What do compliance auditors look for regarding document storage?

Auditors check that records are complete (nothing missing), accessible (can be produced within a few days), and properly managed (clear filing systems, retention schedules, access controls and destruction processes).

What provider documentation do I need for an audit?

You should have your provider's ISO 27001 and ISO 9001 certificates, a GDPR data processing agreement, details of security measures, chain of custody procedures, and destruction certificates for any records that have been destroyed.

How to Prepare for a Compliance Audit When Using Off-Site Storage

When auditors from HMRC, the ICO, the CQC, or any other regulatory body request documents, you need to produce them quickly and confidently. If your records are in off-site storage, this adds a step to the process — but with proper preparation, it should make your audit easier, not harder.

What Auditors Expect

Auditors generally want to see three things regarding your document storage:

That records are complete — the documents they request actually exist and are available
That records are accessible — you can produce them within a reasonable timeframe (usually a few days)
That records are properly managed — there is a clear system for filing, retention, access control and destruction

Having your records in professional off-site storage actually strengthens your position on all three points — provided you have chosen the right provider and set up the system properly.

Before the Audit: Preparation Steps

1. Know What You Have Stored

You should have a complete catalogue of everything in off-site storage — ideally searchable by date, department, document type or reference number. If your provider uses barcode tracking, you should have access to an online portal or inventory report that lets you identify and request specific boxes or files.

2. Review Your Retention Schedule

Make sure your retention schedule is up to date and that records due for destruction have been reviewed and either destroyed or retained with justification. Auditors will look at whether you are keeping records for the right length of time — both too short and too long.

3. Check Access to Provider Documentation

Gather the following from your storage provider in advance:

ISO 27001 and ISO 9001 certificates (current and valid)
Data processing agreement (required under GDPR if they handle personal data)
Details of security measures (CCTV, fire suppression, access controls)
Chain of custody procedures
Destruction certificates for any records already destroyed

4. Test Your Retrieval Process

Before the audit, request a few boxes or files to confirm the retrieval process works smoothly. Check how long it takes from request to delivery, that the correct items arrive, and that your team knows how to use the provider’s ordering system.

During the Audit

Request specific items from storage as soon as the auditor identifies what they need
Most providers offer same-day urgent retrieval for audit situations
Provide the auditor with your catalogue or inventory system so they can see what records exist
Show them your retention schedule and evidence that it is applied consistently
Provide your provider’s ISO certificates, data processing agreement and security documentation

Why Off-Site Storage Can Strengthen Your Audit Position

Using a professional storage provider actually gives you several advantages in an audit:

Complete audit trail — barcode tracking shows when every box was received, where it is stored, every time it has been retrieved, and when it is due for destruction. This is far more rigorous than most in-house systems
ISO certification — demonstrating that a certified, audited third party manages your records is stronger evidence of proper management than a staff member explaining your filing system
Secure destruction — certificates of destruction prove that records were disposed of properly at the right time, with the right method
Access controls — controlled, logged access to a purpose-built facility is easier to evidence than access to an office storage room

Common Audit Pitfalls to Avoid

Not knowing what is in storage or how to find specific items
Not having destruction certificates for records that should have been destroyed
Not having a current data processing agreement with your provider
Keeping records beyond their retention period without justification
Not testing the retrieval process in advance — discovering problems during the audit is too late

At EvaStore, we support clients through audits regularly. Our O’Neil software system provides comprehensive tracking, and our team can prepare inventory reports, supply certification documentation and prioritise urgent retrievals during audit periods.

Get a Free Quote

Every business is different, so the best way to understand your costs is to get in touch with our team. We provide clear, no-obligation quotes — usually within the same day.

Call us on 01691 650355 or use the form below.