Unit4 Compliance Archive for UK FOI, HESA, NAO, Nordic Retention

A Unit4 compliance archive is a Unit4 (Business World / Agresso / ERPx / Coda) data archive built specifically to satisfy long-term regulatory retention requirements with documented evidence chains. For Unit4's typical customer base it covers: UK Freedom of Information Act minimum 7-year retention, UK higher-education HESA returns and re-submission obligations, REF (Research Excellence Framework) cost-attribution evidence, OfS (Office for Students) data templates and resubmission windows, UK NAO (National Audit Office) public-sector audit packs, HMRC payroll retention (6 years), Nordic public-sector retention regimes (Swedish Arkivlagen, Norwegian Arkivlova, Danish Arkivloven), GDPR right-to-erasure with cryptographic evidence, and professional-services-firm contract retention obligations (typically 7+ years per client engagement contract). The compliance archive layer adds documented retention metadata, immutable storage, formal evidence-of-retention reports, and pre-built regulator-ready extract formats on top of the underlying Unit4 cloud archive.

UK FOI Act and associated public-records guidance set a floor of 7-year retention for most financial and operational records held by public bodies, with longer periods for specific categories. The Unit4 compliance archive applies a 7-year-floor retention rule by default to financial transactional data extracted from Business World / Agresso, with the actual retention period typically set higher (10–15 years) to give a safety margin against retrospective FOI requests. Every archived dataset carries retention metadata — earliest-deletable date, source-system extract date, hash signature, retention policy applied, retention review schedule. Pre-built FOI response extract formats let public-body customers respond to FOI requests in minutes — typically with a one-click extract against archived gltrans, apvoucher, and supplier-payment data filtered to the requested scope, with NI / personal-data masking applied where appropriate.

Higher Education customers in the UK have a particularly intricate retention profile — HESA Finance Statistics Return, HESA Student Record, HESA Staff Record, REF (Research Excellence Framework) cost capture, OfS (Office for Students) data templates, KEF (Knowledge Exchange Framework) returns. Many of these require not just data retention but the ability to *reproduce* a return retrospectively, sometimes years after submission, in response to UKRI, HESA, or OfS audit queries. The Unit4 compliance archive ships with pre-built extract formats for the most commonly requested HE returns — HESA Finance Statistics Return shape pulled from gltrans + Flexi-Field-tagged cost centres, REF cost attribution from project actuals against research projects, OfS access-and-participation cost reporting from departmental rollups. Each format includes the metadata HESA / OfS / UKRI auditors actually ask for: data-as-of date, submission date, applied accounting policies, and reconciliation back to the original Business World ledger.

The UK NAO and its public-sector equivalents (Audit Scotland, Wales Audit Office, Northern Ireland Audit Office) audit central government, local authorities, NHS bodies, devolved administrations, and significant arm's-length bodies. Their audit cycle typically requires 7+ years of detailed transactional evidence: full general-ledger transaction history, AP voucher detail with supplier evidence, payroll evidence per pay period, asset register movements, project / programme cost capture, grant disbursement evidence. The Unit4 compliance archive provides NAO-ready extracts — saved queries that produce the exact data shapes NAO field teams request, with read-log evidence proving who accessed what and when, and with hash chains demonstrating data has not been altered post-extract. For local authorities and NHS bodies running Business World, this means responding to NAO requests in hours rather than the weeks it took to regenerate AIB reports from a live Agresso instance.

Yes. Nordic public-sector customers (Swedish kommuner running Business World, Norwegian fylker, Danish regioner, Finnish maakunnat) operate under national archive law — Arkivlagen (Sweden), Arkivlova (Norway), Arkivloven (Denmark), Arkistolaki (Finland) — with retention periods often longer than UK equivalents and specific obligations around digital-archive accessibility, authenticity verification, and format-stability over multi-decade horizons. The Unit4 compliance archive uses open Parquet format (vendor-neutral, ISO-standardised columnar storage) for storage stability, applies SHA-256 hash chains and immutable object versioning for authenticity, supports in-country data residency (Azure Sweden Central, OCI Stockholm, AWS Stockholm), and produces extract formats aligned with national archive-deposit specifications. Where customers need to deposit data with the national archive at end-of-retention, the compliance archive produces deposit-ready bundles automatically.

Professional-services firms running Unit4 (consulting firms, law firms, architecture practices, engineering services firms — Unit4's services-firm sweet spot) typically have contractual retention obligations baked into client engagement contracts: 7-year retention of timesheet and expense detail per engagement, 10-year retention of project deliverables and supporting financial evidence, sometimes indefinite retention of certain regulated-industry engagements (financial services, defence, healthcare clients). The Unit4 compliance archive supports per-client / per-engagement retention rules — timesheet and expenseclaim data tagged with the engagement Flexi-Field carries the client-specific retention policy, with automatic legal-hold marking for engagements in active dispute. Client audit requests are served from the archive with the same evidence chains used for regulator responses.

This is one of the genuinely hard problems of long-term data retention — and the Unit4 compliance archive handles it explicitly. The archive supports record-level redaction with cryptographic evidence: when a GDPR erasure request is received for a data subject, the records identifiable to that subject are redacted in place (the underlying Parquet objects rewritten with the subject's personal fields nulled), a tamper-evident audit log entry records the redaction with the original record hash, and a cryptographic proof is produced that satisfies the controller-evidence requirement. Where regulatory retention (e.g. HMRC payroll, UK Public Records Act) overrides GDPR erasure for specific fields, the rule engine handles the conflict per documented policy — typically by retaining the financial transaction with personal identifiers masked rather than fully erased. The full erasure-vs-retention policy is configurable and documented per data domain.

Every operation on the compliance archive produces evidence. Extract: source-system metadata (Unit4 instance, schema version, extract date, extract-user identity, SQL query executed, rows returned, hash signature per record). Load: Parquet object created, storage location, encryption-key reference, retention-policy applied, retention-review schedule, manifest signature. Query: user identity, timestamp, query text, rows returned, fields accessed, masking-policy applied, unmask events if any. Lifecycle: tier transitions (hot → cool → archive), retention-review approvals, end-of-retention deletion events with retention-policy compliance confirmation. All evidence is stored immutably (object-versioning with legal-hold), exported continuously to customer SIEM, and surfaced through a formal Evidence Pack report for regulator submissions. The Evidence Pack is the artefact UK FOI, HESA, NAO, HMRC, Nordic archive authorities, and client auditors ask for — and it is produced on demand, not bespoke per request.