Hi Amanda,
If I understand your statement correctly, you are not using Auto Destroy, but your custom process is still destroying records even though a reviewer has not approved it. Is that correct?
From a technical standpoint, that should not be possible. I do know the OOTB destroy workflow works correctly and it will not destroy without someone clicking the Approve button for each and every record that is ready for disposal. If you are using a destroy workflow, is it possible that reviewer "A" is approving destruction for reviewer "B" unintentionally? Have you reviewed your version of IER and all new fix packs/interim fixes to see if there was a reported bug for your issue?
As Eric mentions, I also have many clients that start with destroy because they are not confident in the process and fear that IER will destroy records that are not ready for destruction yet. Once they have to approve 10,000+ records, they quickly change to auto-destroy.
------------------------------
Mike Baney
------------------------------