Most small business owners keep records out of habit rather than strategy — boxes of old invoices in a closet, years of bank statements in an email folder, tax returns going back further than anyone can remember why. The problem is that "keep everything forever" and "keep as little as possible" are both wrong, and both can hurt you. Some records are legally required to be kept for specific periods. Others should be destroyed once their retention period passes, because holding onto them longer actually increases your legal exposure. Knowing the difference is a basic piece of business hygiene that most owners never get around to formalizing.
Why retention periods exist
Retention rules come from several different directions at once, which is part of why they're confusing. Tax authorities need you to substantiate what you reported. Employment law requires certain payroll and personnel records in case of a wage dispute or discrimination claim. Corporate law requires you to maintain formation documents and ownership records for as long as the entity exists. Contract law effectively requires you to keep agreements until the statute of limitations for a breach claim has passed. None of these bodies coordinated with each other, so the retention period for a given document depends on which rule is longest, not which one is most obvious.
Tax records: the baseline rule
The IRS generally has three years from the filing date to audit a return, which is why "keep tax records for three years" is the number most owners have heard. But that period extends to six years if you underreported income by more than 25%, and there's no time limit at all if the IRS suspects fraud or if you never filed a return. Because you can't know in advance whether a return will be questioned, the safer practical standard most accountants recommend is seven years for tax returns and supporting documentation — receipts, mileage logs, expense records, and anything else that backs up what you claimed. Records related to the purchase of property, including real estate and major equipment, should be kept for as long as you own the asset plus the applicable audit period after you dispose of it, since depreciation and basis calculations depend on the original purchase records.
Payroll and employment records
Employment records carry some of the strictest and most specific retention requirements, because they can become evidence in a wage claim, discrimination charge, or workers' compensation dispute years after the fact. The Fair Labor Standards Act requires payroll records, time cards, and wage computations to be kept for at least three years, with records used to calculate wages (like time cards) kept for two years. The Equal Employment Opportunity Commission requires personnel and employment records to be retained for one year from the date a record was made or a personnel action was taken, and longer if a charge has been filed. I-9 forms have their own rule: keep them for three years after the date of hire or one year after termination, whichever is later. Many employers simplify this into a single practice — keep the full personnel file for the duration of employment plus at least four to seven years after separation — because it's easier to apply one conservative rule than to track five different minimums for different document types within the same file.
Corporate and governance records
Formation documents — articles of incorporation or organization, bylaws or operating agreements, EIN confirmation letters, initial ownership records — should be kept permanently for as long as the business exists, and ideally beyond that in case a former owner or creditor raises a claim years later. Meeting minutes, resolutions, and ownership transfer records fall into the same permanent category. These documents are what prove the business was operated as a legitimate separate entity, which matters enormously if the business is ever sued and a plaintiff tries to argue that the owners should be personally liable because the entity wasn't respected as a real, separate legal structure.
Contracts and legal agreements
Contracts should generally be kept for as long as the statute of limitations for a breach of contract claim in your state, measured from the date the contract ends or is fully performed. Most states set this between three and ten years for written contracts, with some allowing longer periods for contracts under seal. Because you don't always know which state's law will apply, and because a contract dispute can surface long after a relationship has ended, many businesses default to keeping executed contracts for at least seven to ten years after termination. Leases, loan agreements, and any contract involving real property tend to warrant permanent retention, since property-related disputes can arise decades later.
Records tied to insurance claims and safety incidents
Any documentation connected to a workplace injury, safety incident, product liability concern, or insurance claim deserves its own extended retention, independent of the general categories above. Personal injury statutes of limitations typically run two to six years depending on the state, but product liability claims can be filed years after a product was sold if the injury only became apparent later. Incident reports, safety inspection records, OSHA logs, and correspondence with your insurance carrier about any claim should be kept for at least ten years, and permanently if the incident involved a serious injury, since these records are often the only evidence available if a claim resurfaces long after the event.
What to actually destroy, and why it matters
Retention isn't only about keeping things long enough — it's also about not keeping them forever. Old customer records containing Social Security numbers, payment card data, or other sensitive personal information create ongoing liability every day they sit in a filing cabinet or an unsecured drive past the point where you actually need them. If your business experiences a data breach, you'll be required to notify anyone whose data was exposed, including people whose records you had no legitimate reason to still be holding. Many state data privacy laws now treat unnecessary retention of personal information as its own compliance failure, separate from the breach itself. A written destruction schedule — and following it consistently, using cross-cut shredding or secure digital deletion rather than just dragging files to a folder called "old" — is what turns retention policy from a legal document into an actual risk reduction practice.
Building a simple retention schedule
Most small businesses don't need an elaborate records management system. A one-page retention schedule listing document categories and how long each is kept, reviewed once a year, covers the vast majority of situations. Store the schedule itself permanently, note who is responsible for enforcing it, and build destruction into a recurring calendar task rather than leaving it to whenever someone notices the filing cabinet is full. If your business is ever notified of pending litigation, a regulatory investigation, or an audit, the retention schedule must be paused immediately for anything relevant — destroying documents after you have reason to expect they'll be needed can be treated as spoliation of evidence, which carries its own serious legal consequences regardless of what your normal retention policy says.
Comments
Post a Comment