Audit Retention Policy Template for Australia

An Audit Retention Policy is a comprehensive governance document that establishes mandatory procedures for storing, managing, and disposing of audit-related records within your organization. This policy ensures your business maintains proper documentation to meet Australian regulatory requirements while providing clear guidelines for staff responsible for record management and audit compliance.

When do you need this document?

You need an Audit Retention Policy if your organization undergoes internal or external audits, maintains financial records, or handles sensitive data that requires regulatory compliance. This includes publicly listed companies subject to ASIC oversight, private companies with complex financial structures, government agencies, and organizations processing personal information. The policy is particularly crucial during audit preparation, regulatory investigations, or when implementing new record management systems. Without proper retention procedures, your organization risks non-compliance penalties, loss of critical evidence during legal proceedings, and operational inefficiencies when locating historical records.

Key legal considerations

Your Audit Retention Policy must clearly define retention periods for different types of records, ensuring compliance with the longest applicable legal requirement. The policy should establish secure storage procedures that protect confidentiality while ensuring authorized access for legitimate business purposes. You must include provisions for electronic record management, data backup procedures, and secure disposal methods that prevent unauthorized access to sensitive information. The policy should designate specific roles and responsibilities for record custodians, including training requirements and accountability measures. Consider including provisions for litigation holds that suspend normal disposal schedules when legal proceedings are anticipated or commenced.

Legal requirements in Australia

Under the Corporations Act 2001, your organization must retain written financial records for at least seven years, including audit working papers and supporting documentation. The Income Tax Assessment Act 1997 requires retention of tax-related documents for five years from assessment date, though business records supporting financial statements may need longer retention. If your organization processes personal information, the Privacy Act 1988 governs retention and disposal of personal data collected during audits, requiring secure destruction when no longer needed. The Electronic Transactions Act 1999 provides the framework for electronic record validity, allowing digital storage provided records remain accessible and authentic. Government organizations must also comply with the Archives Act 1983, which may require permanent retention of certain records or approval before disposal. Your policy must address the intersection of these laws and establish retention periods that satisfy the most stringent applicable requirement.