Legal, Regulatory and Evidentiary Requirements

Introduction

Human-resource records are not merely administrative artifacts. They are evidence of decisions, relationships, payments, rights, obligations, and organizational controls. A payroll register may demonstrate compliance with wage law; a recruitment file may support or undermine an equal-opportunity defense; a safety report may establish whether an employer responded to a hazard; and an access log may determine whether confidential medical information was improperly disclosed.

The legal significance of an HR record depends on more than its content. Its reliability is affected by who created it, when it was created, why it was created, whether it was altered, how it was stored, who accessed it, and whether the organization can explain its retention and disposal practices. Consequently, HR record management is a legal-governance function as well as an information-management function.

This chapter adopts a jurisdiction-sensitive approach. Employment, tax, social-security, immigration, safety, equality, and privacy obligations vary substantially among countries and sometimes among states, provinces, or municipalities. The principles presented here are therefore a framework for legal analysis rather than a substitute for current local law or legal advice. A competent HR professional must identify the governing jurisdiction, the employer’s legal status, the worker’s status, the location of the work, applicable collective agreements, and any cross-border data-transfer rules before prescribing a retention period or disclosure response.

Learning Objectives

By the end of this chapter, students should be able to:

1. Map HR records to labor, tax, social-security, equality, immigration, safety, and data-protection obligations.
2. Distinguish legal retention requirements from operational, litigation, and archival needs.
3. Design and execute a defensible legal hold and discovery process.
4. Explain authenticity, integrity, relevance, reliability, and chain of custody in relation to HR evidence.
5. Construct an audit trail capable of demonstrating compliance without unnecessarily exposing personal data.
6. Evaluate ethical and governance risks in automated, cloud-based, and AI-assisted HR record systems.

1. The Legal Architecture of HR Records

1.1 Records as evidence of organizational action

An HR record can perform several functions simultaneously:

• Transactional: recording pay, leave, attendance, benefits, or a change in employment status.
• Regulatory: demonstrating compliance to a labor inspector, tax authority, immigration agency, safety regulator, or data-protection authority.
• Defensive: supporting the organization’s response to a grievance, claim, audit, or lawsuit.
• Managerial: enabling workforce planning, performance management, and risk monitoring.
• Accountability-related: showing who approved, changed, accessed, or deleted information.

A record should therefore be assessed according to its business purpose, legal significance, sensitivity, and evidentiary value. A system that stores documents but cannot show their provenance, version history, or access history is weak even if it has substantial storage capacity.

1.2 The jurisdictional mapping method

A useful compliance analysis begins with a legal-obligation matrix. For each worker population and record category, the organization should identify:

1. Governing law: national, regional, local, sectoral, contractual, or collective-bargaining rules.
2. Regulator or rights-holder: government agency, employee, applicant, union, insurer, court, or auditor.
3. Required record: the information that must be created or retained.
4. Retention trigger: the event from which the period runs, such as creation, payment, termination, or resolution of a claim.
5. Permitted purpose: the reason for collection and use.
6. Access and disclosure rules: who may view, receive, or correct the record.
7. Disposition rule: deletion, anonymization, archival transfer, or continued preservation.
8. Conflict rule: the action required when legal retention, privacy minimization, and litigation preservation point in different directions.

Retention periods should not be copied from a generic schedule without this analysis. A payroll record, for example, may have one period under wage law, another under tax law, and a longer period if a dispute is pending.

1.3 Sources of obligation

HR record obligations arise from several sources:

Internal policy cannot reduce a statutory obligation. It can, however, impose a longer retention period or stronger access control if that is lawful, proportionate, and operationally justified.

2. Major Regulatory Domains

2.1 Labor and employment records

Labor laws commonly regulate wages, working time, leave, termination, notice, contracts, and employee classification. Relevant records may include employment agreements, job descriptions, time records, pay statements, leave approvals, disciplinary notices, performance records, accommodation discussions, termination documentation, and grievance outcomes.

The principal control is consistency. If time records are systematically edited without an explanation, or if disciplinary records are created only for certain demographic groups, the records may become evidence of unlawful practice rather than proof of compliance. Employers should preserve original entries, identify corrections, record the reason for correction, and restrict retrospective editing.

Worker classification is especially important. The classification of an individual as an employee, independent contractor, temporary worker, intern, or agency worker affects payroll, tax withholding, social-security contributions, benefits, safety obligations, and record retention. A contract label is not always decisive; the actual degree of control, economic dependence, integration, and independence may matter under applicable law.

