A regulated financial firm must retain transaction records for seven years per SEC Rule 17a-4.Which governance process ensures this requirement is operationalized?