The 22-Point Archive Facility Audit: What to Inspect Before Handing a Vendor Your Records

Choosing an archive facility is not simply about finding enough shelves or a warehouse with CCTV cameras. Before handing a vendor your records, you need to inspect 22 critical areas covering security, fire protection, environmental controls, access, inventory, disaster recovery, transportation, technology, compliance, and accountability. A professional records-management partner such as Dox and Box should be able to demonstrate how every stage of custody protects the confidentiality, integrity, availability, and physical condition of your records. This matters because the National Archives and Records Administration states that storage is the “first and best means of defense” for safely preserving archival holdings.[1] ISO 11799:2024 also establishes requirements covering the siting, construction, equipment, and environmental characteristics of repositories used for long-term archive and library storage.

Why an Archive Facility Audit Matters

What should you really inspect before transferring records to an external archive facility?

The answer is simple: everything that can affect the safety, confidentiality, retrievability, and defensibility of your records.

A vendor may advertise secure storage, climate control, barcode tracking, CCTV, and professional handling. However, procurement teams should verify how those claims operate in practice.

The following checks create a practical starting point:

• Confirm the facility's actual purpose: Determine whether the building is specifically designed for records storage or is simply a general warehouse adapted for document boxes.
• Review the facility's documented standards: Ask for written evidence covering fire protection, environmental monitoring, access controls, pest management, housekeeping, emergency response, and maintenance procedures.
• Inspect the storage areas personally: Photographs and presentations cannot reveal blocked aisles, overloaded shelving, water risks, poor housekeeping, or unsuitable record-handling practices.
• Identify the records being transferred: Separate confidential, permanent, high-value, sensitive, frequently requested, and preservation-sensitive records before deciding where each category should reside.
• Check whether the facility supports mixed media: Paper, photographs, magnetic media, optical media, and other formats can have different preservation requirements and should not automatically share identical conditions.

Why does this matter?

NARA explains that storage choices have a major influence on long-term preservation and recommends housing records appropriately according to their size, format, and composition.[1]

A useful industry perspective comes from former U.S. Archivist Allen Weinstein, who described security and preservation of documents as the first responsibility of an archivist.[3]

For an Indian organisation, the principle is equally relevant. The vendor should not merely possess your records. The vendor should be able to demonstrate controlled custody.

The 22-Point Physical Facility Inspection

What exactly should you inspect during a physical visit?

Use this 22-point checklist before signing a long-term records-storage contract.

Building and Location

• Site location: Verify that the facility is located away from obvious flood, industrial pollution, unstable structures, and other foreseeable hazards that could threaten stored records.
• Building construction: Examine structural integrity, roof condition, walls, flooring, drainage, and loading capacity because records may remain inside for several years.
• Storage zoning: Confirm that storage areas are physically separated from offices, workshops, kitchens, loading zones, and activities that create unnecessary contamination or security risks.

Shelving and Storage

• Shelving quality: Check that shelving is stable, appropriately loaded, corrosion-resistant and configured to prevent boxes from touching floors, walls or vulnerable building services.
• Box condition: Inspect whether archival boxes are clean, durable, appropriately sized and protected against crushing, moisture, dust and unnecessary handling damage.
• Aisle management: Confirm that aisles remain clear and sufficiently accessible for safe movement, retrieval operations, emergency response and inspection activities.

NARA's preservation guidance specifically notes that appropriate housing provides physical support and protection while buffering records against adverse environmental conditions.[1]

Environmental Controls

• 7. Temperature monitoring: Ask how temperature is measured, where sensors are positioned, how frequently readings are recorded, and what happens when conditions move outside approved limits.
• 8. Relative humidity monitoring: Verify continuous humidity monitoring because excessive or fluctuating humidity can contribute to mould, corrosion, distortion and deterioration of vulnerable materials.
• 9. Air quality: Ask whether filtration and ventilation systems address particulate matter and gaseous pollutants that may contribute to long-term deterioration of archival materials.
• 10. Environmental records: Request historical temperature and humidity reports rather than accepting a verbal statement that the facility is climate controlled.

