How does a regulator decide whether an organization's electronic recordkeeping is compliant during an audit?

A regulator does not simply ask whether records exist. Instead, an auditor evaluates whether the organization can demonstrate that its electronic records are reliable, complete, and managed according to applicable laws, regulations, and recognized standards. Compliance is judged less by the technology in use and more by the evidence that records can be trusted and produced when needed.

What auditors typically examine

Across most regulatory frameworks, an auditor looks for a consistent set of qualities in the recordkeeping program:

• Authenticity — Can the organization prove a record is what it claims to be, created or received by the stated person at the stated time?
• Integrity — Is the record complete and unaltered, with controls that detect or prevent unauthorized change?
• Reliability — Were records captured through trustworthy, consistent business processes?
• Usability and accessibility — Can records be located, retrieved, and read for as long as they must be kept, despite changing formats and systems?

These attributes mirror the principles set out in international standards such as ISO 15489, which many regulators treat as a benchmark for sound practice.

The evidence regulators request

Auditors rarely judge intent; they look for documented proof. Expect requests for:

• Policies and procedures governing how records are created, classified, stored, and disposed.
• Retention schedules showing each record series has a defined, legally grounded retention period.
• Access and security controls, including audit logs that track who viewed or modified records.
• Disposition records proving that destruction or transfer happened under authorization and at the right time.
• Metadata that establishes context, ownership, and chain of custody.

How the determination is made

Auditors generally sample records and trace them end to end, comparing actual practice against the organization’s own stated policies and against external requirements. Gaps between policy and practice are common findings. A program is more likely to be judged compliant when controls are documented, consistently followed, and supported by reliable system logs, and when staff can explain how the program works.

Because requirements differ by sector and jurisdiction, organizations should map their obligations to the specific statutes and standards that govern them rather than assume a single rule applies. For broader background on managing digital records, see /topics/electronic-records/.

In short, regulators look for demonstrable, consistent control over the full lifecycle of records, backed by evidence rather than assertion.