What should an auditor do when conducting a periodic audit on media retention?

Checking electronic storage media to ensure records are not retained past their destruction date is the core objective of a media retention audit. Retention policies define how long data must be kept and when it must be destroyed; auditing compliance means verifying that expired records have been purged or destroyed on schedule, preventing unauthorized data retention and reducing legal and privacy risk.

Ensuring authorized personnel possess paper copies of PII addresses physical document access control, not the retention lifecycle management that is the focus of a media retention audit.

Checking that hard disks within an active retention cycle are properly stored addresses physical security or chain-of-custody concerns, not whether data is being held beyond its permitted retention period.

Ensuring data shared with outside organizations is off a retention schedule conflates third-party data-sharing agreements with internal media retention policy compliance, which are separate audit domains.