OFCCP audit support and job posting recordkeeping require more than a screenshot of an advertisement: VEVRAA personnel-record rules and affirmative action program record requirements use different retention clocks. Build a retrievable chain from requisition approval through listing, applicant decisions, and outreach assessment, with a retention rule attached to each record category.

Key takeaways

• Index records by requisition, hiring location, and affirmative action program year.
• Keep transmission evidence and receiving-system confirmation together.
• Separate confidential self-identification information from routine hiring files.
• Distinguish one year, two years, and three years; preservation holds can require longer retention.

What should your OFCCP audit support and job posting recordkeeping index contain?

Start with an index that connects each hiring action to its source records, responsible owner, and applicable retention category. A reviewer should be able to follow the record without asking the original recruiter to explain a folder name. The structure below is a suggested operating method, not an agency-mandated filing format.

Use stable requisition identifiers even when a title changes or a recruiter leaves. Include the hiring location, recruiting dates, position status, applicable affirmative action program (AAP) year, and links to the systems holding the underlying evidence. Record who can retrieve restricted material without placing that material in the general index.

The recruitment records needed during an OFCCP audit become easier to produce when the index explains their relationships. A folder full of exports is less useful if nobody can identify which advertisement generated the applications or which disposition code applied when the decision occurred.

Assign an owner for missing records and keep a dated gap log. If an attachment cannot be recovered, describe the gap honestly and preserve the surrounding evidence. A new explanatory memo should carry its actual creation date; it should never impersonate a contemporaneous decision record.

How do you connect each requisition to coverage and listing exceptions?

Keep the contractor’s coverage analysis separate from the opening’s listing decision, then link them. VEVRAA’s general contract threshold is $200,000; the AAP requirement generally adds 50 or more employees. An exception for a particular opening does not establish that the employer is outside VEVRAA.

The final rule effective September 21, 2026 reflects the updated threshold. Have the compliance owner verify coverage, exemptions, and the rule applicable to the records being reviewed. A retained policy should identify its effective period so an old hiring action is not judged against an unexplained new checklist.

For each requisition, document whether listing was required and the basis for any exception. The VEVRAA equal opportunity clause excludes executive and senior management positions, internal-only openings, and positions lasting three days or less from its definition of openings that must be listed. Apply the actual definitions, rather than relying on a title such as “senior.”

An internal-only rationale needs particular care. Once the employer decides to consider external applicants, that exception no longer applies. Preserve the changed recruiting decision and connect it to the resulting listing activity; a requisition’s original label does not explain a later external search.

What proves that the ESDS received the opening?

Retain the submitted vacancy information, submission timestamp, destination employment service delivery system (ESDS), and any acknowledgement or rejection the system returns. These are useful evidence fields, not a prescribed federal receipt form. They help distinguish sending a feed from successfully delivering a usable listing.

The clause requires listing at least concurrently with other recruitment sources or efforts. An intermediary can satisfy the requirement when it delivers the information to the appropriate ESDS in a permitted manner and format that allows priority referral of protected veterans. A commercial job-board appearance alone does not establish those conditions.

Keep the receiving job-order identifier alongside the employer’s requisition identifier. Save the actual listing content and location mapping, plus any correction, rejection, retry, and eventual acceptance. A clean final screenshot can conceal an earlier failed transmission; the sequence matters when someone asks when the opening became available to the ESDS.

Use the mandatory job-listing requirements to review the delivery process, then request evidence at the requisition level from any intermediary. Vendor summary reports are easier to reconcile when they identify the destination and receiving record rather than merely reporting that distribution completed.

Which search criteria and disposition records should stay together?

Preserve the materials that explain how the employer found and assessed candidates: the advertised requirements, sourcing criteria, applications considered, interview material, and recorded selection reasons. Keep the version used when the decision occurred. The practical goal is to reconstruct the decision from preserved evidence.

For a cleared opening, a statement that a candidate lacked a required qualification should connect to the actual requirement and the stage at which it applied. Preserve whether the advertisement required existing eligibility, eventual eligibility, or particular access. A vague disposition such as “clearance” leaves the reader guessing what the hiring team evaluated.

Save search strings, database names, filters, search dates, and the results actually used when those records exist. Treat this as a recommended way to explain sourcing; it is not a claim that every historical Internet Applicant procedure remains a VEVRAA obligation. Have the compliance owner identify the current requirements governing the particular process.

