It usually starts with an email.
A regulator, an external audit firm, or your own legal team needs records. Specific records. Transactions from 2013 to 2016, say, with supporting documents, and evidence of who has accessed them since. The deadline is not negotiable.
And now the real question gets asked, often for the first time in years: where is that data, actually?
The scramble
If those records live in a retired or barely-maintained system, a familiar sequence begins.
Someone tries to log in to the old application. The password has expired, or the person who owned it has left. IT restores access, only to find that the reporting module needs a licence that lapsed in 2021. A consultant who worked on the system a decade ago gets a phone call. Extracts get pulled into spreadsheets, manually, with no way to prove they’re complete.
Meanwhile the clock runs. Every day of scrambling has a cost — in people pulled off real work, in emergency consulting fees, and in the impression it makes on the auditor. Because auditors notice how you produce records, not just whether you produce them. A stumbling, manual, best-effort response invites deeper questions. Confidence invites fewer.
The uncomfortable maths
Here’s the thing about audit readiness: organisations pay for it either way.
Some pay continuously — keeping legacy applications alive year after year, with licences, infrastructure and increasingly rare specialist skills, purely so that old data stays theoretically reachable. Others pay in a lump — the emergency scramble when the request lands, plus whatever the consequences are if records can’t be produced in time.
Neither is a strategy. Both are just deferred decisions.
What “prepared” actually looks like
A prepared organisation has done something structurally different: it has separated the information from the applications that created it.
That’s what an enterprise archive is for. With OpenText Information Archive, records from retired and live systems are preserved in one secure, application-independent archive — searchable long after the original applications are gone. When the audit email arrives, the response looks like this instead:
Finding the records is a search, not a project. Authorised users query the archive directly and retrieve records from any archived system in one place — no legacy logins, no consultants, no reverse-engineering a dead database.
Access history comes with the records. InfoArchive can audit the events that matter — ingestion, searches, views, downloads, retention changes — with a dedicated Auditor role kept separate from administration. So “who accessed this and when” is a report, not an investigation.
Retention is demonstrable, not anecdotal. Records carry enforced retention policies. Nothing is disposed of without qualifying under policy and being explicitly approved. If something needed to be preserved for litigation, a hold blocked its deletion — provably.
Exports are ready for the auditor. Search results and audit reports can be exported directly, so evidence is handed over in an orderly, defensible form.
The real deadline
The uncomfortable truth about sudden audits is that they’re only sudden for the unprepared. The obligation to produce those records existed all along — the audit just made it visible.
So the question isn’t really “what happens if you have a sudden audit?” It’s: is your organisation one email away from a scramble, or one search away from an answer?
If you’re not sure, that’s worth finding out before someone else asks.
Procentrica is an OpenText Information Archive certified delivery partner. We help organisations decommission legacy applications, reduce storage costs and strengthen compliance — while keeping business records accessible for as long as they’re needed. Talk to us.
Learn more: See how Procentrica implements OpenText Information Archive
– Author: Raymond Barreto-Long
