Federal Record Retention Requirements for Employers: Timelines

Federal record retention requirements for employers are not set by a single statute or agency. The IRS, Department of Labor, OSHA, EEOC, USCIS, and SEC each impose their own timelines, and the periods stretch from one year for basic personnel files to permanently for corporate governance documents. A business that keeps everything the same length of time will either destroy documents too early and face penalties or pay to store files it no longer needs.

Quick-Reference Retention Periods

Income tax records, general: 3 years from the filing date¹
Income tax where 25%+ of gross income was omitted: 6 years²
Bad debt or worthless securities loss: 7 years³
Fraudulent or unfiled returns: indefinitely⁴
Employment tax records: 4 years after tax due or paid⁵
Payroll records under the FLSA: 3 years⁶
Wage computation records under the FLSA: 2 years⁶
Personnel records under EEOC rules: 1 year from creation or personnel action⁷
Form I-9: 3 years from hire or 1 year from termination, whichever is later⁸
FMLA records: 3 years⁹
ERISA benefit plan records: 6 years after filing¹⁰
OSHA injury and illness logs: 5 years¹¹
OSHA employee exposure and medical records: duration of employment plus 30 years¹²
Audit workpapers under Sarbanes-Oxley and SEC rules: 7 years¹³
Corporate governance documents: permanently

The rest of this article explains each of these categories, what triggers the longer periods, and what happens when retention falls short. Where two rules cover the same document, the longer period controls.

Tax and Payroll Records

The IRS baseline is three years. Records that support income, deductions, or credits on a return must be kept at least three years from the date the return was filed or two years from the date the tax was paid, whichever is later. That window matches the standard period during which the IRS can assess additional tax.¹

Several situations extend that period:

If a business omits more than 25% of the gross income it reported, the IRS has six years to assess, so records need to last at least that long.²
Records supporting a bad debt deduction or a worthless securities loss must be kept for seven years from the return’s filing date.³
Records for buildings, equipment, and other business property must survive until the limitation period expires for the year the asset is sold or disposed of. These establish cost basis for depreciation and for calculating gain or loss at sale. Equipment depreciated over ten years needs its purchase records for those ten years plus at least three more after disposal.¹
For a fraudulent return or a return that was never filed, there is no limitation period. The IRS can assess tax at any time, and the supporting records should be kept indefinitely.⁴

The unfiled-return rule catches people out. An owner who missed a year and assumes the clock has run is wrong. There is no clock on an unfiled return.

Payroll tax records follow a separate track. Federal regulations require employers to keep all records related to employment taxes — Social Security, Medicare, and federal unemployment (FUTA) withholdings — for at least four years after the tax is due or paid, whichever is later.⁵ That four-year floor sits above the DOL’s separate three-year FLSA payroll rule, and when two requirements overlap the longer one controls.

Employment and Personnel Records

Employment records are governed by multiple agencies. The workable approach is to identify the longest applicable period for each document type and use it as the floor.

Payroll and Wage Records (FLSA)

The Department of Labor requires employers to keep payroll records — employee names, addresses, occupations, pay rates, and total wages paid — for at least three years from the date of last entry. Records used to calculate wages, including time cards, work schedules, and wage rate tables, have a shorter floor of two years.⁶

EEOC and ADEA Records

The Equal Employment Opportunity Commission requires employers to keep personnel and employment records for one year from the date the record was made or the date of the relevant personnel action, whichever is later. For an involuntarily terminated employee, that year runs from the termination date. “Personnel records” is broad here, covering application forms, hiring and promotion decisions, pay rates, and selection for training.⁷ If an employee files a discrimination charge, all relevant records must be kept until the case is fully resolved, regardless of the one-year baseline.¹⁴

Under the Age Discrimination in Employment Act, employers must keep payroll records for three years and records documenting employee benefit plans or seniority systems for the full period the plan is in effect plus at least one year after termination of the plan.¹⁵

Form I-9

Every employer must complete and retain a Form I-9 for each employee hired after November 6, 1986. After an employee leaves, the retention formula is three years after the hire date or one year after the termination date, whichever is later. In practice, that means keeping the form for three years if the employee worked fewer than two years, and one year after termination if they worked longer than two years.⁸ Fines are assessed per form, so a company with hundreds of noncompliant I-9s faces exposure that multiplies fast.

