Choosing retention rules your regulator will accept

A retention schedule is the point where legal obligation meets system configuration. Done well, it means records become eligible for disposition automatically and destruction is defensible. Done poorly, it means either everything is kept forever or records disappear without a documented decision behind them.

Start from record classes, not from documents. The question is never how long to keep this particular invoice; it is how long the class of financial supporting documentation must be retained, and which statute or regulation sets that period. Where several obligations touch the same class, the longest governs.

Retention then has to survive contact with reality. Two features decide that: legal holds, which suspend destruction for records caught by litigation, audit or investigation and release cleanly afterwards; and a disposition process that is reviewed and logged rather than silent. A regulator is rarely troubled that a record was destroyed. They are troubled when nobody can show the decision and approval behind it.

Finally, treat the schedule as configuration rather than code. Retention periods change as legislation changes, and the people administering the system should be able to update them without a project. That is a training and handover question as much as a technical one.