ISO 11799:2024 specifically addresses repository characteristics for long-term storage and recognises that different materials may require controlled areas within a facility.

NARA guidance similarly emphasises environmental monitoring, filtration and controlled storage conditions for archival holdings.

Fire and Water Protection

• Fire detection: Verify the presence, testing and maintenance of appropriate fire detection systems and determine whether alerts reach a continuously monitored location.
• Fire suppression: Ask what suppression system protects the storage area, when it was last tested, and how the design limits potential damage to records.
• Water protection: Inspect plumbing routes, roof drainage, sprinkler arrangements, leak detection, and the positioning of records relative to potential water sources.
• Emergency exits: Confirm that emergency exits are clearly marked, unobstructed, and incorporated into documented evacuation and emergency-response procedures.

NARA guidance requires strong attention to fire prevention, housekeeping, fire alarms, emergency exits and monitoring for water-related incidents.

Housekeeping and Pest Control

• Cleanliness: Look for dust accumulation, food, waste, standing water, damaged boxes and other housekeeping issues that can increase deterioration and pest risks.
• Pest management: Ask for documented inspection schedules, treatment records, monitoring methods, and procedures for handling evidence of insects, rodents, or other biological threats.

NARA's archival-storage standards treat preservation, environmental control, fire safety and security as connected facility-management responsibilities rather than isolated activities.[6]

Security, Access and Records Accountability

Can a facility be considered secure simply because it has CCTV?

No. CCTV is only one layer of security.

A proper audit should examine who can enter the facility, which employees can handle records, how access is authorised, and whether every movement can be reconstructed later.

Physical Security Controls

• Entry controls: Verify badge, biometric, or equivalent access controls and determine whether access permissions are assigned according to job responsibilities.
• Surveillance: Confirm camera coverage for entrances, loading areas, corridors, storage zones and dispatch points, along with retention periods for surveillance footage.
• Personnel screening: Ask whether employees handling client records undergo appropriate background verification, confidentiality commitments and role-based security training.
• Visitor controls: Verify whether visitors, contractors and maintenance personnel are logged, escorted where necessary and prevented from accessing records without authorisation.
• Chain of custody: Confirm that every receipt, movement, retrieval, return and destruction event creates a traceable record showing who handled the material and when.
• Inventory reconciliation: Test whether the vendor can locate a sample box quickly using its identifier and reconcile the physical item against the inventory database.

Why is chain of custody so important?

Because records may eventually become evidence in litigation, regulatory investigations, audits, tax matters, employment disputes, or internal investigations. A box that cannot be located or whose movement cannot be explained creates an avoidable evidentiary problem.

NARA's commercial records-storage guidance requires agencies using commercial facilities to ensure that the facility complies with applicable storage standards and allows inspection rights.

For organisations managing sensitive records, Dox and Box can help establish structured control over physical records while connecting archival storage with broader records-management processes.

Technology, Digital Records and Retrieval Controls

What happens when your archive is partly physical and partly digital?

This is where traditional box storage alone becomes insufficient.

Modern organisations increasingly need a connected approach to scanning, indexing, retrieval, electronic storage and physical archive management.

Digital Control Points

• Digital inventory: Confirm whether every physical container can be represented digitally with unique identifiers, metadata, location information, retention status and retrieval history.
• Search capability: Test whether authorised users can locate records using meaningful metadata rather than relying entirely on box numbers or manual registers.
• Access permissions: Verify role-based permissions for digital records and administrative systems, particularly where documents contain personal, financial, legal or commercially sensitive information.
• Audit trails: Confirm that the system records logins, searches, downloads, modifications, transfers, approvals and other important activities in a tamper-resistant manner.
• Backup arrangements: Ask how frequently information is backed up, where backups are stored, and how restoration is tested.
• Recovery testing: Do not accept “we have backups” as sufficient evidence. Request evidence that restoration procedures have actually been tested.

NARA has highlighted the growing volume of electronic records and the importance of capacity, efficient throughput and security for digital holdings.

This makes integrated records management increasingly important. Organisations asking how to manage both physical and electronic records efficiently with Dox & Box should look beyond simple digitisation and consider a lifecycle approach covering capture, indexing, storage, retrieval, retention and disposition.

