--- title: Do you need a document retention schedule? description: Do you need to develop document retention schedule or standards and procedures for your Business Continuity Program? Yes. image: https://mha-it.com/hubfs/Imported_Blog_Media/bcm-documenation-strategy-1-1.jpg --- [Skip to content](https://mha-it.com/blog/document-retention-schedule#main-content) [![MHA by BCMMetrics - navy](https://mha-it.com/hs-fs/hubfs/MHA%20by%20BCMMetrics%20-%20navy.png?width=245&height=54&name=MHA%20by%20BCMMetrics%20-%20navy.png "MHA by BCMMetrics - navy")](https://mha-it.com/) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) [Contact Us](https://mha-it.com/contact) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) Business Continuity # Do you need a document retention schedule? Richard Long Updated on: February 25, 2025 #### Relevant Contents #### Need Tailored Business Continuity Insights? Contact Us Now for Personalized Guidance! [Schedule a Free Consultation](https://mha-it.com/contact) **Do you need to develop document retention schedule or standards and procedures for your Business Continuity Program? If you want to ensure compliance with standards and best practices, yes, you do.** Generally speaking, if there is a standard that requires the creation of a certain type of documentation, there will be some corresponding requirement to retain those records for a period of time, even if that requirement is not expressly stated. The standards require recordkeeping to provide evidence of the effective operation and implementation of your program, the competency of your personnel, and audit requirements and results. ## Documentation should cover these aspects of your program: - The scope and objectives of the program and procedures - The BCM policy - The provision of resources - The competency of BCM personnel and associated training records - The business impact analysis - The risk assessment - The business continuity strategy - The incident response structure - Business continuity plans and incident management plans - BCM exercising - The maintenance and review of BCM arrangements - Internal audit - Management review of the program - Preventive and corrective actions - Continual improvement So where do you start? First, determine if your organization has a records and information management program and/or a records retention schedule. If so, you must work with your company’s records professional to determine what records you have and how long you should retain those records. It is not unusual to find that a company has little to no reference to business continuity documentation in the schedule. But you can use what the schedule says about other documents (like risk assessments, other company policies/procedures, audit or other assessment reports, etc.) as a guideline to develop retention periods. ## Regardless of whether you are working with a records professional, use the list above as a starting point and determine: - What specific documentation do you keep in each category? - What does your maintenance schedule say about the documentation? How often do you create/supersede it (quarterly, annually)? - Is there a legal or compliance based rationale to retain the documentation once it is no longer active or in use (e.g., to prove that training or testing took place and what the results were)? - Is there a legal or compliance requirement to retain the document for a specified period of time? - Does lasting value exist in old versions of the document? ## Using this information, you might use the following sample guidelines: - Plans: retain for one year after superseded (replaced). - Governance related documents (e.g., Policy, Standards, Charter): retain based upon the maintenance schedule. - If you update Standards annually, keep them on file for one year after you update them. - Retention schedules should take into consideration what we would consider “exception” documentation – when documents need to be kept for a longer period of time in response to an item from an exercise, the Steering Committee, and/or an Auditor. - Retention schedules should take into consideration that a legal/litigation hold issued in response to actual or pending litigation may suspend destruction of certain information until that hold is released. --- ![](https://mha-it.com/hubfs/Richard%20Long-MHA-Consulting.png) #### Richard Long Richard Long is one of MHA’s practice team leaders for Technology and Disaster Recovery related engagements. He has been responsible for the successful execution of MHA business continuity and disaster recovery engagements in industries such as Energy & Utilities, Government Services, Healthcare, Insurance, Risk Management, Travel & Entertainment, Consumer Products, and Education. Prior to joining MHA, Richard held Senior IT Director positions at PetSmart (NASDAQ: PETM) and Avnet, Inc. (NYSE: AVT) and has been a senior leader across all disciplines of IT. He has successfully led international and domestic disaster recovery, technology assessment, crisis management and risk mitigation engagements. ## Start building a stronger future ##### Navigate uncertainty with an expert - schedule your free consultation with our CEO, Michael Herrera. [Schedule your consultation](https://mha-it.com/contact) ## Other resources you might enjoy ![BC’s Big Four: The Most Disruptive Problems in Business Continuity](https://mha-it.com/hs-fs/hubfs/Imported_Blog_Media/most-disruptive-incidents-in-business-continuity-1.jpg?height=245&name=most-disruptive-incidents-in-business-continuity-1.jpg) #### [BC’s Big Four: The Most Disruptive Problems in Business Continuity](https://mha-it.com/blog/most-disruptive-problems) [Read More](https://mha-it.com/blog/most-disruptive-problems) ![Getting the Most Out of Your BCM Consultant: Do’s and Don’ts](https://mha-it.com/hs-fs/hubfs/Imported_Blog_Media/your-bcm-consultant.jpg?height=245&name=your-bcm-consultant.jpg) #### [Getting the Most Out of Your BCM Consultant: Do's and Don'ts](https://mha-it.com/blog/your-bcm-consultant) [Read More](https://mha-it.com/blog/your-bcm-consultant) ![crisis event documentation](https://mha-it.com/hs-fs/hubfs/Imported_Blog_Media/Crisis-Event-Documentation-1.jpg?height=245&name=Crisis-Event-Documentation-1.jpg) #### [Crisis Event Documentation: The Documents You Need to Weather the Storm](https://mha-it.com/blog/crisis-event-documentation) [Read More](https://mha-it.com/blog/crisis-event-documentation) ## Ready to start focusing on higher-level challenges? [![MHA by BCMMetrics - White](https://mha-it.com/hs-fs/hubfs/MHA%20by%20BCMMetrics%20-%20White.png?width=308&height=68&name=MHA%20by%20BCMMetrics%20-%20White.png "MHA by BCMMetrics - White")](https://mha-it.com/) Business continuity consulting for today’s leading companies. #### Company - [Who We Are](https://mha-it.com/who-we-are) - [Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [News](https://mha-it.com/news) - [Blog](https://mha-it.com/blog) - [Contact](https://mha-it.com/contact) #### Services - [Business Continuity](https://mha-it.com/business-continuity) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [Crisis Management](https://mha-it.com/crisis-management) - [BCaaS](https://mha-it.com/bcaas) - [Training & Awareness](https://mha-it.com/training-awareness) - [Program Augmentation](https://mha-it.com/program-augmentation) © 2026 MHA Consulting. All rights reserved.  [Privacy Policy](https://mha-it.com/privacy-policy) ```json { "@context" : "", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://mha-it.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://mha-it.com/blog", "name" : "Blog", "position" : 2 }, { "@type" : "ListItem", "name" : "Do you need a document retention schedule?", "position" : 3 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Richard Long", "url" : "https://mha-it.com/blog/author/richard-long" }, "dateModified" : "2025-02-25T11:58:46.883Z", "datePublished" : "2016-05-31T15:56:10.000Z", "headline" : "Do you need a document retention schedule?", "image" : [ "https://mha-it.com/hubfs/Imported_Blog_Media/bcm-documenation-strategy-1-1.jpg" ], "mainEntityOfPage" : { "@id" : "https://mha-it.com/blog/document-retention-schedule", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://mha-it.com/hubfs/Frame%2016353%20(1).svg" } } } ```