CPA Record Retention Requirements for Tax Practitioners

CPA record retention requirements run from three years for basic preparer copies and payroll files to seven years for tax engagement workpapers and PCAOB audit documentation, with employee benefit plan records held six years, non-issuer audit files held five, and destruction certificates kept permanently. Those periods come from different sources (the Internal Revenue Code, Sarbanes-Oxley, ERISA, state boards of accountancy, and the FTC), and when more than one rule reaches the same document, the longest period controls.

Retention Periods at a Glance

Tax return workpapers and supporting documents: seven years from the filing date, which covers the IRS’s six-year extended assessment window plus a buffer
Copies of filed returns or preparer lists under IRC 6107: three years after the close of the return period¹
E-file authorizations (Form 8879): three years from the return’s due date or the IRS received date, whichever is later²
Property basis records: entire ownership period plus three to six years after the disposal year’s return is filed³
Worthless securities and bad debt loss support: seven years⁴
PCAOB audit documentation: seven years from the report release date⁵
Non-issuer (AICPA) audit documentation: five years from the report release date
Audit workpapers under Sarbanes-Oxley criminal provisions: at least five years from the end of the fiscal period in which the engagement concluded⁶
Employee benefit plan records: six years from the filing date⁷
Peer review working papers and reports: at least 120 days after the administering entity’s acceptance letter⁸
CPE documentation: typically five years (verify your state board’s rule)
Payroll records: three years; basic time records two years⁹
Form I-9: three years from hire or one year after termination, whichever is later¹⁰
EEO and personnel files: one year from separation, longer if a discrimination charge is pending
Firm registration and permits: life of the firm plus a reasonable period after dissolution
Destruction certificates: permanently

Tax Preparation Records

Why Seven Years Is the Working Minimum

The IRS has three years from the later of the return’s due date (including extensions) or filing date to assess additional tax, stretching to six years when the taxpayer reported 25% or less of gross income.¹¹ For fraudulent or unfiled returns there is no limitation period at all. A seven-year retention on tax engagement files covers the longest non-fraud assessment window with a buffer. Shorter periods assume every client reported income correctly, which is a bet you lose at the worst possible moment: when an IRS examiner asks for workpapers you no longer have.

The Three-Year Floor for Preparer Copies

Separate from engagement workpapers, every tax return preparer must either keep a completed copy of each return prepared or maintain a list of taxpayer names and identification numbers, and must make the material available for IRS inspection on request. The window runs three years after the close of the return period.¹ Most firms keep the full return copy; a bare list meets the statute but creates work later.

E-File Authorizations

If you e-file, you collect signed Form 8879 authorizations. Each one has to sit in a secure, tamper-proof system for three years from the later of the return’s due date or the IRS received date.² A missing 8879 can cost the firm its e-file privileges, so a batched intake process is essential during tax season.

Basis Records

Property records travel with the asset. The IRS tells taxpayers to keep records until the statute of limitations expires for the year the property is sold or otherwise disposed of.³ For firms, that means holding purchase documents, improvement records, and depreciation schedules through the entire ownership period plus three to six years after the disposal year’s return. For like-kind exchanges, basis carries over, so the original property’s records stay in the file until the replacement property is finally sold. Claims for worthless securities or bad debts need seven years of support.⁴

Audit and Attestation Documentation

PCAOB Standards for Public Company Audits

Audits of public companies carry the strictest retention rule in the profession. Under Auditing Standard 1215, audit documentation must be kept at least seven years from the report release date, drawn directly from Section 103 of Sarbanes-Oxley. If no report is ever issued, the seven-year clock starts from the date fieldwork was substantially completed.⁵

The engagement team has 45 calendar days after the report release date to assemble and lock the final file.⁵ After that documentation completion date, nothing can be deleted. Anything added later must carry the date of the addition and the reason for it.

