How long should LEV test reports be retained for audit purposes?

LEV test reports should be retained for at least five years, although many organisations keep them for longer. This allows trends in system performance to be reviewed over time and helps demonstrate consistent compliance.

From an audit perspective, having historical reports available shows that systems have been maintained and re-tested as required. It also helps explain any recurring issues or system modifications.

If exposure concerns, claims, or investigations arise, older reports can become important evidence. They provide context and show what controls were in place at specific points in time.

In practice, retaining reports for the life of the system, or at least while it remains in use, is often the most sensible approach.