Call Recording Access and Retention Audit

Inspection template for auditing restricted access to call recordings, access logging, retention controls, and documented destruction practices against policy and applicable recordkeeping requirements.

Audit Scope and Record Inventory

• Audit period and business units in scope are documented
• Call recording systems, storage locations, and archives are identified
• Retention schedule applicable to each recording type is documented
• Sample size and sampling method are recorded
• Any active legal hold or preservation notice is identified

Logical and Physical Access Controls

• Access to recordings is limited to authorized roles with documented business need
• Unique user IDs are used for all recording access
• Multi-factor authentication is enabled for administrative or privileged access
• Shared accounts or generic credentials are prohibited or formally approved with compensating controls
• Physical access to servers, storage media, or backup devices is restricted
• Encryption is enabled for recordings at rest and in transit where applicable

Access Logging and Monitoring

• Recording access events are logged with user, timestamp, action, and record identifier
• Administrative actions such as export, delete, restore, and permission changes are logged
• Access logs are protected from alteration and unauthorized deletion
• A recent log review was completed within the required monitoring interval
• Unusual access, export, or deletion activity has documented review and disposition

Retention, Legal Hold, and Destruction

• Retention periods match the approved policy and applicable regulatory or contractual requirements
• Recordings subject to legal hold are excluded from routine deletion
• Automated deletion or purge settings align with the approved retention schedule
• Destruction events are documented with date, method, and authorization
• Sampled recordings older than the retention period were destroyed or placed on hold as required

Exceptions, Findings, and Sign-Off

• Deficiencies and non-conformances are documented with evidence
• Corrective actions, owners, and due dates are assigned
• Inspector signature