AICPA Standards for Non-Issuer Audits

Private company and other non-issuer audits follow AICPA AU-C Section 230: no less than five years from the report release date, with a 60-day documentation completion window rather than 45. The same prohibition on deletion applies after that window closes, and additions must note the date and reason. Under both PCAOB and AICPA rules, the audit file includes management representation letters, engagement quality review documentation, and communications with those charged with governance.

Criminal Exposure Under Sarbanes-Oxley

Two federal criminal statutes sit behind the audit retention rules. 18 U.S.C. § 1520 requires any accountant auditing a public company to maintain audit and review workpapers for at least five years from the end of the fiscal period in which the engagement ended. A knowing and willful violation carries a fine and up to 10 years in prison.⁶ The broader 18 U.S.C. § 1519 reaches anyone who destroys, alters, or falsifies any record with intent to obstruct a federal investigation or proceeding, with a maximum of 20 years in prison.¹² For a CPA firm, that means destroying records once you have any reason to anticipate a federal inquiry is a crime independent of any other retention violation.

Employee Benefit Plan Records

If your firm audits or certifies information for an ERISA-covered plan, Section 107 adds a six-year requirement. Anyone required to file reports about a benefit plan must keep the underlying records at least six years after the filing date, with enough detail to verify, explain, and check the filed documents, including worksheets, receipts, and supporting resolutions.⁷ Plans eligible for a filing exemption still have to keep records for six years from the date the filing would have been due.

State Licensing and Firm Records

CPE Documentation

Every state board of accountancy conditions license renewal on continuing education and requires proof. Most states expect CPAs to keep completion certificates, course descriptions, and attendance records for at least five years, which matches the audit cycle boards typically use when selecting licensees for review. A CPA who cannot produce proof when picked for audit risks suspension until the deficiency is cured.

Peer Review

Firms performing audits, reviews, or compilations undergo periodic peer review as a condition of the state firm permit. Under the AICPA Peer Review Program, working papers, reports, and letters generated during the review should be kept at least 120 days after the administering entity issues its acceptance letter.⁸ The underlying engagement workpapers the reviewer looked at follow their own, longer retention schedule.

Firm Registration and Malpractice

Records of firm registration, permits to practice, and ownership changes should be kept for the life of the firm and a reasonable period after dissolution. Engagement letters and confidentiality agreements should be held at least through the malpractice limitation period, which depending on jurisdiction and theory generally runs three to six years from when the error was or should have been discovered. These documents establish the scope of the engagement and often decide a malpractice case.

Employment Records

CPA firms are employers, and employment retention rules apply regardless of what client services you provide. The Fair Labor Standards Act requires payroll records (hours worked, wages paid) to be preserved at least three years from the date of last entry, with basic time records like daily start and stop times kept for two.⁹ Form I-9 must be retained three years after the hire date or one year after employment ends, whichever is later.¹⁰ Title VII and the ADEA require personnel and employment records to be kept for one year after separation, longer when a discrimination charge is pending. These obligations get overlooked in retention policies that focus only on client files.

Client Record Return and Taxpayer Consent

Two federal rules govern how you handle client information, which is a different question from how long you keep it, but they belong in any retention policy.

Under Circular 230 Section 10.28, when a client requests their records, you must promptly return everything the client needs to meet their federal tax obligations. You may keep copies. A fee dispute does not relieve the duty; the only narrow exception is where state law allows retention during a fee dispute, and even then you must allow the client to review and copy the retained material.¹³ Workpapers you create internally to support the return are generally the firm’s property.

IRC Section 7216 prohibits any tax return preparer from knowingly or recklessly disclosing or using a taxpayer’s return information for any purpose beyond preparing that return.¹⁴ Sharing with an affiliate, cross-marketing financial planning or insurance, and using a subcontractor for processing all require the taxpayer’s prior written consent. Consent must be knowing and voluntary, cannot be a condition of service, and for individual filers cannot use an opt-out format; the taxpayer must affirmatively choose each disclosure or use.¹⁵ Keep signed consents for the duration of the engagement relationship and a reasonable period after. Criminal penalties reach $1,000 per violation, or $100,000 for an aggravated disclosure, plus up to one year in prison. Civil penalties under IRC 6713 run $250 per unauthorized disclosure or use, capped at $10,000 per calendar year.¹⁶

When a Litigation Hold Overrides the Schedule

Your retention and destruction schedule stops the moment you reasonably anticipate legal action. Triggers include a demand letter, a lawsuit threat, a subpoena, notice of a regulatory investigation, or credible internal information that a dispute is heading toward litigation. Once a trigger occurs, destruction of anything potentially relevant must be suspended immediately, across both physical and electronic records, including email, text messages, and cloud files.

