GAAP Record Retention Guidelines: Tax, Payroll, and Audit Records

GAAP record retention guidelines are a bit of a misnomer: GAAP governs how you measure and report financial activity, but it sets no retention periods of its own. The timelines that actually bind you come from federal tax, securities, labor, benefits, safety, and anti-money-laundering statutes, and they range from two years for some payroll backup documents to permanent for corporate formation records. For most financial documents, plan on three to seven years, with seven as the safer default.

Quick Reference by Record Type

  • Tax returns and supporting records: three years minimum, six or seven in specific situations, indefinite if a return was fraudulent or never filed
  • Employment tax records: at least four years after the tax is due or paid
  • Audit workpapers (for SEC-registrant audits): seven years after the engagement concludes
  • FLSA payroll records: three years for core records, two years for supporting documents
  • EEOC personnel records: one year from creation or the personnel action
  • Form I-9: three years after hire or one year after termination, whichever is later
  • ERISA plan filings and support: six years minimum; participant benefit records effectively until benefits are paid
  • Articles, bylaws, minutes, stock ledgers: permanent
  • Capital asset records: life of the asset plus the applicable limitations period
  • OSHA 300 Log, 301 forms, annual summary: five years after the covered calendar year
  • Employee medical records: duration of employment plus 30 years
  • Employee exposure records: 30 years
  • Bank Secrecy Act transaction records: five years

Federal Tax Records

The IRS ties its retention expectations to the periods during which it can audit your return or collect additional tax. The baseline is three years from the date you filed or the return’s due date, whichever is later.1Internal Revenue Service. How Long Should I Keep Records? From there, the timeline stretches or disappears entirely depending on the facts:

The indefinite scenarios catch more businesses than you might expect. A return that omits an income stream, or a year where a filing slipped through the cracks, leaves the door open permanently. Keeping copies of every filed return, along with the W-2s, 1099s, receipts, and invoices that support each line, is the only real protection.

Employment tax records run on their own clock. IRS Publication 583 requires all employment tax records to be kept for at least four years after the date the tax becomes due or is paid, whichever is later.3Internal Revenue Service. Publication 583 – Starting a Business and Keeping Records That four-year rule runs independently of the income tax periods, so payroll-related documents often need to stay on file longer than a business assumes.

Audit Workpapers and Financial Statements

Public companies and their auditors face the strictest rules. SEC Rule 2-06 of Regulation S-X, implementing Section 802 of the Sarbanes-Oxley Act, requires auditors to keep all records relevant to an audit or review for seven years after concluding the engagement.4eCFR. 17 CFR 210.2-06 – Retention of Audit and Review Records The rule covers workpapers, correspondence, memoranda, and any documents containing conclusions, opinions, analyses, or financial data related to the audit, whether or not the materials support the auditor’s final conclusions.5U.S. Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews

Two federal criminal statutes back this up. Under 18 U.S.C. § 1520, willfully failing to retain audit workpapers as required by SEC rules carries up to ten years in prison.6Office of the Law Revision Counsel. 18 USC 1520 – Destruction of Corporate Audit Records The broader obstruction statute, 18 U.S.C. § 1519, reaches anyone who destroys, alters, or falsifies records to impede a federal investigation, with penalties up to twenty years.7Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations Both statutes reach individuals, not just firms, so an employee shredding the wrong box can trigger personal criminal liability.

Even organizations not subject to SOX should treat seven years as a practical floor. Most federal and state statutes of limitations for contract disputes and financial claims fall within that window.

Payroll, Personnel, and I-9 Records

Several agencies regulate payroll and employment records, each with different requirements. The Fair Labor Standards Act sets two tiers. Core payroll records, including employee names, Social Security numbers, hours worked, and wages paid, must be preserved for at least three years. Supporting documents that show how wages were calculated, such as timecards, work schedules, and wage rate tables, must be kept for two years.8U.S. Department of Labor. Fact Sheet #21 – Recordkeeping Requirements under the Fair Labor Standards Act

The EEOC adds another layer. Personnel and employment records related to hiring, promotion, demotion, pay rates, or termination must be kept for at least one year from the date the record was created or the personnel action took place. For involuntary terminations, the year runs from the date the employee was let go.9U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements The FLSA’s three-year rule usually swallows the EEOC’s one-year minimum for overlapping documents, but records unique to hiring or promotion decisions need their own tracking.

Form I-9 Retention

Federal regulations require a completed Form I-9 for every employee hired after November 6, 1986. Keep it three years after the date of hire or one year after employment ends, whichever comes later.10U.S. Citizenship and Immigration Services. 10.0 Retaining Form I-9 For short-tenure employees who work less than two years, that means holding the form for three full years from their start date. For longer-tenure employees, keep it one year past their last day.11U.S. Citizenship and Immigration Services. Retaining Form I-9 Missing I-9s during an audit generate immediate fines, so build the retention calculation into offboarding.

