Key takeaways
- Write the policy by record category, not as one blanket retention period.
- Keep tax records at least as long as the IRS and state rules require, and longer when a contract or a lender requires it.
- Say where each category lives and who can delete it.
- Review the policy every year and when a client leaves.
Why the policy matters
A retention policy protects the firm in three ways: it keeps the records a return or a contract needs, it sets a defensible date for destruction, and it gives the team one place to look when a client asks for a copy.
A policy that exists only in the owner's head is not a policy. The team should be able to find the retention period for a category without asking.
Start with the legal minimums
The IRS generally requires records supporting a return to be kept for at least three years, and longer in some situations. Employment tax records should be kept at least four years after the tax is due or paid.
State rules, professional standards and contracts can require longer periods. The policy should say that the longer of the applicable rules applies.
Write it by category
Group the records: tax returns and workpapers, bookkeeping records, payroll records, client source documents, engagement letters and contracts, correspondence, and firm administrative records.
For each category, say the retention period, where it lives and who may destroy it. A table is easier to use than a paragraph.
Store the records securely
Client records should live in the firm's secure document system, not on a personal drive or in an email inbox. Access should be limited to the people who need it.
Back up the records and test the restore. A retention policy without a backup is a policy that ends at the first hardware failure.
Set the destruction process
Destruction should be scheduled, approved and recorded. The record can be a simple log: the category, the date range, the date destroyed and the person who approved it.
Do not destroy records that are under a legal hold, an open audit, a loan application or a client dispute. The policy should say who can place a hold and how it is released.
Handle a client who leaves
When a client leaves, return the client's records, keep the firm's workpapers for the retention period and document the handoff. The policy should say what is returned, what is kept and when the firm's copy is destroyed.
Keep the handoff record longer than the underlying documents. It shows what was sent and when, which is the question that usually comes later.
Review the policy
Review the policy every year and when a law, a contract or a client relationship changes. Update the table and tell the team what changed.
A policy that is reviewed is a policy the team trusts. A policy that has not been opened since it was written is a document nobody follows.