In the absence of regulatory guidance or firm policies, what is the minimum recommended duration for maintaining records according to CFA Institute?