SYNTHETIC TEST DOCUMENT — FICTIONAL COMPANY — NO CUSTOMER DATA

Bluebird Mortgage Brokerage LLC
Consumer Information Disposal Procedure — GAP SCENARIO
Document ID: BMB-REC-002 | Version 0.1 | Drafted: 2026-09-15
Owner: Office Manager | Approval status: Draft only

1. Scope
Bluebird is a fictional mortgage broker that receives borrower applications and consumer report information for a business purpose. This procedure concerns paper credit reports, derived notes, exported spreadsheets, scanned copies, retired laptops, backup media, and files held by a records vendor. It is intended to be referenced by the company's written information security program, but that cross-reference has not been added.

2. Current paper-file practice
Staff place old borrower folders in a locked cabinet. Every quarter, the Office Manager sends folders to a destruction vendor. The company has not documented how the vendor is selected or monitored, and it does not require a certificate of destruction. Some photocopies of consumer report information are placed in ordinary office recycling when a file cabinet is full. That practice is an intentional test gap; ordinary recycling does not render the information unreadable.

3. Current electronic-file practice
Employees delete local spreadsheet copies after a loan closes, but the procedure gives no deadline and does not distinguish deletion from secure erasure. Retired laptops are kept in an unlocked storage room until pickup. No one verifies that drives are sanitized or destroyed. Backup copies are not listed in the retention inventory.

4. Retention and exceptions
The Office Manager currently says to keep every electronic copy indefinitely in case it is needed later. There is no record-type retention schedule, legal-hold process, exception owner, or review date. This is an intentional test gap; the draft offers no controlled decision for when information is no longer needed.

5. Missing evidence and next actions
Bluebird has no disposal log, vendor contract review, destruction receipts, or periodic check of the procedure. The proposed next action is to assign a Records Manager, inventory consumer information in all formats, establish a retention schedule, use secure paper and electronic destruction methods, review any vendor, and retain evidence that each disposal event occurred.

TEST INTENT: A weak and partly contradictory disposal SOP. It mentions covered information and a vendor, but documents unsafe recycling, indefinite retention, missing device sanitization, and absent oversight. A keyword-only screen may miss the negative meaning of these statements.