What evidence do you need to defend records destruction if you are audited or sued?

When records destruction is questioned in an audit or a lawsuit, the central issue is rarely that you destroyed records. It is whether you can show the destruction was routine, authorized, and consistent — not an attempt to hide or discard something relevant. This is the principle of defensible destruction. Your evidence should answer one question convincingly: “We followed our own documented program in good faith.”

The core evidence you should be able to produce

• An approved retention schedule that covers the record type, with retention periods tied to legal, regulatory, or operational requirements. The schedule should predate the destruction.
• Proof the schedule was actually applied — that the records met their full retention period before disposition.
• Destruction logs or certificates of destruction identifying what was destroyed, when, by whom, the method used, and the authority (the schedule item) under which it occurred.
• Approval or sign-off records showing the disposition was authorized by the responsible custodian, not done ad hoc.

Showing the program was real and consistent

Isolated paperwork is weaker than a pattern. Be ready to demonstrate:

• A written records management policy and evidence it was communicated and followed.
• Consistent, recurring disposition across similar records — uniform application undercuts any claim that one batch was singled out.
• System metadata and audit trails for electronic records, since these often supply the most reliable, tamper-evident proof of timing and authorization.

The litigation-hold piece

This is where destruction defenses most often fail. You must show that no legal hold (litigation hold) was in effect for the records at the time they were destroyed. That means evidence of:

• A hold process that suspends normal destruction when litigation, audit, or investigation is reasonably anticipated.
• The hold being issued promptly and its scope documented.
• Records being preserved — not destroyed — once a duty to preserve arose.

Destruction that occurs after a preservation duty attaches can look like spoliation, even if your schedule technically allowed it.

Bottom line

Keep the schedule, the approvals, and the destruction records — and keep proof that holds were honored. Together they show good-faith, routine disposition rather than convenient disposal. For broader context, see the compliance and standards hub.