Business record retention requirements come from a patchwork of federal statutes, and the minimum period depends entirely on the type of document. Tax records generally need to stick around for three years, employment tax records for four, payroll records for three, benefit plan records for six, and toxic exposure records for the length of employment plus 30 years. Corporate formation documents and board minutes should be kept permanently. Miss any of these floors and the fallout ranges from disallowed deductions and 20 percent accuracy penalties to OSHA citations and courtroom sanctions that can decide a case before it reaches trial.
How Long to Keep Tax and Financial Records
Every business must keep books and records detailed enough to support the income, deductions, and credits on its returns.1eCFR. 26 CFR 1.6001-1 – Records Retention tracks the IRS assessment window: three years from the filing date or the return’s due date, whichever is later. If a business omits more than 25 percent of its gross income, the window stretches to six years.2Office of the Law Revision Counsel. 26 USC 6501 – Limitations on Assessment and Collection
For most accurately filed returns, three years is the floor. Where a substantial omission is possible, six years is safer. Receipts, bank statements, invoices, and general ledger entries all belong in this bucket.
A few records need longer. Claims for a loss from worthless securities or a bad debt deduction require seven years of records. Property records — anything supporting depreciation, cost basis, or capital improvements — should be kept for as long as you own the asset and three years after you dispose of it, since the IRS needs the original basis when you report the gain or loss.3Internal Revenue Service. How Long Should I Keep Records
When deductions get disallowed for lack of documentation, an accuracy-related penalty can add 20 percent on top of the underpaid tax.4Office of the Law Revision Counsel. 26 USC 6662 – Imposition of Accuracy-Related Penalty on Underpayments That penalty covers negligence, substantial understatements, and valuation misstatements.
Employment and Personnel Records
Employment records sit under wage law, tax law, anti-discrimination law, and benefits law all at once. Each regime sets its own floor, and where several apply to the same document, the longest one controls.
Payroll Records
The Fair Labor Standards Act requires payroll records — employee names, hours worked each week, total wages paid — to be kept for at least three years from the date of last entry. Supporting documents like wage rate tables and time cards have a shorter two-year requirement.5eCFR. 29 CFR Part 516 – Records to Be Kept by Employers Most businesses keep everything together for the longer three years.
Employment Tax Records
The IRS requires all employment tax records — withheld income tax, Social Security and Medicare contributions, FUTA filings — for at least four years after the return’s due date or the date the tax was paid, whichever is later.6Internal Revenue Service. Employment Tax Recordkeeping Because this period runs longer than the FLSA’s three years, four years is the controlling number for anything touching payroll withholding.
Hiring, Discipline, and Termination Files
EEOC regulations require personnel records — applications, promotion decisions, disciplinary actions, and termination paperwork — for one year from the date the record was created or the personnel action occurred, whichever is later.7eCFR. 29 CFR Part 1602 – Recordkeeping and Reporting Requirements Under Title VII, the ADA, GINA, and the PWFA The clock resets on termination because the departure itself is a personnel action. Once a discrimination charge is filed with the EEOC, the floor changes entirely: all records relevant to that charge must be preserved until final disposition.8GovInfo. 29 CFR 1602.14
Form I-9
A completed Form I-9 must be kept for three years after the date of hire or one year after employment ends, whichever is later.9U.S. Citizenship and Immigration Services. Handbook for Employers M-274 – 10.0 Retaining Form I-9 For a short-term hire, that means the I-9 stays on file for the full three years from hire even after the employee leaves.
FMLA Records
Employers covered by the Family and Medical Leave Act must keep leave records for at least three years. Those records must identify which absences were designated as FMLA leave, track hours when leave is taken in partial-day increments, and include copies of written notices exchanged with the employee. Medical certifications go in confidential files separate from standard personnel folders.10eCFR. 29 CFR 825.500 – Record-Keeping Requirements
Employee Benefit Plans
ERISA sets the longest employment-side floor. Employers sponsoring a benefit plan must keep records sufficient to verify, explain, and audit required filings for at least six years after the filing date.11Office of the Law Revision Counsel. 29 USC 1027 – Retention of Records That covers Form 5500 filings, plan documents, summary plan descriptions, amendments, trust agreements, nondiscrimination test results, and supporting financial records. Because disputes can surface years after an employee retires, many practitioners keep plan documents indefinitely.
