The accreditation criterion, “Maintenance of Commercial Records”, requires a company to manage important commercial records securely and systematically, and guarantee the completeness and accuracy of records, especially those relating to the importation or exportation of goods, licenses, permits, etc.

Therefore, the company shall have an effective record management system with procedures on classification, retrieval, storage, retention and disposal of records. It is equally important to conduct internal audit on systems and records at planned intervals.

Firstly, the company shall classify its records into different level of sensitivity, such as normal, restricted, confidential, etc., and limit the access to records through different security measures. For example, paper documents are stored in locked cabinets or storage rooms with a designated staff controlling the access keys, and electronic records are protected from unauthorized access by installing passwords and smart card identification system.

In addition, the company shall specify the retention time, methods of retrieval and procedures for disposal of obsolete records. For example, the company shall appoint a designated staff to monitor the archiving and disposal of records.

At last, the company shall conduct internal audits on the record management system and records at planned intervals. Internal auditor should be appointed to inspect if management procedures are properly executed and records are complete and accurate. The audit results shall also be reviewed for areas of improvements subsequently.