The usual order
- The inventory
What do you hold, and where?
- The access log
Who has touched it, and when?
- The file itself
Complete, and produced within the time allowed.
- The destruction record
For anything that should exist and no longer does.
Compliance
What an auditor actually asks for, in order
The inventory first, then the access log, then the file.