2.2 Tax and social-security obligations

Tax authorities commonly require records supporting gross pay, deductions, withholding, taxable benefits, expense reimbursement, employer contributions, and year-end reporting. Social-security systems may require records of earnings, contribution periods, eligibility, injury, sickness, pension participation, or family-related benefits.

The HR function should reconcile three sources rather than treating payroll as self-proving:

• the employment or time record,
• the payroll calculation and payment record, and
• the remittance or reporting confirmation.

A defensible payroll trail links these sources through stable identifiers and records approvals, exceptions, corrections, and transmission results. Sensitive financial information should be segregated from broad personnel access. Payroll administrators may need detailed access, while line managers may need only attendance or approval information.

2.3 Equal opportunity and anti-discrimination

Equal-opportunity laws generally prohibit discrimination in recruitment, pay, promotion, training, discipline, accommodation, and termination on protected grounds defined by the relevant jurisdiction. Some systems also regulate harassment, retaliation, pay transparency, algorithmic decision-making, and positive action.

Records should enable the organization to compare similarly situated cases without unnecessarily exposing protected information. Useful records include job advertisements, selection criteria, interview evaluations, scoring rubrics, accommodation decisions, promotion panels, pay-review analyses, complaints, investigations, and remedial actions.

A major risk is informal decision-making. Statements such as “not a cultural fit” or “too old for the role” may be discoverable and may reveal discriminatory reasoning. The solution is not to eliminate candid records; it is to require job-related, evidence-based, respectful documentation and training in objective decision-making.

2.4 Immigration and right-to-work compliance

Immigration records may include identity documents, work authorization, visa conditions, sponsorship materials, expiration dates, and verification results. These records are highly sensitive and should be separated from ordinary personnel files wherever possible.

The organization must distinguish verification from surveillance. A lawful verification process should collect only what is required, apply the same process consistently, limit access, monitor expiration dates, and establish a documented escalation process. Copies of identity documents should not be retained merely because they are convenient if local law does not require them.

Cross-border assignments create additional complexity. The host-country work authorization, payroll, tax residence, social-security coverage, and data-transfer rules may all differ from those of the home country.

2.5 Occupational safety and health

Safety records can include training logs, hazard assessments, incident reports, near-miss reports, medical restrictions, workers’ compensation records, exposure monitoring, and corrective-action evidence. Medical and exposure records generally require stronger confidentiality controls than ordinary employment records.

An incident record should distinguish facts, observations, reported statements, causal hypotheses, and legal conclusions. It should identify time, location, persons involved, equipment, immediate response, witnesses, evidence preserved, and corrective actions. Managers should avoid speculative or blame-oriented language before facts are established.

2.6 Data protection and privacy

Data-protection regimes commonly impose principles such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, confidentiality, and accountability. European organizations may be governed by the General Data Protection Regulation (GDPR), while other jurisdictions apply comprehensive privacy statutes, sectoral laws, employment privacy rules, or constitutional protections. In the United States, for example, obligations may arise from a combination of federal, state, sectoral, and contractual rules rather than one general employee-privacy statute.

The organization should document:

• categories of personal and sensitive data;
• purposes and legal bases for processing;
• data subjects and recipients;
• retention periods or criteria;
• security controls;
• international transfers;
• rights-request procedures;
• breach-response procedures; and
• processor or vendor responsibilities.

Consent is not a universal solution. In employment relationships, power imbalances may make consent difficult to treat as genuinely voluntary. Organizations should identify the lawful basis and purpose for each processing activity, provide appropriate notice, and avoid collecting information that is not necessary.

3. Retention, Disposition, and Conflicting Duties

3.1 Retention is not permanent storage

A retention schedule is a controlled decision about how long a record should be kept and what happens afterward. The schedule should specify the event that starts the period. “Seven years” is incomplete unless the organization states whether the period begins at creation, the end of the tax year, the final payment, termination, or closure of a claim.

A practical retention decision can be represented as:

where R is the required retention period, L is the applicable legal minimum, O is the operational requirement, D is the duration of an investigation, audit, or dispute, and C is a contractual or collective-agreement requirement. This is a governance heuristic, not a universal legal formula. It applies only when the periods are measured from the same valid trigger and when retaining the record remains lawful and proportionate. If a legal hold applies, normal disposition is suspended regardless of the ordinary schedule.

