IATF16949 Practical Guide (33) | Record Retention and Retention Periods: 7.5.3.2.1 Retention List, Period Matrix, and Expiry Disposal Determination

By: QTank Published: 11/5/2026 Views: 24

Current rating: ★★★☆☆ Rate this Equivalent to 8 ratings

A company was undergoing a recertification audit in March 2026. The auditor selected a safety component that had been EOP (End of Production) in 2023 and requested to see the PPAP approval records and the final batch full-size inspection report from that year. The document controller searched the paper archives and found the PSW (Part Submission Warrant). However, when the IT department checked the MES (Manufacturing Execution System), the inspection data for that batch was no longer in the system. The storage policy set three years ago when the company moved to the cloud was "business data retained for 3 years, automatically deleted after expiration." The data from before 2023 was batch-archived and deleted at the end of 2025, and the encryption keys were handed over with the termination of the outsourced maintenance contract, making the data inaccessible now.

The auditor did not question whether the data was qualified or not, but asked two specific questions: "How do you determine the retention periods for your records?" and "Where is this period specified in your documents?" The company could not answer these questions and received a nonconformity, citing 7.5.3.2.1 for failing to retain records according to the product production and service period plus one calendar year.

The crux of the issue is not that the data was "deleted incorrectly," but that the company had never calculated the retention periods. Most companies' record control procedures simply state "quality records are retained for three years," without specifying when the three years start, which records should be retained longer, or what to do when customer requirements are stricter. The three years is a round number, not a calculated period. This article addresses four key issues: how long to retain, when to start the retention period, how to legally dispose of records upon expiry, and how to ensure they are still readable on the expiry date. The authenticity of records (who modified them and what changes were made) and the retrieval speed (whether they can be found within half an hour) are covered in separate articles and will not be repeated here.

1. Distinguish Between Three Periods: Filling Period, Retention Period, and Readability Period

Confusing these three concepts is the starting point for record management issues.

Filling Period is the time limit for generating records—first article inspection must be filled out immediately after the first piece is completed, not at the end of the shift. This ensures timeliness and authenticity.

Retention Period is the duration for which records must be kept after they are generated—determined by 7.5.3.2.1 and customer special requirements. This ensures that evidence is available when needed.

Readability Period is the duration for which the medium and system can still open the record—determined by the lifespan of the storage medium, system version, file format, and key management. This ensures that "available" does not mean "usable." The most easily overlooked period is the readability period. Paper records, if not water-damaged or infested by insects, can generally be read for up to 15 years. However, the readability period for electronic records is often shorter than the retention period—system upgrades, vendor discontinuation of support, proprietary archiving formats, and loss of encryption keys can all result in records being physically "available" but effectively non-existent during an audit. Therefore, the retention strategy for electronic records must address how to ensure data readability through every system change during the retention period.

2. How to Calculate the Periods: One Baseline, Two Enhancements, and One Starting Point

Baseline Rule: The retention period for records must be at least "product production and service period + 1 calendar year." Note that this is not "three years from the creation of the record," but follows the product lifecycle—records must be retained as long as the part is in production, being supplied, or under service, and for one additional calendar year after production ends.

First Enhancement: Specific records follow the "product validity period." PPAP/PSW and supporting documents, tooling records, purchase orders and modifications, and product and process change records must be retained for the customer-defined product validity period plus one calendar year. These records share the characteristic of "cross-batch effectiveness"—a PSW covers the entire production run of a part model and cannot be closed after a single batch.

Second Enhancement: The longest period between customer special requirements and regulatory requirements. For safety components, regulatory components, and parts involving personal safety, some customer special requirements specify a 15-year retention period, while others require 20 years after production ends. Environmental regulations (such as material declarations containing specific substances) may have different requirements. The rule for determining the retention period is: take the longest period among the baseline, customer, and regulatory requirements, and specify which one is taken and the document number in the retention list. Without a written basis, "we have always stored them this way" is not a valid reason during an audit.

Starting Point is the most common place for calculation errors. There are three common starting events:

Starting Event	Applicable Scenario	Evidence to Retain
Date of EOP/production stop notification from the customer	Formal written notification	Original customer notification or email, internal EOP confirmation form
Date of the last batch delivery	No formal notification, based on actual supply	Final shipment form, invoice, delivery signature
Date of confirmation that the part is discontinued or replaced in the customer system	Checkable status in the customer system	System screenshot (including query time), change approval record

In practice, the earliest date for which evidence can be provided among these three events is used as the starting point—starting earlier means a more conservative period, which reduces the risk of issues. Once the starting point is determined, it should be recorded in the "starting event" column of the retention list and a special update should be triggered by the project department within 10 working days of the EOP, otherwise, the list will remain in a "product in production" state and the period will never start.

