University of Calgary
UofC Navigation

Internal Audit Process

Retention Rule Number: 
Specific Retention Rule 2015.04
Function/Activity: 
To document Internal Audit’s examination and evaluation of the adequacy and effectiveness of the organization’s governance, risk management and internal controls as well as the quality of performance in carrying out assigned responsibilities to achieve the organization’s stated goals and objectives.
Description/Type of Records: 
Reports, minutes, memos, audit plan, records collected as evidence during audits and investigations, risk and control matrix, correspondence, metrics tracker, workbooks, working papers, process diagrams, risk assessments, audit program

Retention Rules

Office of Primary Responsibility (OPR)
Retention
Disposition
Office of Primary Responsibility (OPR): 

Internal Audit (IA)

Office of Primary Responsibility (OPR): 

Audit Plan:

Retention: 

Retain for 5 years to track completion of engagements  

Disposition: 

 Confidential shred or delete.

Office of Primary Responsibility (OPR): 

Facilitations:

Retention: 

Retain for 5 years following completion of final report

Disposition: 

Transfer final “management” reports to University Archives for permanent preservation. Destroy records created and accumulated during the facilitation by confidentially shredding or deletion. 

Office of Primary Responsibility (OPR): 

Investigations:

Retention: 

Retain for 5 years following completion of final report. 

Disposition: 

Transfer final “management” reports to University Archives for permanent preservation. Destroy records created and accumulated during the investigation by confidentially shredding or deletion. 

Office of Primary Responsibility (OPR): 

Audit Engagements:

Retention: 

Retain for current and one previous engagement cycle of unit under review

Disposition: 

Transfer final “management” reports to the University Archives for permanent preservation.  Destroy records created and accumulated during the engagement by confidentially shredding or deletion. 

Office of Primary Responsibility (OPR): 

Metrics:

Retention: 

Retain for 5 years to ensure all remediation actions included in the metrics have taken place.  

Disposition: 

Confidential shred or delete. 

Office of Primary Responsibility (OPR): 

Audit Manual and Process Descriptions:

Retention: 

Retain until superseded.  

Disposition: 

Confidentially shred or delete.