NAID AAA certification: the records your shred company should keep

NAID AAA Certification is the best-known certification in the document destruction industry. It's run by i-SIGMA, the industry's trade association, and it checks a company's security procedures through scheduled and unannounced audits. Some clients, especially in healthcare, finance and government, ask for it before they'll sign.

Why records matter so much

Most of what an auditor or a nervous client wants to know comes down to: can you show what happened? Who was on the truck, when the material was picked up, when and where it was destroyed, and who signed for it. Good records turn those questions into a two-minute lookup instead of a week of digging.

Records worth keeping for every job

• The service record: site, date, arrive and depart times, containers and quantities, and the driver and helper
• The client's signature, or the reason one wasn't collected
• For off-site work, the pickup receipt and the destruction batch: when it was destroyed, where and by whom
• The certificate of destruction, with a unique number, and any corrected versions
• Missed or skipped stops with a reason, so a gap in service is explained
• Photos where they help: a locked console, a full bin, a blocked loading dock

Records about your company

• Employee screening and signed confidentiality agreements
• Training records
• Who has access to your systems, and what each person can see
• A history of changes to important records, so you can show nothing was quietly altered

Habits that make audits easier

1. 1Keep records in one system, not split between paper, email and spreadsheets.
2. 2Never edit issued certificates; correct them with a new version.
3. 3Give drivers only the access they need, such as gate codes for that day's stops.
4. 4Practice pulling a full history for one client and one month. If it takes more than a few minutes, fix that before an auditor asks.

How Trakro supports this

Trakro isn't a certifying body and doesn't certify your company. It keeps the records audits ask about: locked service records and certificates, correction versions, the off-site chain of custody, role-based access and an audit log no one can edit.