In my opinion, for something like file maintenance review, as long as you have enough documentation to prove that you have a process in place, that's good enough for me. I am never going to test that a particular change was reviewed from two years ago.
Now, there may be an occassion where I want to know who made a change two years ago, and that's why I said that if the reports themselves weren't available other than in paper form, they should be retained longer.