Business Record Retention: What to Keep, How Long, and Where

# Business Record Retention: What to Keep, How Long, and Where

I got audited in year two of my first business. Nothing dramatic — the IRS wanted documentation on a handful of deductions from a return filed 18 months earlier. The problem wasn't that the deductions were wrong. The problem was I couldn't find three receipts and a contractor agreement. I spent two full days tearing through a filing cabinet and a Google Drive with zero organization. I found everything eventually, but those two days cost me real money in lost productivity and accountant fees.

That experience taught me something most business owners learn the hard way: keeping records isn't about being organized for the sake of it. It's about protecting yourself when someone — the IRS, a state agency, a former business partner, a vendor — asks you to prove something happened.

This guide covers exactly what to keep, how long to keep it, and where to store it so you're never scrambling. And if you're just starting a business, building this system on day one is one of the smartest things you can do.

The IRS Retention Rules (The Actual Numbers)

Let's start with the federal requirements, because these are the ones that will bite you if you get them wrong.

The IRS doesn't have one simple rule. They have a sliding scale based on what could go wrong:

3-Year General Rule

The standard statute of limitations for an IRS audit is three years from the date you file your return (or the due date, whichever is later). For most small businesses filing on time, this means the IRS has until roughly April 2029 to audit your 2025 return.

This covers the majority of situations. If you filed an honest, accurate return and there's no reason for the IRS to dig deeper, three years is the window.

6-Year Rule (Underreported Income)

Here's where it gets longer. If the IRS determines you underreported your gross income by more than 25%, the statute of limitations extends to six years. You might think, "I'd never underreport by 25%." But consider: if you forgot to include a 1099 from a side project, or miscategorized revenue, or a contractor you paid didn't file their taxes and the IRS comes looking — suddenly you're in six-year territory.

This is why I tell every business owner: keep everything for at least seven years. The six-year rule plus a one-year buffer gives you coverage for virtually every scenario.

7-Year Rule (Worthless Securities & Bad Debts)

If you claimed a deduction for worthless securities or bad debt, the IRS gets seven years to audit that claim. This applies to any business that's written off uncollectible invoices (which is... most businesses at some point) or has investment losses.

Forever (Fraud or Failure to File)

There is no statute of limitations if the IRS suspects fraud or if you simply didn't file a return. None. They can come after you 20 years later. This is why you always file, even if you can't pay. Filing a return you can't fully pay is infinitely better than not filing at all.

The Practical Takeaway

State Requirements Add Another Layer

Federal rules are just the floor. Every state has its own retention requirements, and some are longer than the IRS:

• California: Franchise Tax Board can audit up to 4 years from filing (but 6 years if underreported by 25%+)
• New York: Generally follows federal timelines but requires certain employment records for 6 years
• Texas: No income tax, but sales tax records must be kept for 4 years
• Illinois: 3.5 years for income tax, but 4 years for sales tax

The safest approach: keep records for at least 7 years regardless of your state. This covers every federal and state scenario except fraud (which is forever, but if you're committing fraud, record retention is the least of your problems).

If you need help staying on top of all these compliance requirements, we built a checklist for that.

What to Keep: The Complete List

Here's the document-by-document breakdown. I'm organizing this by retention period so you can build your system around it.

Keep Forever

These documents have no expiration. They define your business's existence and history.

• Tax returns (all years) — Yes, the IRS statute is 3-7 years, but your tax returns are the foundation of your financial history. Keep them forever.
• Corporate records — Articles of incorporation, bylaws, operating agreements, amendments, board minutes, annual meeting minutes, stock certificates, ownership changes
• Business licenses and permits — Current and historical
• Audit reports — Both internal and external
• Annual financial statements — Balance sheets, P&Ls, cash flow statements
• Property records — Deeds, titles, depreciation schedules, improvement records (keep for the life of the asset plus 7 years)
• Insurance policies — Even expired ones; claims can surface years later
• Legal correspondence — Anything involving attorneys, lawsuits, settlements
• Trademark and IP registrations

Keep for 7 Years

This is your default bucket. When in doubt, 7 years.

• Bank statements and reconciliations — Every month, every account. This is your financial backbone. If you're using Holdings, all of this is automatically organized and searchable in your dashboard.
• Receipts and expense documentation — Every business expense needs a receipt. Every single one. The IRS requires "adequate records," which means: amount, date, place, business purpose.
• Invoices (sent and received) — Both accounts receivable and accounts payable
• Contracts and agreements — Keep for 7 years after the contract expires or terminates, not 7 years from signing
• Payroll records — Timesheets, pay stubs, W-4s, benefit records, Workers' comp claims
• Employee records — Keep for 7 years after termination (some states require longer)
• 1099s and W-2s — Both copies you issued and copies you received
• Loan documents — Keep for 7 years after the loan is fully paid off
• Vendor and supplier records
• Canceled checks — If you still use them
• Credit card statements and records
• Travel and entertainment logs
• Vehicle mileage logs — Date, destination, business purpose, miles driven

Keep for 3-4 Years

Shorter retention, but still important:

• Monthly/quarterly financial reports (internal, non-audited)
• Bank deposit slips
• Purchase orders (after fulfillment)
• Physical inventory records (after reporting year)

Digital vs. Physical: The Modern Answer

Here's the good news: the IRS accepts digital copies. You don't need a warehouse of filing cabinets. Revenue Procedure 98-25 (updated multiple times since) explicitly allows electronic storage of records as long as the digital copies are:

1. Legible and readable — Can be clearly viewed and printed
2. Accessible — You can produce them on request
3. Protected — Backed up and secured against loss

My System (What We Actually Do at Holdings)

Go digital-first. Here's the practical setup:

1. Scan everything immediately. Receipt comes in? Phone photo, uploaded to cloud storage, tagged with date and category. Don't let paper pile up.
2. Use consistent naming. I use: `YYYY-MM-DD_vendor_category_amount` (example: `2026-04-08_office-depot_supplies_$247.50`)
3. Organize by year, then category. Top-level folders by tax year, subfolders for: income, expenses, payroll, contracts, tax filings, bank statements, legal
4. Tag everything. If your storage system supports tags, use them. A receipt can be tagged both "office supplies" and "Q2 2026."