Digital mailroom processes can further reduce manual handling at the point where incoming documents enter an organisation. For businesses handling substantial correspondence volumes, digital mailroom automation services can support document capture, classification, routing and indexing before records enter downstream workflows.

The important question is not whether a vendor has software. It is whether its technology creates a reliable link between the physical record and its digital representation.

Disaster Recovery, Compliance and Vendor Governance

What happens if the archive facility experiences a fire, flood, cyberattack, power failure, civil disruption, or sudden business closure?

Your audit should answer that question before the records arrive.

Business Continuity

• Disaster recovery plan: Request a documented plan covering fire, flood, water leakage, pest incidents, system failure, cyber incidents, theft and prolonged power disruption.
• Recovery priorities: Confirm that critical records are categorised so the vendor knows which materials must be recovered first after an incident.
• Alternative facility: Ask whether records can be temporarily relocated and how the vendor will preserve inventory accuracy during emergency movement.
• Emergency contacts: Verify named contacts, escalation procedures and communication timelines for incidents affecting confidentiality, availability or physical integrity.
• Insurance coverage: Review applicable insurance policies and exclusions, especially where the records have legal, financial, historical or operational significance.

Compliance and Contracts

• Inspection rights: Ensure the contract allows the client or authorised auditor to inspect the facility, systems, processes and relevant records.
• Confidentiality obligations: Define confidentiality requirements for employees, subcontractors, transport providers, technology partners and other parties involved in records handling.
• Retention and disposition: Specify that records cannot be destroyed merely because a storage period has expired. Authorised disposition must follow the client's approved retention rules.
• Exit provisions: Establish procedures for returning, transferring or securely destroying records when the contract ends, including inventory reconciliation and certificates of destruction.
• Subcontracting controls: Require disclosure and approval of material subcontractors that may receive custody, transport, or processing responsibilities.

NARA guidance demonstrates why contractual and inspection controls matter. Agencies using commercial records-storage facilities must ensure compliance and retain the ability to inspect facilities.

A good vendor relationship therefore begins with measurable obligations rather than broad promises.

The Dox and Box Standard for Vendor Selection

So, what should the final decision look like after the 22-point audit?

Do not select a records-storage vendor merely because it offers the lowest price per box. Evaluate the complete risk profile.

A useful scoring approach is to classify every audit item as Compliant, Partially Compliant, Non-Compliant, or Not Applicable.

Before Signing the Contract

• Document every observation: Photograph relevant facility conditions, record evidence reviewed, and document gaps instead of relying on verbal explanations from vendor representatives.
• Score critical risks separately: Fire protection, access control, chain of custody, environmental monitoring, disaster recovery, and inventory accuracy should receive greater weight than cosmetic facility features.
• Demand corrective actions: Ask the vendor to provide written deadlines and responsible personnel for every significant gap identified during the audit.
• Conduct a sample retrieval: Select several boxes and test whether the vendor can identify, retrieve, deliver, and return them while maintaining complete transaction records.
• Review performance periodically: Facility audits should continue after onboarding because security controls, staffing, technology, environmental systems, and business conditions can change.

This is where Dox and Box can add value beyond simple storage.

A modern records-management approach should connect physical custody, digital indexing, controlled access, retrieval, retention and eventual disposition into one accountable lifecycle.

The best archive facility is therefore not necessarily the biggest warehouse. It is the facility where your organisation can answer five questions at any time:

Where is the record? Who has access to it? What condition is it in? Can it be retrieved quickly? Can its entire custody history be demonstrated?

If the vendor cannot answer these questions with evidence, the audit is not complete.

The 22-point audit provides a practical framework for asking those questions before records leave your premises. By combining facility inspection with technology, documentation, contractual controls and ongoing monitoring, organisations can reduce the risks associated with outsourcing records custody while improving retrieval and accountability.

For businesses looking to bring physical and electronic records under one structured management framework, Dox and Box provides a practical foundation for secure records management, digitisation, indexing, retrieval and lifecycle control.