Sarbanes-Oxley and Financial Record Custody

Public companies, their auditors, and the accounting firms and contractors that support them.

• Retention of financial records and the workpapers supporting them.
• Controls that can be evidenced as having operated, not merely documented.
• Restricted and accountable access to records.
• Disposal that is controlled rather than incidental.

• ◆Scheduled rotation that produces a scan record every cycle — the evidence a control operated.
• ◆Restricted access with named authorized parties; no staff member can open a client box alone.
• ◆Witnessed destruction with serialized certificates at end of retention.
• ◆A separate, hardened site for duplicate records.

The usual misreading is that this is a documents rule. It is largely a controls rule. What is being tested is whether a process reliably does what the organization says it does, and whether that can be demonstrated. Storage becomes relevant because a control that depends on records nobody can produce is a control that cannot be evidenced, not because there is a storage clause to satisfy.

Testers ask to see that a process ran as described, repeatedly, over a period. Where off-site custody supports a control, what helps is the ordinary operational record: scheduled collections that happened on schedule, signed handovers on both legs, intake reconciliation, and a documented list of who was authorized at the time. That is a byproduct of running the arrangement properly rather than something assembled for an audit, which is exactly why it holds up.

We do not design, assess, or attest to your controls. We produce custody evidence that your controls can rely on. Your auditors decide whether the control is adequate.