Health, Safety, and Environmental Records
OSHA Injury and Illness Logs
Employers with more than ten employees during the previous calendar year must maintain OSHA 300 logs, incident reports, and annual summaries for five years after the end of the calendar year the records cover.12eCFR. 29 CFR 1904.33 – Retention and Updating of Old Forms Employers with ten or fewer employees are partially exempt, though they must still report fatalities, hospitalizations, amputations, and eye losses.13Occupational Safety and Health Administration. 29 CFR 1904.1 – Partial Exemption for Employers With 10 or Fewer Employees Certain low-hazard industries also qualify regardless of size.
Toxic Exposure and Medical Records
Records involving employee exposure to toxic substances or harmful physical agents carry one of the longest retention requirements in all of federal regulation. Medical records for each exposed employee must be kept for the duration of employment plus 30 years. Exposure monitoring records must be kept for at least 30 years on their own.14eCFR. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records Occupational diseases like mesothelioma can take decades to appear, and employers who dispose of these files early lose the ability to defend against exposure claims.
Hazardous Waste Manifests
Businesses generating hazardous waste must keep a copy of each waste manifest for at least three years from the date the initial transporter accepted the waste. That period automatically extends during any unresolved enforcement action, and small quantity generators are subject to the same rule.15eCFR. 40 CFR Part 262 Subpart D – Recordkeeping and Reporting
Contracts and Commercial Agreements
No single federal statute sets a retention period for contracts. The controlling factor is the statute of limitations for a breach claim. Under the Uniform Commercial Code, adopted in nearly every state, a suit for breach of a contract for the sale of goods must be filed within four years of the breach.16Legal Information Institute (Cornell Law School). UCC 2-725 – Statute of Limitations in Contracts for Sale Parties can shorten that window to as little as one year by agreement but cannot extend it.
For service agreements, leases, and other non-goods contracts, limitations periods vary by state and commonly range from three to six years. Keep every executed contract for its full term plus the longest applicable limitations period in your state. Contracts involving real property, intellectual property licenses, or long-tail indemnification obligations are usually kept indefinitely.
Permanent Corporate Records
Some documents survive as long as the business itself. Articles of incorporation, operating agreements, bylaws, partnership agreements, and stock transfer ledgers define the entity’s legal existence and internal governance. Owners who lose them may struggle to prove ownership interests, and courts may question whether corporate formalities were observed — one of the factors weighed when deciding whether to pierce the corporate veil and hold owners personally liable.
Board meeting minutes and formal resolutions belong in the same permanent category. They show that major decisions like authorizing loans, issuing shares, or approving mergers followed proper internal procedures. In an acquisition or due diligence review, gaps in these records can reduce valuation or stall the deal.
Intellectual property records work the same way. Patent filings, trademark registrations, copyright certificates, and their maintenance and renewal paperwork should be kept for the life of the protection plus several years. Patent protection generally lasts 20 years from filing. Trademarks can be renewed indefinitely but require periodic filings to stay active.
Federal Contractor Records
Businesses performing federal contracts work under a separate set of rules in the Federal Acquisition Regulation. The baseline: all records supporting a contract — accounting procedures, cost documentation, source materials — must be kept for three years after final payment.17eCFR. 48 CFR 4.703 – Policy
Specific record types have their own timelines, measured from the end of the contractor’s fiscal year in which a cost was charged to the government contract. Financial and cost accounting records (invoices, accounts payable, purchase orders, canceled checks), payroll registers and tax withholding statements, and equipment, receiving, and production quality records must be kept for four years. Time cards, attendance records, petty cash records, and labor cost distribution documents must be kept for two years. These periods apply unless the contract itself specifies something longer.18eCFR. 48 CFR 4.705 – Contractor Records Retention Contractors who convert original records to electronic images must keep the originals for at least one year after imaging so the government can validate the imaging system.
