Compliance Documentation: What to Keep on File
Compliance documentation for property managers: what belongs in the file, how to index it, how long to keep it, and how to retrieve it under pressure.
Compliance documentation fails in a predictable way. It is complete enough on the day it is created, then drifts: a certificate goes into an email, a service report into a van, a closing letter into someone's desk drawer. Two years later the file exists but cannot answer a simple question. Good compliance documentation property practice is therefore less about paperwork than about a filing structure that survives staff turnover, so the right document can be produced on the day it is asked for.
Key takeaways
- A compliance file is a set of documents plus an index that says what exists, where it is, and when it expires
- Keep one authoritative copy of each document; duplicates in three places create version disputes
- Retention runs to the longest applicable obligation: statute, contract, insurance policy or limitation period
- Every document needs three facts attached: what it covers, the date it applies from, and who issued it
- Store by building, then system, then date — not by supplier or by year folder
- Never destroy anything subject to an open claim, dispute or investigation — critical
What counts as compliance documentation?
Answer first: any record that proves a legal, contractual or insurance obligation was met on a specific date, in a specific building.
That definition is deliberately narrow. Marketing material about a contractor's capabilities is not compliance documentation; the certificate that contractor issued for the work is. A policy document is not proof of anything until it is paired with evidence that the procedure in it was carried out. The test to apply to any document is simple: if a regulator, insurer or owner asked you to prove a specific obligation was met last March, would this document do it?
CCOHS's guidance on health and safety programs notes that some form of program is required under legislation in most Canadian jurisdictions, and a program that cannot be evidenced is difficult to defend. The evidence is what the file holds.
What belongs in a building compliance file?
Answer first: certificates, test reports, licences, service records, inspection records, training records and the correspondence that links them. The list is longer than most managers expect, and it is best organised by system rather than by contractor.
| Document type | Who normally issues it | Typical retention |
|---|---|---|
| Fire alarm, sprinkler and extinguisher test reports | Servicing contractor | Life of the system, minimum five years |
| Elevating device licence and maintenance records | Regulator and maintenance contractor | Life of the installation |
| Boiler and pressure vessel certificates and logs | Regulator and operating engineer | Life of the equipment |
| Electrical inspection certificates and defect clearances | Electrical authority or contractor | Life of the installation |
| Water testing, backflow and pool records | Testing contractor | Per the applicable regulation |
| Contractor insurance certificates | Contractor's broker | Current plus the policy tail |
| Contractor safety documents and inductions | Contractor | Term of the contract plus three years |
| Scored building inspection records and photos | Manager or inspector | Life of the asset, minimum five years |
| Training and certification records | Employer | Employment plus the limitation period |
| Incident reports and closure notes | Manager | Minimum five years, longer if a claim exists |
| Regulator orders and your responses | Regulator | Permanently |
Two rows in that table are consistently missing from real files: contractor insurance certificates, which are allowed to lapse quietly between renewals, and the correspondence that shows an order was answered. Both are cheap to keep and expensive to reconstruct.
Compliance documentation property by property: how to structure the file
Answer first: by building, then by system, then by date, fronted by a one-page register that lists every document and its expiry.
A workable structure has three layers:
- The register. One table, one row per document set: the obligation, the frequency, the responsible party, the date of the last evidence, the next due date, the storage location.
- The document store. Folders named for the building and the system, with dates in the file name in year-month-day order so they sort chronologically.
- The correspondence file. Orders, notices, contractor letters and your responses, kept with the system they concern rather than in a general inbox folder.
The register does most of the work, and it is the layer managers skip. Without it, a file is a pile that requires its owner to be present to interpret. With it, a relieving manager, a new building operator or a broker can answer a records question in under a minute.
Where the same fact lives in two systems, decide which is authoritative and say so in the register. The practical version of that decision for inspection records is set out in inspection records and retention — one copy, one format, one retention rule.
Who holds which document?
Answer first: the owner of the obligation usually holds the original, and the manager holds a copy plus proof it is current.
Three parties overlap on almost every regulated system. The contractor holds the working file and the test records. The building manager holds the operational record and the closure evidence. The owner holds the contract and often the certificate, because the regulator issues it to the owner entity. Any of the three can be asked to produce it, so the manager's copy should be complete enough to answer without a phone call.