Destroying records after a hold should have been in place is spoliation. Courts respond with sanctions ranging from an adverse inference instruction (telling the jury to assume the destroyed material would have been unfavorable to the firm) to preclusion of evidence, dismissal, or default judgment. A written protocol should name who can trigger a hold, how it reaches every custodian, and how compliance is checked.

Secure Storage and Destruction

FTC Safeguards Rule

CPA firms that handle customer financial information are financial institutions under the FTC Safeguards Rule and must run an information security program. The Rule specifically requires encryption of customer information on firm systems and in transit. Where encryption is not feasible, the firm must put in place alternative controls approved by a designated Qualified Individual who oversees the security program.¹⁷ Firms using cloud storage must confirm the provider meets these standards and that the data stays within jurisdictions accessible to U.S. regulators.

Electronic Access Over Time

The IRS requires machine-readable records to remain capable of being retrieved, printed, and produced on electronic media for the full retention period.¹⁸ Archiving in a format that becomes unreadable is not compliant. When a firm migrates practice management systems, records in the old proprietary format must either be converted or remain accessible through the old system. Periodic access testing should be part of the retention process, not an afterthought when a request arrives.

Compliant Destruction

Once the mandatory period has fully expired and no litigation hold applies, destruction is not optional. Indefinite retention creates exposure: old data can be breached, and stale records can be subpoenaed in unrelated matters. The FTC Disposal Rule requires anyone possessing consumer information to take reasonable measures to prevent unauthorized access during disposal. For paper, that means cross-cut shredding or pulverizing. For electronic records, secure wiping or physical destruction of the media.¹⁹ A third-party vendor should be chosen through documented due diligence and bound by a written contract specifying destruction standards. Every destruction event should be captured in a certificate noting the date, method, and specific records destroyed, and those certificates should be retained permanently.

1
Office of the Law Revision Counsel. 26 USC 6107 – Tax Return Preparer Must Furnish Copy of Return to Taxpayer and Must Retain a Copy or List
2
Internal Revenue Service. Frequently Asked Questions for IRS e-File Signature Authorization
3
Internal Revenue Service. How Long Should I Keep Records
4
Internal Revenue Service. Publication 583, Starting a Business and Keeping Records
5
Public Company Accounting Oversight Board. AS 1215 Audit Documentation – Appendix A
6
Office of the Law Revision Counsel. 18 USC 1520 – Destruction of Corporate Audit Records
7
Office of the Law Revision Counsel. 29 USC 1027 – Retention of Records
8
AICPA & CIMA. AICPA Peer Review Program Document Retention Policy
9
eCFR. 29 CFR Part 516 – Records to Be Kept by Employers
10
U.S. Citizenship and Immigration Services. Retaining Form I-9
11
Internal Revenue Service. Time IRS Can Assess Tax
12
Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy
13
Internal Revenue Service. Treasury Department Circular No. 230 (Rev. 6-2014)
14
Office of the Law Revision Counsel. 26 USC 7216 – Disclosure or Use of Information by Preparers of Returns
15
eCFR. 26 CFR 301.7216-3 – Disclosure or Use Permitted Only With the Taxpayers Consent
16
eCFR. 26 CFR 301.7216-1 – Penalty for Disclosure or Use of Tax Return Information
17
Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know
18
Internal Revenue Service. Revenue Procedure 98-25 – Retaining Machine-Sensible Records
19
eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records