Legal Holds Override Every Schedule
Once a business reasonably anticipates litigation, it must suspend normal document destruction and preserve all records that could be relevant. This obligation kicks in before any lawsuit is filed. A demand letter from opposing counsel is an obvious trigger. Subtler ones count too: an internal harassment complaint, a government investigation, or a pattern of customer disputes that makes litigation foreseeable.
The consequences for ignoring a hold are among the harshest in civil litigation. Under Federal Rule of Civil Procedure 37(e), when electronically stored information that should have been preserved is lost because a party failed to take reasonable steps, and the data can’t be recovered, the court can order measures to cure the resulting prejudice.19Legal Information Institute (Cornell Law School). Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery When the court finds a party intentionally destroyed evidence to deprive the other side of it, sanctions escalate: the court may instruct the jury to presume the lost information was unfavorable, or it may dismiss the case or enter a default judgment outright.
Severe sanctions like adverse inference instructions and default judgments require a finding of intent, not carelessness. But even negligent destruction can lead to court-ordered remedies, additional discovery costs, and lasting credibility damage with the judge. A written retention policy with clear litigation hold procedures is one of the strongest defenses against spoliation claims.
Storing Records Electronically
Digital storage is acceptable for tax and regulatory purposes, but the system has to meet standards. The IRS requires that any electronic storage system accurately transfer, index, preserve, and reproduce records. It must include controls preventing unauthorized changes, deletions, or deterioration, and the business must run regular quality assurance checks.20Internal Revenue Service. Revenue Procedure 97-22
Two requirements trip businesses up. First, the system must support a complete audit trail linking general ledger entries to their source documents; a folder of scanned receipts with no indexing doesn’t qualify. Second, the IRS must have unrestricted access to the system during an examination, including hardware, software, and personnel. Cloud storage contracts that limit government access can put the whole digital archive at risk.
Reproduced records must be legible enough that every letter and number is identifiable. Faded, cropped, or low-resolution scans may not hold up. Keep documentation of how the system works, including its indexing structure and operating procedures, and be prepared to produce that documentation on request.
Building a Retention Schedule
A retention schedule turns all these overlapping requirements into a single operational document. Catalog every type of record your business creates or receives. For each, identify the responsible department, the governing regulation, the retention trigger (date of creation, end of fiscal year, termination of employment, contract expiration, property disposal), and the calculated destruction date.
Where multiple regulations apply to the same document, the longest period controls. Payroll records satisfy both the FLSA’s three-year requirement and the IRS’s four-year employment tax requirement, so the schedule should reflect four years. Build in a buffer of a few months past the statutory minimum. Destroying records on the exact expiration date leaves no margin if a trigger date was miscalculated. Review the schedule annually — regulations shift, the business enters new industries or takes on government contracts, and new record types appear.
Disposing of Records Securely
When a record reaches its destruction date and no litigation hold is in effect, dispose of it properly. Careless disposal of documents containing Social Security numbers, customer financial data, or trade secrets creates liability that outlasts the record itself.
For paper, cross-cut shredding is the standard; strip-cut shredders leave pieces large enough to reassemble. For digital media, the National Institute of Standards and Technology defines three sanitization levels. Clearing overwrites data using standard read-write commands and protects against casual recovery. Purging uses more advanced techniques that make recovery infeasible even with laboratory equipment. Physical destruction — shredding, incinerating, or pulverizing drives — eliminates both the data and the media.21National Institute of Standards and Technology (NIST). NIST Special Publication 800-88r2 – Guidelines for Media Sanitization
Whichever method you use, document it. A certificate of sanitization recording the media type, serial number, method, and verification results proves the destruction was routine. If a dispute later arises about whether a record was destroyed in the normal course of business or selectively purged, that documentation is your evidence.