If you receive a subpoena from some regulator or police agency asking for documents, it is imperative you process documents properly. Goofing up could cause serious problems, even if you aren’t the actual target of the investigation. If you are the target and you mess up, things could get really bad, really fast.
The law firm of Gammon & Grange provides some ideas on how to work through the serious issues without getting your organization in trouble: When the Knock at Your Nonprofit Door is Not Some Pizza, but Subpoena.
There are many places in the audit rules where the guidance says something like consider consulting with legal counsel before taking the next step.
If you ever receive a subpoena, that would be an incredibly wonderful time to consult with legal counsel. Get your attorney on the phone. Immediately.