When implementing a retention schedule, what should be included?

• A. A defined retention schedule specifying timeframes, responsibilities, and disposal procedures aligned with legal and contractual requirements.
• B. A random set of dates.
• C. An informal guideline.
• D. No retention policy is necessary.

Answer: (C)

A retention schedule must be defined and documented, laying out how long records are kept, who is responsible for each step, and how and when disposal occurs, all aligned with applicable laws and contractual requirements. This creates a consistent, auditable framework that helps ensure compliance, reduces the risk of keeping records longer than needed or destroying them too soon, and protects sensitive information.

A random set of dates lacks reliability and accountability; an informal guideline may be too vague to enforce or to ensure compliance; and having no policy at all leaves the organization exposed to legal and operational risks. Therefore, the best approach is a defined retention schedule with clear timeframes, responsibilities, and disposal procedures aligned with legal and contractual requirements.