Examiners ask a municipal utility for prior-year control test outcomes after the current test cycle opens. What must the compliance team preserve?
Select an answer to reveal the explanation.
Short Explanation
Auditors love a paper trail, and IRM is that trail. Closing one test cycle does not mean shredding last year’s grades. Keep the history so anyone can see how the control performed over time.
Full Explanation
Compliance programs must retain historical control test results across cycles so examiners can review prior-year outcomes even after the current test cycle opens. A municipal utility asked for prior-year results cannot answer adequately if only the latest failed tests are kept while pass history is purged to save storage, if prior results were replaced with a PDF dump and IRM records cleared, or if each control's prior result fields were overwritten so dashboards show a clean slate. History is evidence; purging passes or greenwashing fields undermines examiner trust and may violate records obligations. Exam caveat: retention must align with legal and records policies—retain what examiners and regulators require, including passed and failed outcomes with evidence links, for the mandated retention period. Operational check: confirm test result records from prior cycles remain queryable in IRM, run a sample examiner request for last year's outcomes on critical controls, verify attachments still resolve, and document retention settings in the utility's IRM records schedule. Prohibit overwrite-only practices in admin runbooks, monitor storage growth with archival strategies that preserve retrievability, and brief new admins that dashboard aesthetics never justify destroying history.