One often overlooked detail: different records for the same part can have different starting points. Batch inspection records follow the final batch delivery, tooling records follow the tooling disposal, and change records follow the change effectiveness. Therefore, the retention list is maintained in a cross-referenced manner by "record category × part," not just by "part."

3. Retention List: 14 Fields to Manage All Records

The following table is the core deliverable of the entire method. It is not a "record list" (which manages which forms exist), but a retention list—which manages how long each type of record is retained, who is responsible, and how to dispose of it upon expiry. The two lists must be maintained separately; mixing them often results in inaccuracies on both sides.

No.	Field	Filling Rule	Example
1	Record Category	Grouped by business, not by form number, one row per category	Batch inspection records
2	Belonging Process	Mark COP/SP/MP and process number	COP-05 Manufacturing
3	Representative Form/System Object	List all form numbers or system table names under this category	QR-QC-012, MES inspection detail table
4	Responsible Department	The generating department of the record, not the document control	Manufacturing Department
5	Trigger Point	What event generates this type of record	First piece and patrol inspection of each batch
6	Starting Event	One of the three events listed above, specified	Date of final batch delivery
7	Baseline Period	Written as an expression, not a fixed number of years	Production service period + 1 calendar year
8	Enhancement Clause	Customer CSR number/regulatory clause number, or "none" if not applicable	CSR-07 Clause 4.2 (15 years)
9	Final Period	Expression of the longest period among the three	Production stop + 15 years
10	Medium	Paper, electronic, or mixed, specify the system for electronic records	Electronic (MES) + paper first article form
11	Storage Location	To the level of warehouse, cabinet, or directory	Archive Room A, MES archive database
12	Retrieval Key	What is used to find the record during an audit	Batch number/Work order number/Date range
13	Expiry Disposal	Destruction, retention, or transfer, specify the approver	Destruction, approved by the document control supervisor
14	Freeze Mark	Whether there are unresolved claims, recalls, lawsuits, or regulatory investigations	None

Maintenance frequency recommendations: update quarterly (for new record categories and changes in customer requirements), update specially upon EOP (to add the starting event and recalculate the final period), and verify within 10 working days after each customer CSR revision. Completing all three ensures that the list remains dynamic and accurate.

A common mistake: the list is only filled up to the 7th column, with the 8th column (enhancement clause) uniformly stating "follow customer requirements" and the 9th column (final period) left blank. When the auditor sees this, they will directly ask, "What is the specific period?" If the company cannot answer, it indicates that the list has not been effectively maintained.

4. Period Matrix: Baseline Values for Major Record Categories

The table below provides reference values for applying the rules to specific records. The first column lists major record categories, the second column lists the baseline periods, the third column lists the enhancement triggers, the fourth column lists the starting points, and the fifth column lists the responsible departments. Companies can use this as a template and then calibrate each row according to their specific customer requirements—the calibration process itself must be recorded as part of the evidence.

Record Category	Baseline Period	Enhancement Trigger	Starting Point	Responsible Department
Design Records (DFMEA, DVP&R, Design Review)	Production service period + 1 year	Safety parts follow CSR	EOP	R&D
Process Design Records (PFMEA, Control Plan, Flowchart)	Production service period + 1 year	Customer requirement for version retention	EOP	Process
PPAP/PSW and Supporting Documents	Product validity period + 1 year	Take the longer period if customer specifies	Part discontinuation	Quality
Tooling, Molds, and Inspection Equipment Records	Tooling usage period + 1 year	Follow customer requirements if customer owns tooling	Tooling disposal	Tooling/Equipment
Purchase Orders and Modifications	Product validity period + 1 year	Follow agreement period for long-term agreements	Final order closure	Purchasing
Change Records (ECN, 4M Changes)	Product validity period + 1 year, and no less than 3 years after change effectiveness	Retain customer approval documents	Change effectiveness	R&D/Process
Batch and Inspection/Testing Records	Production service period + 1 year	Safety parts 15 years (typical)	Final batch delivery	Manufacturing/Inspection
Material Certificates and Material Reports	Production service period + 1 year	Follow regulations for regulatory parts	Final batch delivery	Purchasing/Inspection
Calibration and MSA Records	Tooling usage period + 1 year, and no less than 3 years	Follow the longer period if customer audit cycle is longer	Calibration date	Metrology
Internal Audits, Process Audits, Product Audits	At least 3 years, covering a complete certification cycle	Customer second-party audit records 5 years	Audit completion	System
Management Review Records	At least 3 years	Follow the longer period if certification body requires	Review meeting date	Management Representative
Nonconforming, 8D, Customer Complaints	At least 3 years; extend to closure + 3 years for safety parts	Do not destroy if claims are unresolved	Closure date	Quality/Customer Service
Training and Competency, Qualification Approval	In-service period + 3 years; retain for 3 years after departure for special positions	Follow the validity period of certificates for regulatory positions	Departure/Certificate expiration	HR
Supplier Evaluation and Second-Party Audits	Cooperation period + 3 years	Follow customer requirements for designated suppliers	End of cooperation	SQE
Regulatory Parts, Environmental Substance Declarations	Follow regulations, typically 15 years	Take the longer period if customer requires 20 years	Final batch delivery	Quality/EHS
Emergency Plans and Drill Records	3 years	Take the longer period if customer requires	Drill completion	Operations

