Governance Deep Dive: Audit Retention Is a Governance Decision

How long audit evidence survives decides which questions the organization can ever answer, which makes retention policy a governance choice wearing a storage costume.

A retention window is a list of questions you are choosing to become unable to answer. The slow-burn incident discovered at month seven does not care that the logs rotated at month six.

Deciding retention deliberately

• Map incident classes to the evidence age they typically require.
• Retain authorization history longer than activity history.
• Document what each retention tier makes unanswerable, and who accepted that.

Use the audit schema, enterprise guide, and security docs to keep evidence as long as the questions it answers stay askable.