I assume they must have the CVR data somewhere. Is there a requirement to store this data. If so for how long?
The data is not from the CVR but from the QAR (Quick Access Recorder) database. The QAR is similar to the FDR but may record many more parameters and often at a higher sample rate. However the QAR is not designed to survive a crash.
These days many airlines & flight departments will periodically download and analyze QAR data in accordance with their Flight Operations Quality Assurance (FOQA) program. The data is kept in an archival database and is used to provide safety oversight.
FOQA is part of a larger Safety Management System (SMS). It's a pity that this particular operation apparently had an audited SMS in place, but clearly no one really paid attention to basic practices like making sure checklists are being followed.
FOQA and SMS are voluntary in the US although they will soon become mandatory for Part 121 and is already in wide use among airlines and many biz jet ops.