FMLA Records

Employers covered by the Family and Medical Leave Act must keep FMLA-related records for at least three years. These include dates of leave taken, hours of leave when taken in partial-day increments, copies of employee leave notices, and any documents related to disputes about whether leave qualifies as FMLA leave. Medical certifications and records about an employee’s or family member’s health condition must be stored in confidential medical files separate from the general personnel file.⁹

Workplace Safety Records (OSHA)

OSHA imposes some of the longest retention periods of any federal agency, particularly where chemical or hazardous substance exposure is involved.

Employee exposure records — the results of workplace monitoring for toxic substances or harmful physical agents — must be kept for at least 30 years. Employee medical records must be kept for the duration of employment plus 30 years. The one exception: if an employee works less than one year, medical records need not be kept beyond the end of employment as long as those records are provided to the employee at termination.¹²

OSHA injury and illness logs — the 300 Log, annual summary, and 301 Incident Reports — must be saved for five years following the end of the calendar year they cover. During that five-year window, the 300 Log must be updated if new recordable injuries are discovered or if the classification of previously recorded injuries changes.¹¹ Violations of OSHA recordkeeping requirements can result in penalties of up to $16,550 per violation for serious or other-than-serious violations, and up to $165,514 per violation for willful or repeated violations.¹⁶

Employee Benefit Plan Records (ERISA)

Employers who sponsor retirement plans, health plans, or other benefit plans subject to the Employee Retirement Income Security Act must keep records for at least six years after the filing date of the plan’s annual report (Form 5500), or six years after the date the report would have been due if the plan was exempt from filing. The records must be detailed enough to verify and explain the filed report and include vouchers, worksheets, receipts, and relevant resolutions.¹⁰

This six-year ERISA requirement is separate from and in addition to the ADEA benefit-plan rule (duration of plan plus one year). Where both apply to the same document, keep it for whichever period is longer.

Audit Workpapers for Public Companies (SOX)

The Sarbanes-Oxley Act adds a layer for publicly traded companies and their auditors. Under PCAOB standards, auditors must prepare and maintain audit workpapers and related information for at least seven years, in enough detail to support the audit report’s conclusions.¹³ The SEC’s implementing rule at 17 CFR § 210.2-06 requires accountants to retain all records relevant to an audit or review, including workpapers, correspondence, and communications containing conclusions, opinions, or financial data, for seven years after the audit concludes.¹⁷

The criminal exposure is real. Under 18 U.S.C. § 1520, knowingly and willfully violating the audit workpaper retention requirement is punishable by a fine, up to 10 years in prison, or both.¹⁷ And 18 U.S.C. § 1519 reaches further: anyone who destroys, alters, or falsifies any record with intent to obstruct a federal investigation faces up to 20 years in prison. That provision is not limited to public companies. It applies to any business that destroys records to impede a federal proceeding.¹⁸

Corporate Governance Documents and Contracts

Foundational corporate documents — articles of incorporation, bylaws, stock ledgers, and minutes of board and committee meetings — should be kept permanently. No federal statute sets a specific number of years, because these records define the legal existence, ownership, and decision history of the business. They may be needed decades later for mergers, ownership disputes, or regulatory inquiries.

Federal law does not prescribe a single retention period for ordinary commercial contracts. Retention should track the applicable statute of limitations. Under the Uniform Commercial Code, a suit for breach of a contract for the sale of goods must be filed within four years of the breach. When a warranty extends to future performance, the four-year clock does not start until the breach is or should have been discovered.¹⁹ Practically, keep contracts, invoices, and related correspondence for at least four years after full performance or termination, longer if the agreement includes future-performance warranties or could feed a tax or regulatory matter with a longer window.