Longer retention is not automatically safer. Excessive retention increases breach exposure, storage cost, inaccurate-data risk, and the possibility that irrelevant information will be used unfairly. A schedule should therefore combine minimum legal retention with periodic review and defensible destruction.

3.2 Legal holds

A legal hold, sometimes called a litigation hold or preservation notice, is a formal suspension of ordinary deletion when litigation, an investigation, an audit, or another reasonably foreseeable legal process requires preservation. The duty may arise before a formal claim is filed.

A defensible hold process includes:

1. Trigger assessment: identify facts indicating that a dispute or investigation is reasonably anticipated.
2. Scope definition: identify issues, time periods, custodians, systems, locations, and record types.
3. Custodian identification: include HR, managers, payroll, IT, compliance, and other relevant personnel.
4. Notice: issue clear instructions explaining what must be preserved and what routine deletion is suspended.
5. Acknowledgment: obtain and monitor acknowledgments.
6. Implementation: suspend automated deletion, mailbox purges, device replacement, and relevant database overwrites.
7. Monitoring: repeat notices, audit compliance, and update scope as facts develop.
8. Release: document when the hold ends and restore the ordinary schedule only after authorized review.

A hold should preserve relevant information without collecting everything indiscriminately. Overbroad collection increases privacy risk and review cost; underbroad collection can result in spoliation allegations.

3.3 Discovery and information governance

Discovery rules differ by jurisdiction, but common concepts include relevance, proportionality, privilege, confidentiality, and preservation. Potentially discoverable HR information may exist in HRIS databases, email, messaging platforms, shared drives, applicant-tracking systems, payroll systems, collaboration tools, paper files, mobile devices, access-control systems, and AI platforms.

The organization should create a data map before a dispute arises. It should identify system owners, data fields, retention settings, export capabilities, metadata, backup practices, and access logs. Discovery collections should preserve context and metadata where required. Exporting only visible text may omit timestamps, authorship, revision history, or links necessary to interpret the record.

Legal privilege is not a general label that can be placed on every HR document. Communications involving lawyers may lose protection if widely circulated, and business advice is not necessarily privileged merely because counsel is copied. Privilege determinations should be made by qualified legal professionals.

4. Admissibility, Authenticity, and Audit Trails

4.1 Core evidentiary qualities

Although evidence rules vary, a reliable HR record generally should be:

• Relevant: logically connected to a fact in issue.
• Material: significant to the legal question.
• Authentic: shown to be what the proponent claims it is.
• Reliable: created and maintained through dependable processes.
• Complete enough: not misleadingly detached from surrounding context.
• Legally obtained: collected and disclosed consistently with applicable rights and restrictions.

A record may be genuine but unreliable. For example, an attendance spreadsheet may be authentic in the sense that it came from a supervisor, yet unreliable if the supervisor reconstructed it months later from memory.

4.2 Electronic records

Electronic evidence is not inherently inferior to paper. Its strength depends on controls. Important controls include unique user accounts, role-based access, time synchronization, tamper-evident logging, documented corrections, backup integrity, change management, and retention of relevant metadata.

An audit trail should answer five questions:

1. What record or field changed?
2. What was the previous value?
3. What is the new value?
4. Who made the change and under which authorization?
5. When, why, and through what system did the change occur?

A system that records only the final value cannot demonstrate the history of a disputed decision. Conversely, indiscriminate logging can create excessive surveillance and privacy risks. Audit logging must be proportionate, access-controlled, protected against alteration, and retained for a documented purpose.

4.3 Chain of custody

Chain of custody is the documented history of possession, handling, transfer, storage, and examination of evidence. It is especially important for investigation files, device images, access logs, video, and exported databases. A basic chain-of-custody entry should record the item identifier, description, source, date and time, collector, transferor and recipient, storage location, integrity check where appropriate, and purpose of access.

Hash values may assist with integrity verification for exported digital files. A cryptographic hash is a fixed-length output generated from a file; if the file changes, the hash will normally change. A hash does not prove that the original file was truthful or lawfully obtained. It supports integrity, not complete authenticity or relevance.