Contractor documents need renewal dates, not just receipt dates. Filed by arrival date alone, an insurance certificate can expire unnoticed nine months before you need it. The verification routine for those items is covered in vendor insurance and compliance checks.
How long should compliance documents be retained?
Answer first: for the longest of the four obligations that apply, which is usually the limitation period rather than the regulation.
- Regulatory minimums. Provincial rules set floors for specific records — life safety testing, water quality, elevating devices, incident reports.
- Contract terms. Management agreements and leases often specify what must be kept, in what form, and for how long.
- Insurance requirements. Property and liability policies commonly require records for the policy period plus a defined tail. Ask the broker in writing.
- Limitation periods. A claim can be brought for a defined period after damage is discovered. Condition records must outlive that window.
Where two rules conflict, keep the longer one and note why in the register. Storage is cheap; reconstructing a lost record from a contractor's archive is not.
Not regulatory advice. Retention periods vary by province, by building type and by the records concerned, and they change. Confirm the applicable requirements with your provincial regulator, your insurer and your legal advisor, and follow the management agreement where it sets a longer period.
What makes a compliance document usable years later?
Answer first: attribution, a date, a location and an unaltered original.
A report saying "system tested, satisfactory" is nearly useless. One that names the device, the address, the date, the technician and the result is evidence. When a document arrives without those details, ask for a corrected copy while the contractor still remembers the job; that is a two-minute request in the week after and a lost argument two years later.
Photos need the same treatment. A photo of a fire door propped open is evidence only if it carries a date, a location and a link to the finding it supports. Consistent condition evidence is covered in documenting building condition.
What should be digitised first?
Answer first: anything that expires, anything a regulator asks for on site, and anything you would need after an incident.
Certificates and licences with expiry dates come first, then life safety test reports, contractor insurance and safety documentation, scored inspection records and their photos, orders and responses, and training records. Keep paper originals of permits, signed orders and sealed certificates alongside the scan; never scan an original that is being sent away, and never destroy the paper after a partial scan.
What should be destroyed, and when?
Answer first: on a published schedule, with a destruction log, and never while a dispute or investigation is open.
Destruction is part of a sound policy, not a suspicious act. Records kept beyond their useful life cost storage, slow retrieval and raise disclosure exposure in a claim or access request. A defensible policy has a schedule saying what goes and when, a log recording what was destroyed, the date range and who authorised it, and a hard stop whenever a claim, dispute, investigation or legal hold is reasonably anticipated.
That last point overrides everything else. Destroying a document after a hold is anticipated is the most damaging thing a manager can do to their own position, regardless of what the schedule said — critical.
Frequently asked questions
Do I need paper copies if everything is scanned?
Not for most records, provided the scan is legible, complete and stored with the date and source recorded. Keep the paper original for permits, signed orders and certificates a regulator or court may want to see in its original form. Never keep a partial scan and destroy the original.
Who owns the compliance file when a management contract ends?
The records belong to the owner entity and the management agreement, not to the individual manager or the outgoing company. Check the agreement for the handover clause, produce an indexed copy, and get written acknowledgement of what was transferred.
How do I stop certificates from expiring unnoticed?
Track next-due dates, not receipt dates, in a single register, and review it monthly for items falling due in the next ninety days. A certificate with a renewal date seven months away is invisible in a folder and obvious in a register.
Should contractor safety documents sit in the same file as building records?
They can share a store but should be indexed separately, because they expire on the contractor's cycle rather than the building's. The register needs the expiry date and the person who chases the renewal.
What do I do with a document I cannot identify?
Keep it and flag it. An unlabelled certificate found in a mechanical room may be the only copy of a test result for a system still in service. Ask the contractor or the regulator before disposing of anything you cannot date.
A compliance file is an operating habit
The difference between a file that works and one that does not is rarely effort. It is sequencing: capture the document when it arrives, add one register line, set the next-due date, and only then let the paperwork leave your hand.
NeatScore does the inspection half of that habit: scored inspections against APPA 1–5 levels, photos attached to each item, critical items flagged, deficiencies tracked to closure, and dated branded PDF reports that give you a stable record of condition over years. Try it free for 14 days, or see pricing.
The wider programme — records that exist because a system is maintained, not only because a filing obligation says so — is set out in preventive maintenance for property managers. For the systems that fill the thickest part of the file, elevator maintenance and inspection records shows what a complete set looks like.