Cloud Backup Is Non-Negotiable

Your digital records need to be backed up. Not "I'll get to it." Today.

Minimum viable backup strategy:

• Primary storage: Cloud platform (Google Drive, Dropbox Business, OneDrive)
• Secondary backup: Different cloud provider or local encrypted drive
• Test your backups quarterly. Can you actually restore a file from two years ago? Try it.

If you're doing your own bookkeeping, your accounting software (QuickBooks, Xero, Wave) stores a lot of this digitally. But don't rely solely on your accounting software — export backups regularly. If you cancel your subscription or the company changes their retention policy, you need your data.

What About Physical Originals?

Some documents should be kept in physical form even if you have digital copies:

• Signed contracts with wet signatures — Some jurisdictions still prefer originals
• Government-issued documents — Business licenses, permits, articles of incorporation
• Property deeds and titles
• Stock certificates (if paper-issued)

For these, use a fireproof safe or a bank safe deposit box. Everything else? Digital is fine.

Document Destruction: Do It Right

Keeping records is important. Destroying them properly is equally important.

When to Destroy

Set an annual purge date. I do mine every January. Pull up your retention schedule, identify everything that's past its required retention period, and destroy it.

Never destroy records:

• That are subject to a current or pending audit
• That are involved in any open legal proceeding (this is called a "litigation hold")
• That relate to ongoing tax disputes
• Before their retention period expires

How to Destroy

Paper documents: Cross-cut shredding. Not strip-cut (those can be reassembled). If you have a lot, hire a certified shredding service — they give you a certificate of destruction.

Digital documents: Permanent deletion isn't just dragging to the trash. Files in your trash or recycle bin are recoverable. Use secure deletion software or destroy the physical drive. For cloud storage, verify the provider's deletion is permanent and not just soft-delete with a 30-day recovery window.

Create a destruction log. Document what you destroyed, when, and how. This protects you if someone later asks why a document doesn't exist — you can show it was destroyed per your retention policy, not hidden or lost.

Building Your Retention System

Here's how to set this up in an afternoon:

Step 1: Create Your Folder Structure

```

Business Records/

├── 2026/

│ ├── Income/

│ ├── Expenses/

│ │ ├── Receipts/

│ │ └── Invoices/

│ ├── Payroll/

│ ├── Bank-Statements/

│ ├── Contracts/

│ ├── Tax-Filings/

│ └── Legal/

├── 2025/

│ └── [same structure]

├── Permanent/

│ ├── Corporate-Records/

│ ├── Licenses-Permits/

│ ├── Insurance-Policies/

│ └── Property/

└── Destruction-Log.xlsx

```

Step 2: Automate What You Can

• Bank statements: Most banks (including Holdings) let you auto-export monthly statements. Set it up once.
• Receipts: Use a receipt scanning app that auto-categorizes and stores to cloud
• Payroll: Your payroll provider stores records, but export annual summaries as backup
• Accounting software: Schedule quarterly exports of your general ledger, P&L, and balance sheet

Step 3: Calendar Your Annual Purge

Every January:

1. Review retention schedule
2. Identify documents past their required retention period
3. Verify no open audits, legal proceedings, or tax disputes
4. Destroy eligible documents (securely)
5. Log what was destroyed
6. Back up everything that remains

Step 4: Train Your Team

If anyone else handles finances — a bookkeeper, office manager, partner — make sure they know the system. A retention policy only works if everyone follows it.

The Cost of Getting This Wrong

Let me give you the real numbers on what happens when you can't produce records:

• IRS audit without receipts: The IRS can disallow deductions entirely. A $50,000 deduction you can't document becomes $0, and you owe taxes on that $50,000 plus penalties and interest.
• Employment audit without payroll records: State labor departments can assess penalties of $100-$500 per missing record, per employee. Ten employees, three years of missing records? That's $30,000+ in penalties alone.
• Legal dispute without contracts: You lose. No contract means no proof of terms. Courts default to the other party's version of events.
• Insurance claim without property records: Your claim gets denied or reduced. If you can't prove what you owned and what it was worth, the insurance company pays less.

How Holdings Helps

I built Holdings partly because I was tired of chasing down financial records. When your banking and bookkeeping live in the same place:

• Every transaction is automatically categorized and stored — no manual receipt entry for bank transactions
• Statements are generated and archived automatically — always accessible, always organized
• AI bookkeeping catches miscategorizations — so your records are accurate from day one
• Export anything, anytime — full transaction history, categorized expenses, tax-ready reports

You still need to keep contracts, employee records, and legal documents separately. But the financial record-keeping — the part that takes most businesses hours every month — is handled.

Banking partner i3 Bank, Member FDIC. Up to $3M in FDIC coverage. 1.75% APY on deposits.

Download: Record Retention Schedule

We built a Record Retention Schedule you can use right now. It covers every document type, the required retention period, recommended storage method, and a destruction date calculator so you know exactly when each document can be safely destroyed.

Print it out, tape it to the wall above your filing cabinet (or bookmark it next to your cloud storage), and never wonder "should I keep this?" again.

---

*This guide is for informational purposes and doesn't constitute legal or tax advice. Consult with a tax professional or attorney for guidance specific to your situation and jurisdiction. Holdings is a financial technology company, not a bank. Banking services provided by i3 Bank, Member FDIC.*