5. Demonstrating Proof of Compliance

Compliance evidence should be designed before an audit. A mature program maintains a “proof package” that links obligation, control, record, owner, and verification activity. Examples include:

The distinction between a policy and proof is essential. A written policy shows what the organization says it does. A system log, completed review, training record, or corrective-action file shows whether it actually did it. Auditors generally assess both design effectiveness and operating effectiveness.

A useful internal-audit cycle is: define the requirement, identify the control, test a representative sample, document exceptions, analyze root causes, assign remediation, and verify closure. Sampling methods should be appropriate to the population and risk; convenience samples can create false confidence.

6. Governance, Ethics, and Technology

6.1 Roles and accountability

A clear responsibility model should assign ownership for record categories, retention rules, access approval, legal holds, incident response, vendor oversight, and destruction. HR cannot transfer its accountability merely because a cloud provider hosts the system. Contracts should address security, confidentiality, sub-processing, location, incident notification, audit rights, return or deletion, business continuity, and assistance with rights requests or discovery.

6.2 Artificial intelligence and automated decision systems

AI may be used to screen applicants, classify documents, detect payroll anomalies, summarize investigations, or predict turnover. These uses create risks of inaccurate inference, discriminatory impact, opaque reasoning, excessive data collection, and uncontrolled retention of prompts or outputs.

Governance should include a documented purpose, approved data sources, human oversight, validation, bias testing where appropriate, explainability proportional to risk, security controls, correction mechanisms, and a prohibition on treating generated text as verified fact. An AI-generated investigation summary is not a substitute for the underlying interviews, documents, and decision record.

6.3 Ethical tensions

Legal compliance is a floor, not the whole of responsible record management. A technically lawful practice may still be unfair if it surprises workers, exposes sensitive information unnecessarily, or preserves damaging inaccuracies. Ethical practice requires proportionality, transparency, respect for dignity, procedural fairness, and attention to power differences between employer and worker.

7. Illustrative Case: Northbridge Health Services

Background

Northbridge Health Services operates hospitals in two countries and employs nurses, physicians, administrative staff, and contractors. Its HR records are distributed across a cloud HRIS, a payroll platform, email, a safety database, and local paper files. The organization has received a discrimination complaint from a former employee who alleges unequal promotion decisions and retaliation after reporting a safety concern.

Problem

The complaint arrives shortly before the monthly automated deletion of former employees’ email accounts. The HR director asks IT to “save anything relevant,” but no custodians or date range are identified. At the same time, a payroll administrator edits historical time entries without recording reasons, and a manager emails an informal spreadsheet containing medical restrictions to a broad leadership group.

Analysis

Three risks exist. First, the organization may fail to preserve relevant evidence because the hold is vague and automated deletion continues. Second, altered payroll records may be authentic system outputs but weak evidence because the correction history is missing. Third, the medical spreadsheet creates a confidentiality and data-protection incident.

Approach and solution

The general counsel and HR compliance lead establish a documented hold covering the complainant, relevant managers, HR, safety personnel, payroll, and IT. The hold identifies the promotion process, safety report, retaliation allegation, and relevant period. IT suspends deletion for identified accounts and preserves relevant collaboration data. Custodians receive written instructions and acknowledge them.

The organization exports the promotion criteria, applicant and promotion records, interview notes, pay history, safety report, related communications, and access logs while preserving metadata. An evidence register records source, date, collector, format, and integrity information. Legal counsel determines privilege issues rather than labeling all HR material privileged.

Payroll corrections are investigated. Original values are preserved, corrected values are documented, and the administrator provides a reason and approval record. The medical spreadsheet is removed from unauthorized locations where lawful, access is restricted, affected individuals and regulators are assessed under applicable breach rules, and managers receive revised handling instructions.

A review finds that promotion criteria were inconsistently applied across departments. Northbridge reruns the promotion analysis, provides a remedy to affected employees, standardizes scoring, and adds periodic equality monitoring. It also separates medical and safety records from general personnel files.

Outcome

Northbridge can demonstrate a credible preservation process, distinguish original payroll data from corrections, and show remedial action for the confidentiality incident. The case is not risk-free: missing records cannot be recreated simply by writing a later explanation. However, the organization’s documented controls, candid assessment, and corrective measures improve the reliability of its position.

Learning points

1. A legal hold must be specific, acknowledged, implemented, and monitored.
2. Record integrity depends on change history, not merely the final stored value.
3. Sensitive records require functional separation and restricted access.
4. Proof of compliance includes evidence that controls operated in practice.
5. Remediation should address both the immediate incident and the underlying process weakness.