Aligning Overlapping Requirements

Because the IRS, FLSA, EEOC, and immigration rules all touch the same employee files, default to the longest applicable period. For most payroll documents, that means four years under the IRS employment tax rule. For personnel files involving hiring or termination decisions, three years covers both the FLSA and EEOC comfortably. Managing different destruction dates for overlapping documents in the same folder invites accidents.

Benefit and Retirement Plan Records

ERISA imposes two distinct obligations. Section 107 requires records supporting required plan filings, including Form 5500 annual reports, nondiscrimination test results, and financial documentation, to be kept for at least six years from the date the report was filed.12U.S. Department of Labor. Recordkeeping in the Electronic Age

Section 209 goes further. Employers must maintain records sufficient to determine the benefits due or potentially due to each employee, including service history, compensation data, deferral elections, beneficiary designations, and plan documents with all amendments.12U.S. Department of Labor. Recordkeeping in the Electronic Age These records are needed to calculate what participants are owed, so the practical retention period extends until all benefits are paid out and any related audit windows have closed. For a defined benefit pension plan, that can be decades after the employee leaves. Six years is a floor; treating participant-level records as permanent until the last beneficiary is paid is the only reliable approach.

Permanent Corporate Records

Some documents define a business entity’s legal existence and stay on file for the life of the entity. Keep the articles of incorporation, corporate bylaws, and every amendment to either. Keep board meeting minutes and shareholder meeting records, which form the official history of major corporate decisions. Keep stock certificates and ownership ledgers that track equity structure.

These records survive dissolution. Closing a business does not end the obligation. Tax authorities and potential claimants can request documents years after operations cease, so formation documents, ownership records, and records of major corporate actions should be retained permanently or until every possible claim is time-barred.

Asset and Depreciation Records

Records for capital assets follow the life-of-the-asset rule. Retain all documentation of purchase price, improvements, and depreciation for as long as you own the asset, plus the applicable limitations period after you sell or retire it. Under the standard three-year IRS assessment window, that means at least three years after disposal. If the sale generates a worthless-securities claim or bad debt deduction, the window extends to seven years.1Internal Revenue Service. How Long Should I Keep Records?

Depreciation schedules deserve particular attention because they span the entire useful life of an asset and affect deductions each year. If you cannot produce the original cost basis and accumulated depreciation when you sell equipment or real property, the IRS can dispute your reported gain or loss. Keep asset files together, with acquisition documents, improvement records, and annual depreciation calculations in one place.

OSHA Safety and Long-Tail Medical Records

OSHA requires employers to retain injury and illness logs, specifically the OSHA 300 Log, the annual summary, and OSHA 301 Incident Report forms, for five years following the end of the calendar year the records cover.13Occupational Safety and Health Administration. 1904.33 – Retention and Updating During the five-year period, update the 300 Log to reflect newly discovered recordable injuries or changes to previously recorded cases.

Employee medical and toxic exposure records run much longer. Under 29 CFR § 1910.1020, employee medical records must be preserved for the duration of employment plus thirty years. Employee exposure records, such as workplace monitoring data, must be kept for at least thirty years on their own.14eCFR. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records The obligation persists even if the business closes. Minor first-aid records and health insurance claims maintained separately from the employer’s medical program are exempt.

Bank Secrecy Act Records

Financial institutions subject to the Bank Secrecy Act must retain most transaction records for five years, including currency transaction reports and documentation of funds transfers and monetary instrument purchases.15FFIEC BSA/AML InfoBase. Appendix P – BSA Record Retention Requirements Records may be kept in original, electronic, or microfilm form, but they must remain accessible in a reasonable timeframe.16FinCEN. BSA Recordkeeping Law enforcement investigations or Treasury Department orders can extend the five-year period case by case, and BSA obligations run independently of other retention rules. A record that satisfies your tax schedule may still need to be preserved under the BSA.

Electronic Records and Secure Disposal

Most businesses now store financial records electronically, and the IRS has specific expectations. Revenue Procedure 98-25 requires machine-sensible records to be retained for as long as their contents remain relevant to tax administration, at minimum through the expiration of the applicable statute of limitations for each tax year. The electronic records must provide enough detail to support and verify return entries, with a clear audit trail connecting the data to the books and to the filed return. Businesses must also maintain documentation of the processes that create, modify, and preserve those records.17Internal Revenue Service. Automated Records

When records reach the end of their retention period, destruction has its own rules. The FTC’s Disposal Rule under 16 CFR Part 682 requires any business that possesses consumer information to take reasonable measures to prevent unauthorized access during disposal. Acceptable methods include burning, pulverizing, or shredding paper records, and destroying or erasing electronic media so the information cannot be reconstructed.18eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information If you outsource destruction, the rule expects due diligence on the vendor, including reviewing their security procedures and monitoring compliance.

Destroy records too early and you lose audit protection. Destroy them improperly and you face liability for data breaches. A retention calendar that tracks each record category’s minimum hold period and triggers a documented destruction process when the period expires handles both problems.