Enforcement case’s lesson: Check your vendor’s recordkeeping policies