Key takeaways
- Study one onboarding record category moving from collection to its authorized system of record, not a person's character.
- Predefine and observe record-category classification, named legal or business basis, authorized destination, access owner, retention rule, transfer acknowledgment, working-copy closure, disposal authorization, and unresolved exception age.
- Keep exclusions, missing records, and rival explanations visible.
- Reserve consequential decisions for named authorized people.
Table of contents
- Trace custody by record category
- Why one retention period is the wrong model
- A minimal handoff record
- Failure modes hidden by a tidy archive
- Close uncontrolled copies with authority
- Limitations: What the handoff evidence does not establish
- Keep the register smaller than the records
- Decision log for each record class
Trace custody by record category
An onboarding handoff is complete only when a defined record category reaches its authorized system and temporary copies receive an explicit disposition. Study one category at a time, such as payroll, time, Form I-9, acknowledgment, equipment, or training evidence. Do not open unrelated content merely to prove that a file moved.
For each category, name the accountable owner, legal or business basis, destination, access group, retention instruction, transfer acknowledgment, and rule for working copies. The decision is whether the intake copy may close, needs correction, or must stay under an authorized hold or exception.
| Design element | Recorded evidence | Interpretation limit | Decision use |
|---|---|---|---|
| Question | Can a field-level handoff show that onboarding records reached the correct authorized system with a defined retention basis and no uncontrolled working copies? | No causal estimate | Define the checkpoint |
| Unit | one onboarding record category moving from collection to its authorized system of record | One bounded path | Make events comparable |
| Measures | record-category classification, named legal or business basis, authorized destination, access owner, retention rule, transfer acknowledgment, working-copy closure, disposal authorization, and unresolved exception age | No universal threshold | Locate a repair |
| Decision | whether an onboarding record can leave the temporary intake workflow, must be corrected, or requires review by the accountable records, legal, privacy, or security owner | Authorized owner required | Choose the next bounded step |

Why one retention period is the wrong model
DOL Fact Sheet #21 describes particular payroll and time records and federal retention duties under the FLSA. The M-274 handbook addresses Form I-9 completion, storage, correction, retention, and inspection. The FTC guide asks businesses to inventory personal information, keep only what they need, protect it, dispose of it securely, and prepare for incidents. Each source governs a different layer.
The synthesis supports a category-specific register, not one company-wide number copied onto every onboarding file. State law, contracts, litigation holds, benefit rules, and organizational policy may add duties outside these sources. An authorized records or legal owner must resolve those questions before disposal.
A minimal handoff record
Record the category, intake location, authorized destination, transfer event, receiving owner, applicable rule, scheduled review or disposition date, working-copy locations, and open exception. Link to the controlling instruction instead of copying sensitive material into the register. The trace should prove custody without becoming a second personnel file.
Review consecutive handoffs during a declared window and include failures. Count orphaned attachments, exports, abandoned forms, duplicate scans, and unacknowledged transfers. A destination receipt does not prove the source copy disappeared, and a deletion checkbox does not prove removal from backups or processors.
Failure modes hidden by a tidy archive
The obvious failure is a record in the wrong system. Less visible problems include applying a payroll rule to Form I-9, mixing medical material with general personnel records, leaving attachments in shared mailboxes, keeping spreadsheet exports, or granting access because it is convenient. Unclear disposal authority can be as dangerous as indefinite retention.
Use a synthetic exception to test the handoff, such as a legal hold, a rejected transfer, or an unavailable destination owner. The correct result may be an isolated, documented hold. Staff should not delete uncertain material or move it through a personal channel just to complete the checklist.
Close uncontrolled copies with authority
When a trace breaks, stop further copying and identify the record category with the accountable owner. Move only required fields through an approved channel. Confirm receipt, then close, retain, or dispose of each working copy according to the applicable instruction. Preserve holds and unresolved exceptions visibly.
Repair the narrow custody defect before reviewing the whole route. If an export cannot be verified as removed, record that uncertainty and assign follow-up. Do not rewrite the history as a clean transfer. Recurring temporary storage needs a named owner, access rule, and review date.
Limitations: What the handoff evidence does not establish
This protocol does not supply a universal schedule, interpret jurisdiction-specific law, authorize deletion, or prove erasure across backups and vendors. It observes declared locations and actions. Missing inventory entries, inaccessible systems, and informal copies can make a clean trace incomplete.
OnboardingEmployees would use the result to identify a category, custody gap, owner, and next decision. It should not label the organization compliant or publish sensitive record counts. The defensible conclusion is that the reviewed category followed, or failed to follow, its named route during the stated window.
Keep the register smaller than the records
Preserve category definitions, source versions, destination identifiers, transfer acknowledgments, copy-disposition states, exclusions, and owner decisions. Use synthetic examples for reviewer training. Restrict the register because even metadata can reveal employment activity or system structure.
A later review should compare the same category and custody states. Report unresolved copies instead of assuming disposal, and separate lawful holds from operational delay. The niche value is evidentiary: the team can show where responsibility changed hands without duplicating the employee material being governed.
Decision log for each record class
Close the review with one row per record class. State the authoritative destination, receiving owner, applicable instruction, transfer evidence, temporary locations, disposal or hold authority, unresolved copies, and next review. A blank field means the handoff is open. It should not be filled with a general policy statement that no reviewer can connect to the actual custody path.
Test retrieval as well as transfer. An authorized owner who cannot locate the record may have received only a notification, while an intake team may still hold the usable copy. Conversely, broad retrieval can reveal that access followed a folder rather than the record's purpose. The trace needs enough system detail to resolve those questions without exposing the record itself.
Recheck a class when its collection form, destination, processor, access group, governing rule, or hold status changes. Compare like categories rather than combining every onboarding artifact into one completion percentage. A payroll register and a Form I-9 file can both be complete while requiring different custody evidence and different authorized decisions.
Sources and methodology
Field-level documentary synthesis of DOL Fact Sheet #21, the USCIS M-274 handbook, and the FTC business data-protection guide, checked September 23, 2026. The protocol traces record categories and custody states without inspecting employee contents; it does not create a universal retention schedule. Reviewers predefine the eligible record class, observation window, and custody states. They retain missing transfers, holds, disputed classifications, and unresolved copies in the final count. The resulting evidence describes declared custody events only and remains subject to review by the responsible records, privacy, and legal owners.
- Fact Sheet #21: Recordkeeping Requirements under the FLSAcurrent guidance. Official summary of covered payroll and time records, accuracy duties, and federal retention periods.
- Handbook for Employers M-274current online edition. Official guidance for Form I-9 completion, storage, retention, correction, and inspection.
- Protecting Personal Information: A Guide for Businesscurrent guidance. Federal business guidance for inventorying, minimizing, securing, disposing of, and planning around personal information.
Source count: 3. Last verification date: September 23, 2026.
Related research
FAQ
What is the unit of analysis?
The proposed unit is one onboarding record category moving from collection to its authorized system of record.
Does this design establish causation?
No. It is a descriptive local observation informed by documentary synthesis.
What should happen when the path fails?
freeze uncontrolled movement, classify the record with an authorized owner, move only the required fields through an approved channel, close or document working copies, and preserve any lawful hold or exception.
What are the main limitations?
This evidence design does not supply a universal retention schedule, interpret jurisdiction-specific law, authorize deletion, or prove removal from backups and downstream processors. Local context, small samples, missing cases, and changing tools also limit interpretation.
Who retains consequential decisions?
Named authorized people retain legal, employment, privacy, security, financial, access, accommodation, and irreversible decisions.
Review the full research library, compare cluster coverage inside recruiting operations, and pair these findings with our VA candidate screening support.