INTERNAL AUDITRISK MANAGEMENT
Do you perform an audit to test the ability to retrieve documents or reconstruct data that has been retained?
Also if you have a formal record retention schedule, is it by function? by regulation?, etc.