Retention Schedule Meets a Litigation Hold

Finding 1 - purge overrode a litigation hold. This is a preservation failure with legal consequence: evidence subject to a hold was destroyed. The control design flaw is that the purge job does not check hold status before deletion; the governance flaw is that the hold was communicated to IT but never operationalized into the deletion pipeline. Frame it as a high-severity finding with two parts: (a) technical - no hold-check gate in the purge logic; (b) process - no reconciliation between legal hold register and automated deletion. Include the 1,400-record count, the 8-month gap between hold issuance and purge, and a note that spoliation exposure is a legal matter for counsel, not something the auditor resolves.

Finding 3 - no automated claims disposal, 19-month gap. This is a retention-limit failure: data kept beyond schedule. It is serious but it is over-retention, not destruction of evidence. Frame it as medium-to-high: the schedule exists on paper but is not enforced, so the organization cannot demonstrate storage limitation. The manual process has no evidence of completion for 19 months.

Which is worse? Finding 1. Over-retention creates privacy and cost exposure; destroying held evidence creates litigation and potential sanctions exposure, and it is irreversible. The asymmetry of harm makes Finding 1 the priority. Note also that the two findings interact: the absence of automated claims deletion is why claims data survived, but the marketing purge's aggression is why held data did not. The organization has both too much deletion and too little - a sign that disposal is not governed by a single consistent control.

The distinction matters because the remediation differs: a retention breach needs deletion; a discovery gap needs an inventory and control fix; both need a scope correction.

Evidence to establish a retention breach:

• Extract recording metadata (date, call ID, associated policy/claim) from the cold-storage bucket and compare against the 90-day schedule.
• Confirm the recordings are actual call content, not backups or test data - sample and listen/transcribe a small set.
• Check whether any legal hold, regulatory retention, or complaint investigation applies to any subset. If a hold covers some, those are lawfully retained and must be carved out.
• Quantify: how many recordings, how far past 90 days, and whether any contain special-category data (health, financial hardship disclosures).

Evidence to establish a discovery gap:

• Review the data inventory and records of processing: is the cold-storage bucket listed as a system of record for call recordings? If not, the inventory is incomplete.
• Check the purge job's configuration and scope documentation - was cold storage ever in scope, or was it added later and never wired in?
• Interview the storage owner and the retention-schedule owner to establish whether anyone knew the bucket existed.
• Test whether subject-access or deletion requests would have found these recordings (run a test DSAR against a known call ID).

Conclusion logic: if the bucket is absent from the inventory and DSAR tooling cannot reach it, it is both - a retention breach and a discovery gap, and the discovery gap is the root cause. If it is inventoried but the purge simply missed it, it is a retention/control-scope breach only. Either way, the audit should recommend a storage-tier reconciliation control so that every retention class has a mapped purge path across primary, cold, and backup tiers.

Problem: 'may retain data as required by law' is an open-ended permission with no deletion obligation, no certification, and no defined trigger. The insurer cannot demonstrate that vendor-held marketing data is deleted at 24 months.

Contractual changes:

• Replace the clause with an affirmative deletion obligation: delete or return all data within 30 days of contract end or of the retention-schedule trigger, whichever is earlier.
• Require a certificate of destruction per deletion cycle, naming the data categories, record counts, and date.
• Narrow any legal-retention carve-out to specific statutes, with notice to the insurer and a defined review date.
• Add audit rights and a sub-processor list with flow-down of the same obligations.

Monitoring changes:

• Add the vendor to the deletion-tracking register with the 24-month trigger date per batch.
• Require an annual attestation and spot-check the certificate against the insurer's own record counts.
• Include the vendor in the disposal audit sample each cycle.

Verification: request the most recent certificate, reconcile counts to the insurer's marketing-list export, and - for a sample - ask the vendor to demonstrate the deletion in a system screenshot or log extract. If the vendor cannot produce a certificate, treat the data as retained and escalate. Re-test at the next cycle; a single certificate is a point-in-time artifact, not a control.