OAR 125-700-0155: Audit Records and Retention

(1) The agency's internal audit function, must maintain audit work papers and reports in accordance with records retention requirements. The internal audit function should ensure that its records retention schedule will allow it to keep the documents until an external peer review has been performed, and audit findings and recommendations have been appropriately followed-up on. Refer to State Archive requirements and OAR 166-300-0025 for record retention schedules. Records must be kept so they can be retrieved, if necessary. (2) The agency's Chief Audit Executive must follow appropriate data classification procedures to monitor and control confidential and sensitive internal audit documents. Confidential documents are those designated as confidential by agency policy or covered by ORS 192.496 through 192.505.