Legal Holds Override Every Schedule

A legal hold is a directive to preserve all records that could be relevant to pending or reasonably foreseeable litigation, a government investigation, or an audit. Once a hold takes effect, it overrides every retention schedule above. Records covered by the hold must be kept until the matter is fully resolved, even if their scheduled destruction date has passed. This applies equally to paper files and to electronic data, including emails, text messages, and database entries.

The duty to preserve arises when litigation or an investigation becomes reasonably foreseeable, not when a lawsuit is filed. Waiting for service of a complaint is too late and can produce sanctions for spoliation of evidence.

Penalties for Getting It Wrong

Consequences vary by record type and by whether the failure looks negligent or deliberate.

On the tax side, a business that cannot produce records to support reported income or deductions risks having those deductions denied. The IRS can also reconstruct income using its own methods when books are inadequate, which almost always results in a higher assessed liability than the return showed.

Employment-related penalties are typically assessed per violation. Under the FLSA, civil penalties for recordkeeping violations can reach $1,313 per violation.²⁰ OSHA penalties, noted above, run substantially higher. I-9 fines are assessed per form.

In litigation, destroying or failing to preserve records after a legal hold triggers can produce an adverse inference instruction, where the court tells the jury it may presume the missing evidence was unfavorable to the party that lost it. That instruction is often enough to decide the case. When records are destroyed with intent to obstruct a federal investigation, 18 U.S.C. § 1519 authorizes up to 20 years in prison.¹⁸

Storing and Destroying Records

Records need to remain accessible, readable, and protected from unauthorized access for their entire retention period. Paper records in long-term storage should be kept in climate-controlled environments to prevent degradation. Electronic records should be stored using encrypted, backed-up systems that allow efficient retrieval during audits or litigation discovery. The practical test is whether a business can produce a specific document within a reasonable time when a regulator or court asks for it.²¹

Once a retention period has expired and no legal hold is in effect, records containing sensitive information should be destroyed in a way that makes reconstruction impossible. For paper, that means cross-cut shredding or pulverizing. For electronic data, secure wiping or physical destruction of storage media. Deleting a file is not enough. Keeping a destruction log — what was destroyed, when, and by whom — is the final proof that the business followed its schedule and did not selectively destroy records.

1
Internal Revenue Service. How Long Should I Keep Records?
2
Office of the Law Revision Counsel. 26 USC 6501 – Limitations on Assessment and Collection
3
Internal Revenue Service. Topic No. 305, Recordkeeping
4
Office of the Law Revision Counsel. 26 USC 6501 – Limitations on Assessment and Collection
5
eCFR. 26 CFR 31.6001-1 – Records in General
6
eCFR. 29 CFR Part 516 – Records to Be Kept by Employers
7
eCFR. 29 CFR 1602.14 – Preservation of Records Made or Kept
8
USCIS. 10.0 Retaining Form I-9
9
eCFR. 29 CFR 825.500 – Recordkeeping Requirements
10
Office of the Law Revision Counsel. 29 USC 1027 – Retention of Records
11
Occupational Safety and Health Administration. 1904.33 – Retention and Updating
12
Occupational Safety and Health Administration. Access to Employee Exposure and Medical Records
13
Office of the Law Revision Counsel. 15 USC 7213 – Auditing, Quality Control, and Independence Standards and Rules
14
U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
15
eCFR. 29 CFR 1627.3 – Records to Be Kept by Employers
16
Occupational Safety and Health Administration. OSHA Penalties
17
U.S. Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews
18
Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations
19
Legal Information Institute. UCC 2-725 – Statute of Limitations in Contracts for Sale
20
U.S. Department of Labor. Civil Money Penalty Inflation Adjustments
21
National Archives. A Management Guide