According to IIA guidance, the chief audit executive (CAE) is responsible for establishing policies and procedures for the internal audit activity, including the retention of audit records. These requirements should be aligned with the organization's overall processes and procedures to ensure consistency and compliance with legal and regulatory requirements. This approach ensures that the retention policy is tailored to the specific needs and context of the organization, while also maintaining alignment with broader organizational policies.
Reference:
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard 2330 - Documenting Information The Institute of Internal Auditors (IIA) - Practice Advisory 2330-1: Document Retention