8. Implementation Framework for HR Professionals

A graduate-level HR records program should integrate law, process, technology, and professional judgment. The following sequence is practical:

1. Inventory: identify records, systems, owners, formats, and data subjects.
2. Classify: label records by function, sensitivity, legal significance, and access need.
3. Map obligations: connect categories to jurisdictions, regulators, retention triggers, and rights.
4. Design controls: define creation, approval, correction, access, transfer, backup, and disposal procedures.
5. Configure technology: implement role-based access, immutable or protected logs, retention rules, alerts, and search capability.
6. Train users: emphasize objective documentation, confidentiality, legal holds, and escalation.
7. Test: conduct access reviews, restoration tests, mock holds, sample audits, and incident exercises.
8. Improve: analyze exceptions and near misses, update the schedule, and document remediation.

Limitations must be acknowledged. No retention schedule can eliminate legal uncertainty. No audit trail proves that a record is factually true. No software can determine every jurisdictional conflict. And no AI system can replace accountable human judgment in high-risk employment decisions.

Contemporary Developments

Several developments are reshaping the field. Privacy regulators increasingly expect demonstrable accountability rather than general assurances. Remote and hybrid work distribute records across personal devices and collaboration platforms. Workplace monitoring creates new questions about proportionality, transparency, and employee autonomy. Algorithmic hiring and workforce analytics increase the need for impact assessment, documentation of model governance, and meaningful human review. Cross-border cloud services make data location, transfer mechanisms, and vendor control more important. Finally, regulators and courts are increasingly interested in whether an organization’s stated policy matches actual system behavior.

The strategic implication is clear: HR record management should be treated as an information-governance capability. The strongest organizations do not wait for a claim or audit to discover what they store. They know where records are, why they retain them, who can access them, how changes are recorded, and how they can prove that their controls operated.

Chapter Summary

HR records support transactions, management, regulatory compliance, legal defense, and organizational accountability. Their value depends on relevance, authenticity, reliability, context, lawful handling, and a documented chain of custody. Because obligations differ by jurisdiction, employers should construct a legal-obligation matrix covering labor, tax, social security, equality, immigration, safety, privacy, contractual, and collective-bargaining requirements.

Retention must be based on valid triggers and balanced against minimization and security risks. Legal holds suspend ordinary deletion when litigation, investigation, audit, or another legal process is reasonably anticipated. Discovery requires proportionate identification, preservation, collection, review, and production across all relevant systems. Audit trails should record changes, users, times, reasons, and authorizations, while chain-of-custody documentation supports confidence in digital evidence.

Proof of compliance requires evidence that controls operated, not merely policies stating that they should operate. Cloud systems, AI, remote work, and cross-border processing increase the importance of access governance, vendor controls, transparency, validation, and human accountability. Ethical record management goes beyond minimum legality by protecting dignity, fairness, confidentiality, and procedural justice.

Key Terms

Legal hold: A formal suspension of ordinary record destruction because legal preservation duties have arisen.

Discovery: The process of identifying, preserving, reviewing, and exchanging relevant information in a legal proceeding.

Authenticity: The quality of being shown to be the record or object claimed.

Integrity: Confidence that a record has not been improperly altered or corrupted.

Chain of custody: The documented history of possession, handling, transfer, and storage of evidence.

Audit trail: A chronological record of system events, changes, users, and actions.

Retention trigger: The event from which a retention period begins.

Disposition: The authorized final action concerning a record, such as deletion, anonymization, or archival preservation.

Spoliation: Improper destruction, alteration, or failure to preserve potentially relevant evidence.

Data minimization: Limiting personal-data collection and retention to what is necessary.

Purpose limitation: Using personal data only for specified, legitimate purposes.

Protected characteristic: A legally protected attribute relevant to equality and discrimination rules.

Worker classification: The legal categorization of a worker, such as employee or contractor.

Privilege: Legal protection that may apply to certain confidential communications or materials.

Metadata: Data describing a record, such as creator, timestamp, format, or revision history.

Proof of compliance: Documentary or system evidence demonstrating that a legal or internal control operated.

Role-based access control: Restricting system access according to job role and approved need.

Data processor: A party that processes personal data on behalf of another organization under applicable law.