Two numbers in the table need special explanation. "Covering a complete certification cycle" for internal audits and management reviews means that within a three-year certification cycle, at least two complete rounds of internal audits and three management reviews must be available—retaining only the most recent one does not demonstrate system continuity. "At least 3 years" for calibration records is because many measuring tools have a calibration cycle of less than one year, and three years can cover at least two calibration intervals, providing a chain for auditors to trace the history of the tools.

5. Electronic Records: Files Become Unreadable Before the Period Ends

This is the most common point of failure, often occurring without the company's awareness.

First Point: Backup is not the same as archiving. Daily backups are rolling recovery measures with a 30-day or 90-day window, and old backups are overwritten once the window passes. Treating "we have backups" as "records are retained" is a conceptual error. The archive area must be a read-only, independent storage with a separate retention policy configured by record category, not a uniform "three years" for the entire database.

Second Point: System upgrades must include a "data migration" action. Every time the MES/QMS is upgraded, a new supplier is selected, or the system is migrated to the cloud, a data migration list must be created: which tables and fields are migrated, how attachments are moved with the main records, how long the old system's read-only mirror is retained, and who verifies it. Without this step, common issues include lost attachments and field meanings drifting, making it impossible to prove data integrity later.

Third Point: Four verifications must be performed after migration and recorded.

Verification Item	Method	Pass Criteria	Evidence
Quantity Consistency	Compare the number of records by category between the source and target databases	No difference, or differences are explained item by item	Comparison table
Key Continuity	Check for missing batch numbers or work order numbers	Missing keys are explainable (canceled, merged)	Missing key list
Attachment Readability	Sample and open attachments	All sampled attachments are readable and format is intact	Sampling record
Content Consistency	Sample and compare key field values and hashes	100% consistency in sampled records	Sampling comparison table

Recommended sampling ratios: at least 30 attachments or 1% of the total (whichever is greater), and at least 50 key fields, covering one complete batch before and after migration.

Fourth Point: Format and Metadata. Long-term retained electronic records should be converted to open formats (such as PDF/A) and retain four metadata fields: creation time, creator, system source, and associated batch. Retaining only an Excel export file and losing the metadata makes it impossible to prove which batch the data belongs to during an audit, rendering it invalid.

Fifth Point: Recovery Drills. Conduct at least one drill annually, randomly selecting a batch from three years ago and walking through the entire process of "finding—opening—printing/exporting—comparing with paper or system records." The drill record itself is evidence of the effectiveness of the retention measures—many companies receive nonconformities not because they did not archive, but because they cannot prove the archived records are usable.

6. Expiry Disposal: Destruction Also Requires an Evidence Chain

Expiry does not mean immediate deletion. The disposal process is fixed in four steps:

90 Days Before Expiry: Early Warning—the system or ledger automatically lists records expiring in the next quarter and pushes them to the responsible department.
30 Days Before Expiry: Review—the responsible department confirms whether any freeze conditions exist, such as unresolved claims, recalls, lawsuits, regulatory investigations, or customer traceability requirements. If any condition exists, mark it as frozen and defer disposal.
Destruction Approval—approved by the document control supervisor. For safety parts or regulatory parts, the quality manager must co-sign.
Execution and Evidence Retention—paper records are destroyed confidentially (shredded or professionally destroyed), and electronic records are deleted and the medium is erased, with the entire process supervised by two people.

The destruction record fields should include at least: list number, record category, coverage period, quantity (number of documents/records), approver, execution date, execution method, supervisor, and reason for destruction. The retention period for this table is recommended to be no less than the period of the records being destroyed—otherwise, it will be impossible to prove in the future that the records were destroyed in compliance, not lost.

Two common errors:

Selling entire cabinets as scrap paper: no list, no approval, no supervision, making it impossible to distinguish between "destroyed according to rules" and "records lost" after the fact, the latter being a serious issue in the IATF context.
Directly deleting cloud storage: the deletion operation leaves no trace and does not confirm the freeze status, leading to a broken evidence chain in case of a recall.

Another frequently misunderstood point: records do not have to be destroyed upon expiry. The retention period is a minimum, not a maximum. Companies can choose to retain records longer, provided they specify the "reason for retention" and the "new expiry date" in the list. The only reason for destruction should be storage cost or compliance requirements (such as personal information protection), not "space occupation."

