Defensible records destruction: approved reports, two approvals and a permanent audit trail

An access-to-information request, an auditor, a lawyer: one day someone asks for a document your organization destroyed years ago. There are two possible answers. "We can't find it." Or: "It was destroyed on this date, under this rule of our retention schedule, after these two people approved it. Here is the report."

Only the second answer protects the organization. This article covers what it takes to give it every time, for Microsoft 365, network drives and paper.

What makes a destruction defensible

A destruction holds up when you can show five things:

1. It was authorized by the retention schedule: a specific rule, with its retention period and a final disposition of destruction.
2. It was documented before it happened: the list of what would be destroyed existed before anything was deleted.
3. It was approved by the right people, not decided by one person alone.
4. It was actually carried out, completely, and verified.
5. It's still traceable long after the content is gone.

Done by hand, each of these is a separate effort: a spreadsheet, an email thread, a manual deletion, a folder of scanned signatures. Each one is easy to lose or to skip.

The report comes before the disposition

In Archiveo, every archive request produces a disposal report generated from your retention rules: the items to destroy, and the items to keep, sort or transfer. That report is what gets validated and approved, before anything is executed.

That order matters. A list reconstructed after the fact proves nothing about what was decided. A report produced and approved beforehand is your supporting document if an access-to-information request comes in later.

Two approvals, built into the tool

A public body shouldn't destroy records on the archivist's decision alone, and the manager shouldn't approve a list nobody checked. Archiveo enforces both steps on every request:

• The archivist validates: the lists are consistent and comply with the retention schedule.
• The manager approves: a formal, traced decision on behalf of the unit that owns the records.

This isn't a procedure in a binder that people may or may not follow. The tool won't execute a request that hasn't been approved, and there's no timeout that turns silence into approval. By contrast, Microsoft Purview's disposition review is configured per retention label and can be set to auto-approve items when reviewers don't act. We cover the differences in Microsoft Purview vs. Archiveo.

Destruction you can actually verify

Deleting a file in SharePoint doesn't destroy it. It goes to the site's recycle bin, then to a second-stage recycle bin, and can be restored for up to 93 days. Manual destruction often stops at the first step, which means the "destroyed" records are still there.

Archiveo deletes the approved items, checks that they're no longer accessible, and empties the SharePoint recycle bin. On network drives, approved items go through a buffer zone first, so a mistake can be corrected before permanent destruction. For paper, the certificate of destruction is attached to the request, next to the approval.

An audit trail that outlives the content

The point of destroying a record is that the content disappears. The proof of the decision shouldn't. Archiveo's audit trail records who created the request, who validated it, who approved it, what was destroyed or transferred, and when. That trail is permanent: it survives the destruction of the content it describes.

For comparison, Purview keeps proof of disposition for up to seven years. Questions about a destruction can come later than that, and a public body should be able to answer them.

Transfers deserve the same proof

Records with permanent value aren't destroyed; they're transferred to the national archive. That's also a decision to document. In Archiveo, records to keep go through a secure buffer zone for cleanup and reclassification. Archiveo then generates the transfer package and deposit file and sends them over secure FTP, and the archivist closes the archive once the national archive confirms receipt. Every step is in the same audit trail.

Sources on Microsoft 365 behavior: Microsoft Learn, Disposition of content and Learn about retention for SharePoint and OneDrive.