Most retention failures we see are quiet: a backup job, a reporting replica, or a vendor default that never inherited the customer-data schedule.
Sampling beats perfection. Pick the domains that hold KYC artefacts, transaction history, and support attachments. Compare stated periods to live TTL, archive classes, and legal-hold queues.
Document exceptions with dates and approvers. Regulators and banking partners care less about a perfect spreadsheet than about whether someone noticed drift and acted.
Fix the highest-impact mismatches first. Then schedule a lighter re-sample — audits that never revisit controls become theatre.