7. How to Provide Evidence During an Audit: A 15-Minute Response Package

When asked about record retention, being able to provide four documents within 15 minutes will generally prevent a nonconformity:

Retention List (including 14 fields and the date of the most recent update)
Period Matrix (including document numbers for customer CSR and regulatory requirements)
Annual Expiry Disposal Ledger (covering the entire chain from early warning to disposal)
Most Recent Recovery Drill Record (proof of electronic record usability)

The evidence retrieval paths should also be pre-designed:

Backward Trace Path—when the auditor specifies a batch, starting from the batch number, the company should be able to retrieve within 5 minutes: inspection records, material certificates, the version of the control plan at the time, operators and equipment, and corresponding change records.

Forward Trace Path—when the auditor specifies an EOP part, the company should be able to explain: the starting point, the basis for the notification, the final period to which year and month, where the records are currently stored, and who can access them.

Common questions and response points:

Auditor's Question	Response Points	Common Failures
What is your record retention period?	Answer by category, provide the matrix, not a single number	Uniformly answer "three years"
What is the basis for this period?	Reference 7.5.3.2.1 + customer CSR number + regulatory clause	Answer "industry practice"
When does the period start?	Provide the starting event and evidence	Answer "from the date of record creation"
Are the data for EOP parts still available?	Retrieve on-site and demonstrate retrieval	Only promise to "find them later"
How do you ensure electronic records are not lost?	Archiving strategy + migration verification + drill records	Answer "IT has backups"
How do you handle expired records?	Show the destruction ledger	No records

8. Key Implementation Points and Common Errors

Key Implementation Points

First, build the retention list with all 14 fields, especially columns 8 and 9 (enhancement clause and final period), which are mandatory for audit.
Always write periods as expressions ("production service period + 1 year"), not fixed years; writing fixed years often leads to calculation errors.
EOP is the trigger for the starting point—the project department must trigger a special update to the list within 10 working days of EOP confirmation, otherwise, the period will never start.
Separate archiving from backups—the archive area must be read-only, have an independent retention policy, and be configured by record category.
Create a data migration list before system changes—perform four verifications after migration and record them.
Conduct a recovery drill annually—select a batch from three years ago and walk through the entire "find—open—compare" process.
Do not skip any of the four steps for destruction—early warning, review, approval, and dual supervision, with the destruction records themselves retained for no less than the period of the destroyed records.
Dynamically maintain the freeze mark—immediately flag any unresolved claims, recalls, lawsuits, or regulatory investigations in the list, and check this column before any destruction actions.
Verify the retention period within 10 working days after each customer CSR revision—calibrate the new requirements in column 8 and recalculate the final period.
Include the retention period in the IT storage budget—long-term batch data retention incurs real storage and maintenance costs, which must be discussed with finance and IT at the project initiation stage, not just before an audit.

Common Errors

A blanket "three years" retention policy. Ignoring the product lifecycle and customer enhancements is the most typical 7.5.3.2.1 failure.
Starting the period from the "date of record creation". This confuses the "retention period" with "counting from the filling date," leading to records being "expired" long before the part's production ends.
Treating backups as archives. Once the rolling backup window passes, old data is overwritten, and the company mistakenly believes it is retained.
Building the list but not maintaining it. Locking the list in a drawer and failing to update it when customer requirements change or the system is upgraded.
Not creating a data migration list during system changes. This results in lost attachments and field meanings, making it impossible to prove data integrity later.
Destruction without approval or supervision. This makes it impossible to distinguish between "destroyed according to rules" and "records lost" in terms of evidence.
Retaining only the most recent internal audit and management review. This fails to provide continuous evidence within a three-year certification cycle.
Retaining only exported files without metadata. The data is present, but the归属关系 lost, making it impossible to match records to batches during an audit.
Retaining training and qualification records with the person. Records are lost when the person leaves, making it impossible to trace special position qualifications.
Not checking the freeze status before destruction. Records are destroyed during a recall, escalating the issue from "incomplete records" to "evidence destruction."

The value of record management lies not in how neatly the archives are organized, but in being able to answer questions about records even ten years later. 7.5.3.2.1 requires companies to clearly calculate a retention period, essentially requiring a clear understanding of the product lifecycle: how many years the part will be produced, supplied, and under service, and how long customers will trace it after production ends. Calculating this number ensures that records are retained; failing to calculate it means retention is a matter of chance.

The retention period must be calculated, and records must be readable upon expiry.

Knowledge code: 2.1.2

Version: v20261009

Author: QTank QTank is dedicated to providing systematic knowledge, methodologies, and practical tools for quality management professionals, helping companies continuously improve their quality capabilities.