Historically the default approach, and still the right one for records that are not digital, for structurally complex risks spanning multiple entities or locations, and where the question is what the business actually does rather than what it paid.
The cost is logistical: scheduling, travel, and the rescheduling that follows when the person who holds the records is unavailable.