Audit Retention Policy Template for Canada

An audit retention policy is a critical governance document that establishes how your organization will manage, store, and dispose of audit-related records. In Canada, this policy ensures you comply with federal and provincial regulatory requirements while protecting your organization from legal risks and supporting efficient audit processes.

When do you need this document?

You need an audit retention policy when your organization undergoes regular audits, whether internal or external. This includes publicly traded companies subject to securities regulations, private corporations with complex financial structures, non-profit organizations receiving government funding, and businesses with significant tax obligations. The policy becomes essential when you're preparing for regulatory inspections, managing large volumes of financial records, or implementing corporate governance frameworks. Organizations often develop this policy following audit findings that highlight record-keeping deficiencies or when expanding operations across multiple provinces with varying regulatory requirements.

Key legal considerations

Your audit retention policy must address several critical legal elements to ensure comprehensive compliance. The policy should clearly define what constitutes audit records, including financial statements, working papers, correspondence with auditors, and supporting documentation. You must establish specific retention periods for different document categories, ensuring they meet or exceed minimum legal requirements. The policy should include secure storage protocols for both physical and electronic records, with appropriate access controls and backup procedures. Consider including provisions for litigation holds that suspend normal disposal schedules when legal proceedings are anticipated. Your policy should also address the transition between different storage formats and establish clear procedures for authorized destruction of records at the end of retention periods.

Legal requirements in Canada

Canadian law imposes specific audit record retention obligations through multiple federal and provincial statutes. Under the Income Tax Act, you must retain all books and records for at least six years from the end of the last tax year to which they relate, including audit working papers and supporting documentation. The Canada Business Corporations Act requires corporations to maintain adequate accounting records and preserve them at the registered office or another designated location. PIPEDA mandates that personal information in audit records be protected through appropriate safeguards and retained only as long as necessary for identified purposes. Provincial securities regulators may impose additional requirements for public companies, including specific retention periods for audit committee communications and external auditor reports. Employment-related audit records must comply with provincial employment standards legislation, which typically requires retention of payroll and employment records for specified periods. Your policy must also consider provincial privacy legislation in jurisdictions like Quebec, British Columbia, and Alberta, which may impose stricter requirements than federal law.