18.1 Contract File Maintenance, Version Control and Retention

Build the record as decisions occur

A procurement file should allow an authorized reviewer to reconstruct what was required, which rules applied, who decided, what evidence was considered, what was agreed, and how performance and payment were verified. It is an operational control as well as audit evidence. Reconstructing a justification months later is less reliable than recording the actual analysis and approval at the time.

Assign responsibility for the official file. Program staff, procurement, finance, legal, inspectors, and the supplier may each hold relevant records, but the contract administrator needs a reliable index and retrieval process. Identify which repository is authoritative, how related records are linked, who can upload or edit, and who can approve deletion or release. Avoid an uncontrolled collection of email attachments with identical filenames.

Organize by the decision lifecycle

A useful file structure follows planning, sourcing, award, administration, and closeout. Include approved requirements and estimates; applicable funding and authority; method justifications; the published solicitation and addenda; receipt and access logs; submitted offers; conflict disclosures; evaluation and negotiation records; approval and award notices; the executed agreement; bonds and insurance; performance evidence; changes; payments; disputes; renewals; and closeout.

The index should identify a document's date, version, owner, status, and relationship to the contract or modification. An executed amendment must not overwrite the original agreement. A revised price sheet needs an effective date so invoices can be checked against the correct rate for the performance period.

Preserve provenance and prevent silent edits

Maintain original submissions and the authorized final versions. Use version control or repository features that record who changed a document and when. If a scoring spreadsheet contains a formula error, preserve the original, document the correction, obtain review, and retain the corrected result. Do not erase an inconvenient score or replace a rationale without a trace.

Separate working drafts from approved records, but do not assume drafts are exempt from retention or disclosure. A “draft” label describes status, not automatic legal protection. Preserve relevant communications, meeting records, attachments, and system logs according to the actual schedule and any hold. Where a record is migrated between systems, verify that files, metadata, permissions, and retrieval links remain usable.

Restrict access without blocking accountability

Apply access according to role and procurement stage. Submitted proposals may need protection before opening or during evaluation. Vendor financial information, personal data, security details, and legal material can require different controls. Give reviewers enough access to perform their duties while recording access and protecting data from unauthorized sharing.

Keep a public-release copy separate from the complete official record. A redaction should not permanently destroy the underlying content. Record the legal basis and approving officer for each withholding decision, and retain the request, response, and production record. Disclosure, retention, and access are separate questions: a record can be retained securely without being immediately public, and a released copy does not replace the complete file.

Apply the right retention trigger

Use the approved records schedule, award terms, property requirements, and applicable law. Contract execution, final payment, final financial reporting, property disposal, and audit resolution are different triggers. Do not use an assumed national retention period for all procurement records. Records relevant to a protest, claim, audit, investigation, or litigation must remain preserved as the governing hold requires.

For federal assistance, 2 CFR 200.334 generally provides a three-year period beginning with submission of the final financial report, with stated exceptions and special triggers. This is not automatically three years from the last invoice. If a longer local schedule or unresolved audit applies, do not destroy the records merely because the ordinary federal period has elapsed.

Worked file-control decision

A contract administrator leaves the agency during an ERP migration. The incoming administrator finds a signed contract, two spreadsheets both named “final rates,” and invoices referencing a missing amendment. The appropriate response is to preserve the existing records, restrict unsupported rate changes, locate the approval and execution evidence, reconcile versions with procurement and finance, and document the confirmed effective rates. Asking the supplier which price it prefers does not repair the official record.

After reconciliation, update the index and assign an owner for missing-record follow-up. Preserve the discrepancy and resolution rather than hiding the earlier uncertainty. Test retrieval of the signed agreement, amendment, acceptance record, and invoice from the new repository. A successful migration is demonstrated by complete, accurate, accessible records, not merely by counting uploaded files.

The CPPB lesson is that documentation is part of performing the process, not an afterthought. An unsupported memory that “the director approved it” cannot replace the required approval evidence, while an unexplained spreadsheet total cannot establish that the correct rate was applied.