Most small businesses keep records for one of two bad reasons: either they throw nothing away out of anxiety about needing it someday, or they clean house periodically without any real system, sometimes destroying things they were legally required to keep. A written document retention policy solves both problems by setting clear, defensible rules for how long different categories of records need to stay, and when it's actually safe to get rid of them.
Why a Formal Policy Matters More Than It Seems
Beyond simple organization, a document retention policy protects a business in two directions: it ensures records required by tax authorities, regulators, or potential litigation are actually available when needed, and it limits liability by ensuring old records that could be discoverable in a future lawsuit are properly disposed of on a routine schedule rather than kept indefinitely. Courts and regulators generally respect destruction that follows a consistent, pre-existing policy far more than destruction that happens to occur right before or during a dispute.
Tax and Financial Records: Generally Three to Seven Years
The IRS generally recommends keeping tax returns and supporting documentation for three years from filing, but that window extends to six years if income was significantly underreported, and indefinitely if a return was never filed or was fraudulent. Many businesses adopt a flat seven-year rule for financial records, invoices, receipts, and bank statements simply because it covers nearly every scenario without needing to track exceptions closely.
Employment Records Have Their Own, Often Longer, Rules
Employment-related documents carry varying retention requirements depending on the specific record: I-9 forms must be kept for three years after hire or one year after termination, whichever is later; payroll records generally three years; and records related to workplace injuries or exposure to hazardous materials can require retention for decades under OSHA rules. Personnel files related to any employee who has filed a claim or lawsuit should be retained well beyond standard timelines until the matter is fully resolved.
Corporate and Legal Records: Keep Permanently
Formation documents, bylaws or operating agreements, meeting minutes, stock or ownership records, intellectual property registrations, and any signed contracts still in effect should generally be retained permanently, not on a rotating schedule. These documents establish the legal existence and ownership structure of the business and are rarely safe to discard even decades later.
Build in a Litigation Hold Exception
Any retention policy needs an override provision: when a lawsuit is filed, threatened, or reasonably anticipated, normal destruction schedules must be suspended for any records that could be relevant, a process known as a litigation hold. Destroying records on schedule after litigation was reasonably foreseeable can be treated by courts as evidence spoliation, with serious legal consequences regardless of whether the destruction was routine.
Address Digital Records and Backups Explicitly
A retention policy written only with paper records in mind quickly becomes outdated. Email archives, cloud storage, backup systems, and old software platforms all need explicit retention and destruction rules, and businesses should confirm that backup systems don't quietly preserve records indefinitely even after the primary copy has been properly destroyed under the policy.
Destroy Records Securely, Not Just Delete Them
Simply deleting a file or throwing away a paper document isn't sufficient for records containing sensitive customer, employee, or financial information. Shredding physical documents and using secure deletion methods for digital files (rather than a basic delete that leaves data recoverable) protects against data breaches stemming from improperly discarded records.
A document retention policy is one of those unglamorous administrative documents that rarely gets attention until an audit, lawsuit, or records request arrives — at which point having clear, consistently followed rules makes the difference between a manageable process and a scramble through years of disorganized files.
Comments
Post a Comment