Books and Records Retention Compliance Checklist
Use this checklist to verify that client agreements, communications, and transaction records are retained, indexed, and retrievable for SEC examination readiness. It helps you spot retention gaps, missing records, and weak preservation controls before an audit does.
Trusted by frontline teams 15 years of frontline software AI customization in seconds
Built for: Investment Advisory · Broker Dealer · Wealth Management · Financial Services Compliance
Overview
This checklist is for reviewing whether books and records are being retained, organized, and retrieved in a way that supports SEC examination readiness. It focuses on the record types most often tested in practice: client agreements, communications, and transaction or trade records, along with the controls that make those records usable later, such as indexing, searchability, version history, and backup protection.
Use it when you need a repeatable inspection of retention compliance across a defined period, a sample of record categories, or a specific system change such as a migration to a new archive or document platform. It is especially useful before an internal audit, after a policy update, or when you want to test whether the first two years of records are readily accessible as required by your retention framework.
Do not use it as a substitute for legal review of your firm’s exact retention obligations, and do not treat backup storage as proof of compliant retention. It is also not the right tool for general cybersecurity testing or for evaluating records outside the scope of books-and-records retention. The checklist is meant to surface concrete deficiencies: missing records, weak indexing, slow retrieval, incomplete audit trails, and preservation gaps that could become exam findings.
Standards & compliance context
- This checklist supports testing against SEC books-and-records retention expectations and should be mapped to the firm’s applicable retention rule set and supervisory procedures.
- For electronic records, confirm that preservation controls align with recognized records management practices and that audit trails or version history are available where required.
- If the firm handles communications subject to supervision or archiving requirements, the checklist should be coordinated with the firm’s communication retention and surveillance controls.
- Backup systems are not a substitute for compliant retention unless they are configured and governed to meet the applicable records preservation standard.
- Where the firm operates under broader compliance frameworks, the checklist can be paired with ISO 9001-style document control or internal control testing, but it should remain focused on retention and retrieval.
General regulatory context for orientation only — verify current requirements with counsel or the relevant agency before relying on this template for compliance.
What's inside this template
Inspection Setup and Scope
This section defines what period, entities, and record types are being tested so the review is traceable and repeatable.
-
Inspection period and scope documented
Record the date range, entity, office, and systems included in the review.
-
Record categories selected for testing
Select the record types included in the sample.
-
Retention policy and schedule available to inspector
Confirm the current retention policy, schedule, or written supervisory procedure is available for review.
Retention Period Compliance
This section verifies that each record category is being kept for the required duration under the firm’s retention schedule.
-
Client agreements retained for required period
Confirm client agreements and amendments are retained for at least five years, with the first two years readily accessible.
-
Communications retained for required period
Confirm business-related communications subject to retention are preserved for the required period and are searchable or retrievable.
-
Transaction and trade records retained for required period
Confirm transaction records, confirmations, and related support are retained for at least five years and are available for the first two years without delay.
Accessibility, Indexing, and Retrieval
This section checks whether records can be found and produced quickly enough to satisfy an examination request.
-
First two years of records readily accessible
Verify records required to be readily accessible can be produced promptly without manual reconstruction.
-
Records indexed by client, account, date, or document type
Confirm the archive supports logical indexing and retrieval by common examination fields.
-
Sample retrieval time
Measure the time required to retrieve a requested record from the archive.
-
Missing or unretrievable records identified
Document any records that could not be located, produced, or verified during the sample.
Record Integrity and Preservation
This section confirms that records remain complete, authentic, and protected in a compliant electronic or original form.
-
Records preserved in original or compliant electronic form
Confirm records are maintained in a manner that preserves content, context, and evidentiary integrity.
-
Audit trail or version history available for electronic records
Verify the system maintains audit logs, version history, or equivalent controls for record changes.
-
Backup and disaster recovery controls protect retained records
Confirm retained records are included in backup, recovery, and business continuity controls.
Supervision, Exceptions, and Corrective Action
This section captures deficiencies, assigns remediation, and shows whether the firm has closed the loop on prior gaps.
-
Retention exceptions or gaps documented
Describe any missing records, late deletions, system failures, or retention exceptions identified during testing.
-
Corrective action assigned for deficiencies
Confirm each deficiency has an owner, due date, and remediation plan.
-
Examination readiness confirmed
Confirm the firm can produce requested records in a timely manner and explain retention controls during an SEC examination.
Inspector Sign-Off
This section records the final result, summary comments, and accountability for the completed inspection.
-
Overall inspection result
Select the final outcome of the inspection.
-
Inspector comments and summary
Summarize key findings, material deficiencies, and follow-up actions.
-
Inspector signature
Inspector sign-off confirming the inspection was completed accurately.
How to use this template
- 1. Define the inspection period, the business units in scope, and the record categories you will test, then attach the applicable retention policy and schedule to the checklist.
- 2. Assign an inspector who can access the archive, document management, email, and trading systems needed to sample and retrieve records without relying on the record owner.
