is no single interval that fits every business in this checklist. Choose a repeatable cadence based on record criticality and change, document each test, and retest after a material system or process change.

Should backups replace the official recordkeeping copy?

No. A backup is a recovery copy and should not silently replace the controlled recordkeeping process. Maintain the accepted copy in its approved location and verify that backups can restore usable records.

Does a complete score prove our company records are legally sufficient?

No. The score only reflects the evidence answers supplied in this operational checklist. It is not legal, tax, financial, cybersecurity certification, or professional advice, and it does not establish completeness, authenticity, or compliance.