Review Questions

Short Answer Questions

1. Why is a jurisdictional mapping exercise necessary before setting HR retention periods?
2. What is the difference between a legal hold and an ordinary retention schedule?
3. Identify four qualities that strengthen the evidentiary value of an electronic HR record.
4. Why should medical and immigration records usually receive stronger access controls than ordinary personnel records?
5. What information should an audit trail capture when a payroll record is changed?

Long Answer Questions

1. Explain how labor, tax, social-security, equality, immigration, safety, and data-protection obligations interact in an HR record-management program.
2. Describe a complete legal-hold and discovery process, including custodians, systems, preservation, monitoring, and release.
3. Critically evaluate the statement: “Keeping records forever is the safest compliance strategy.”
4. Discuss how an organization can demonstrate proof of compliance rather than merely claim that it follows policy.
5. Analyze the evidentiary strengths and weaknesses of electronic HR records compared with paper records.

Analytical / Application Questions

1. A former employee alleges discriminatory promotion and discovers that the employer’s HRIS retained final promotion scores but not earlier versions or access logs. Assess the evidentiary and governance risks and recommend corrective action.
2. A multinational employer stores payroll, medical, and immigration records in one cloud platform accessible to regional HR managers. Design a risk-based access, retention, and data-transfer framework.
3. An AI tool rejects applicants and produces only a ranked list, with no explanation or preserved input data. Evaluate the legal, ethical, evidentiary, and operational weaknesses of the process and propose governance controls.

Multiple Choice Questions with Answers

Question 1

Which factor is most important when determining the beginning of an HR record retention period?

A. The size of the organization

B. The valid retention trigger specified by law or policy

C. The storage capacity of the HRIS

D. The preference of the line manager

Correct Answer: B. The valid retention trigger specified by law or policy

Question 2

What is the primary function of a legal hold?

A. To accelerate routine deletion

B. To suspend ordinary destruction of potentially relevant information

C. To convert all records to paper

D. To give every employee access to the case file

Correct Answer: B. To suspend ordinary destruction of potentially relevant information

Question 3

Which audit-trail entry is most useful when a payroll value is corrected?

A. Only the corrected value

B. Only the name of the payroll system

C. The old value, new value, user, time, reason, and authorization

D. The employee’s job title only

Correct Answer: C. The old value, new value, user, time, reason, and authorization

Question 4

Which statement best describes a cryptographic hash?

A. It proves that a record is factually true

B. It supports verification that a file has not changed

C. It determines whether a communication is privileged

D. It replaces the need for chain-of-custody records

Correct Answer: B. It supports verification that a file has not changed

Question 5

Why should a retention schedule specify a trigger?

A. Because a period such as seven years is ambiguous without a starting event

B. Because triggers eliminate all privacy obligations

C. Because triggers make every record permanent

D. Because triggers remove the need for legal review

Correct Answer: A. Because a period such as seven years is ambiguous without a starting event

Question 6

Which practice most strongly supports equal-opportunity compliance?

A. Using undocumented intuition in interviews

B. Applying documented, job-related selection criteria consistently

C. Deleting unsuccessful applicants’ records immediately in every case

D. Allowing each manager to use different evaluation standards

Correct Answer: B. Applying documented, job-related selection criteria consistently

Question 7

What is the principal evidentiary weakness of a spreadsheet reconstructed months later from memory?

A. It is necessarily encrypted

B. It may lack contemporaneous reliability and change history

C. It cannot contain numbers

D. It automatically becomes privileged

Correct Answer: B. It may lack contemporaneous reliability and change history

Question 8

Which action is appropriate when a legal hold applies?

A. Continue automated deletion without review

B. Suspend relevant routine deletion and monitor preservation compliance

C. Delete irrelevant and relevant records together

D. Allow custodians to decide informally what to keep without instructions

Correct Answer: B. Suspend relevant routine deletion and monitor preservation compliance

Question 9

Which statement about AI-generated HR summaries is most accurate?

A. They are automatically authoritative evidence

B. They eliminate the need to preserve source records

C. They require human verification and governance appropriate to the risk

D. They are never subject to privacy obligations

Correct Answer: C. They require human verification and governance appropriate to the risk

Question 10

What does proof of compliance require beyond a written policy?

A. Evidence that the relevant control operated in practice

B. A longer policy document

C. Permanent retention of every record

D. A claim that managers followed instructions

Correct Answer: A. Evidence that the relevant control operated in practice