- 3. Test each retention category by selecting sample records, confirming the required retention period, and verifying that the records still exist in the approved system or compliant format.
- 4. Measure retrieval performance by searching for records by client, account, date, or document type and recording whether the first two years of records are readily accessible.
- 5. Document every deficiency, assign corrective action with an owner and due date, and confirm closure before marking the inspection as examination ready.
Best practices
- Tie each sample to a specific client, account, date range, and record type so the inspection can be reproduced later.
- Verify the retention schedule against the actual system configuration, not just the written policy, because policy and archive settings often drift apart.
- Test retrieval from the same tools staff use in practice, including archive search, email journaling, and document repositories, rather than relying on manual file browsing.
- Treat missing metadata as a retention problem when it prevents search, indexing, or production of the record on demand.
- Confirm that electronic records preserve original content and required version history, especially after migrations or format conversions.
- Record the exact retrieval time and any manual intervention needed, since slow or workaround-heavy access can indicate an exam readiness issue.
- Escalate any gap affecting required records immediately, even if the issue appears isolated, because retention failures often indicate a broader control weakness.
What this template typically catches
Issues teams running this template most often surface in practice:
Common use cases
Frequently asked questions
What does this checklist cover?
This checklist covers the core books-and-records areas typically tested in a retention review: client agreements, communications, transaction records, indexing, retrieval, and preservation controls. It is designed to confirm that records are retained for the required period and can be produced quickly for examination. It also captures exceptions, gaps, and corrective actions so the review leaves an audit trail.
Who should run this inspection?
Compliance, operations, records management, or a designated supervisory reviewer can run it, depending on how your firm assigns control ownership. The inspector should understand the firm’s retention schedule and know where records are stored across email, archive systems, document management tools, and trading platforms. For higher-risk areas, a second reviewer may be useful to validate sample retrieval and exception handling.
How often should this checklist be used?
Use it on a recurring cadence that matches your compliance program and record volume, such as quarterly, semiannually, or before an internal audit or regulatory exam. It is also useful after system migrations, retention policy changes, or vendor changes that affect archiving and retrieval. If your firm has a high volume of communications or trade activity, more frequent testing is usually warranted.
Does this checklist align with SEC retention requirements?
Yes, it is built to support testing against SEC books-and-records retention expectations, especially for records that must be preserved and made available for examination. It focuses on practical controls like retention periods, accessibility, indexing, and preservation rather than legal interpretation. You should still map the checklist to your firm’s specific rule set, policies, and supervisory procedures before use.
What are the most common mistakes this checklist helps catch?
Common issues include records stored in the wrong archive, retention periods that do not match the policy, communications that were never captured, and files that cannot be retrieved within a reasonable time. Teams also miss version history for electronic records, or they assume backups are the same thing as compliant retention. This checklist makes those gaps visible during testing instead of during an exam.
Can I customize the record categories and sample size?
Yes, and you should. The template is meant to be adapted to the record categories that matter to your business, such as advisory agreements, trade blotters, email, chat, confirmations, or account statements. You can also adjust the sample size, date range, and retrieval criteria to match your risk profile and internal testing plan.
How does this differ from an ad hoc records review?
An ad hoc review usually checks a few files and stops there, while this checklist creates a repeatable inspection record with scope, evidence, findings, and sign-off. That structure matters because retention compliance is not just about having records somewhere; it is about proving they are complete, preserved, and retrievable. The checklist also helps standardize reviews across teams and periods.
What should we do if records are missing or unretrievable?
Document the deficiency, identify the affected record type and date range, and assign corrective action with an owner and due date. Then determine whether the issue is isolated or systemic, such as a failed archive rule, a migration gap, or a policy mismatch. If the gap affects required records, escalate through your compliance and supervisory process immediately.
Related templates
Go deeper on the topic
-
Predictive scheduling laws — also called fair workweek laws or secure scheduling — require employers in covered industries to publish employee schedules...
-
Overtime calculation is the process of applying federal, state, local, and contractual rules to hours worked to determine the correct pay — including...
-
A near-miss is an event that could have caused injury or damage but didn't — a slip that didn't fall, a load that shifted but didn't drop, a machine that...
-
Lockout/tagout (LOTO) is the procedure for controlling hazardous energy — electrical, hydraulic, pneumatic, mechanical, thermal, chemical — before...
-
See how bank branch managers use MangoApps scheduling to fill shifts, communicate policy updates, and eliminate last-minute coverage chaos.
-
See how connected 1:1 tracking, employee audit history, and LMS completion records turn scattered processes into verifiable workforce documentation.
-
See how customers use MangoApps Projects Module to collaborate, track progress, and share knowledge across teams.
-
MangoApps in Okta Integration Network automates user provisioning, SSO, and access management for stronger security and less admin work.
Ready to use this template?
Get started with MangoApps and use Books and Records Retention Compliance Checklist with your team — pricing built for small business.
