A system that enables hanging lawful interception, LI, resources to be cleaned up, the system comprising: one or more processors; a triggering function set comprising a plurality of triggering functions; a data store comprising a plurality of auditing records corresponding to the plurality of triggering functions in the triggering function set, wherein each auditing record comprises a claimant attribute; and instructions that are executable by the one or more processors to: cause each triggering function among the plurality of triggering functions to send an update request to the data store in response to being notified about a failed triggering function within the triggering function set, wherein each update request comprises a request to change ownership of the auditing record corresponding to the failed triggering function; select a triggering function as a new owner of the auditing record corresponding to the failed triggering function based at least in part on a match between the claimant attribute in the auditing record and a claimant field in the update request sent by the triggering function; and cause the new owner of the auditing record corresponding to the failed triggering function to send at least one request to a triggered point of interception, POI, to remove an LI resource corresponding to the failed triggering function. one or more processors; a triggering function set comprising a plurality of triggering functions; a data store comprising a plurality of auditing records corresponding to the plurality of triggering functions in the triggering function set, wherein each auditing record comprises a claimant attribute; and instructions that are executable by the one or more processors to: cause each triggering function among the plurality of triggering functions to send an update request to the data store in response to being notified about a failed triggering function within the triggering function set, wherein each update request comprises a request to change ownership of the auditing record corresponding to the failed triggering function; select a triggering function as a new owner of the auditing record corresponding to the failed triggering function based at least in part on a match between the claimant attribute in the auditing record and a claimant field in the update request sent by the triggering function; and cause the new owner of the auditing record corresponding to the failed triggering function to send at least one request to a triggered point of interception, POI, to remove an LI resource corresponding to the failed triggering function. cause each triggering function among the plurality of triggering functions to send an update request to the data store in response to being notified about a failed triggering function within the triggering function set, wherein each update request comprises a request to change ownership of the auditing record corresponding to the failed triggering function; select a triggering function as a new owner of the auditing record corresponding to the failed triggering function based at least in part on a match between the claimant attribute in the auditing record and a claimant field in the update request sent by the triggering function; and cause the new owner of the auditing record corresponding to the failed triggering function to send at least one request to a triggered point of interception, POI, to remove an LI resource corresponding to the failed triggering function.