1732.6—Minimum requirements of record retention program.
(a) Requirements.
The record retention program established and maintained by an Enterprise under § 1732.5 shall:
(i)
Are adequate to support litigation and the administrative, business, external and internal audit functions of the Enterprise;
(iii)
Permit ready access by the Enterprise and, upon request, by the examination and other staff of OFHEO by reasonable means, consistent with the nature and availability of the records and existing information technology;
(5)
Include an accurate, current, and comprehensive record retention schedule that lists records by major categories, subcategories, record type, and retention period, which retention period is appropriate to the specific record and consistent with applicable legal, regulatory, fiscal, and operational and business requirements;
(6)
Include adequate security and internal controls to protect records from unauthorized access and data alteration; and
(b) Training.
The record retention program shall provide for training of and notice to all employees on a periodic basis on their record retention responsibilities, including instruction regarding penalties provided by law for the unlawful removal or destruction of records. The record retention program also shall provide for training for the agents or independent contractors of an Enterprise, as appropriate, consistent with their respective roles and responsibilities to the Enterprise.