Maintain a disposition-code dictionary with effective dates. Distinguish an applicant’s withdrawal, an unmet stated requirement, a completed interview decision, and a canceled opening when those are the actual reasons. If a code changes during an applicant-tracking-system migration, preserve the mapping so an export does not silently rewrite earlier decisions.

Where should confidential self-identification information live?

Keep protected-veteran self-identification data confidential and outside routine hiring-decision packets. Link records through controlled identifiers so authorized compliance personnel can perform analysis without exposing individual responses to everyone who can open the requisition folder.

The self-identification rule requires confidentiality and provision to OFCCP on request. OFCCP’s VEVRAA FAQs explain that an existing HR or applicant-tracking system can hold the data when it is secured apart from other personnel information and access is limited to personnel with a compliance need to know.

The FAQs also distinguish veteran self-identification data from an employee’s confidential medical file. Avoid building a single unrestricted “audit folder” that collapses those boundaries. Check permissions on exports and shared links as well as the source application; a secure database does little good if its report is broadly accessible.

If the team also handles Section 503 disability hiring obligations, have the appropriate compliance specialist map those separate requirements. Similar-looking forms do not justify treating veteran-status responses, disability information, and medical documents as interchangeable records.

How should outreach activity connect to an effectiveness assessment?

Retain evidence of the activity and the evaluation of its results together. An invoice or event roster shows that an effort occurred; an assessment explains whether it helped recruit qualified protected veterans and what the employer decided to change.

Under the AAP outreach and assessment provisions, covered AAP contractors review outreach annually, document evaluation criteria and conclusions, and consider the required applicant-and-hire data across the specified review period. If the totality of efforts was ineffective, the rule requires alternative efforts. A receipt collection does not supply that analysis.

Group partner contacts, vacancy information supplied, event participation, and referral records under the relevant AAP year. Add the assessment, resulting changes, responsible owner, and evidence that the change occurred. Where referral attribution is incomplete, disclose that limitation rather than presenting an unexplained conversion rate as proof of effectiveness.

Keep internal audit findings and remedial actions connected as well. The FAQs require an internal audit and reporting system and retention of remedial documentation as employment records. A proposed correction and a completed correction should remain distinguishable in the file.

Which retention clock applies to each record?

Assign the clock by record category and coverage, not by the folder containing it. Ordinary records and designated AAP records have different minimums. The comparison below summarizes VEVRAA requirements; the compliance owner should also check other applicable obligations and any preservation hold.

41 CFR 60-300.80(a) and (b) supplies these distinctions. Keep the annual applicant-and-hire computations with their definitions and reconciliation notes. Under 41 CFR 60-300.45(c), preserve the annual benchmark and, if using an individualized benchmark, its factors and their relative significance. The benchmark is not a hiring quota.

Can someone reconstruct a hiring action without its recruiter?

Test retrieval using a closed requisition and a reviewer who did not manage it. Ask the reviewer to trace the approved requirements, listing decision, delivery evidence, applicant decisions, and links to the relevant program assessment. Treat gaps as repair work, without promising that a successful exercise guarantees an audit outcome.

Have the reviewer record broken links, missing versions, unexplained codes, and permissions that prevent authorized access. Check that a canceled requisition can be explained too. A useful test follows the evidence through the actual repositories rather than relying on a specially assembled presentation packet.

Frequently Asked Questions

Is a screenshot enough proof of posting?

A screenshot can preserve content, but it may not establish the destination, delivery timing, or permitted ESDS format. Pair it with the transmission and receiving-system evidence available for that opening.

Does every recruiting record need three years of retention?

No. VEVRAA distinguishes ordinary employment records from designated outreach, data-analysis, and benchmark records. Apply the correct category and check whether the record is also subject to a preservation hold.

Can we use the applicant-tracking system as the audit repository?

It can form part of the repository if the team can retrieve the needed history and protect confidential information. Test exports, version retention, access controls, and identifier mapping before relying on the system alone.

What should we do first if the records are incomplete?

Choose a closed requisition and create a dated gap log that identifies the missing evidence, its likely source, and the person responsible for recovery. Send that log to your internal compliance owner for review before changing the retention schedule.