Document Retention for Small Businesses: What to Keep, How Long to Keep It, and How to Build a Defensible Policy

Understanding which documents to keep and which to throw away can often be daunting. Small business owners may commonly think that “keeping everything” is the safest option, or maybe just throwing out all their outdated files is harmless. Both strategies pose risks. One alternative strategy may keep everyone in the clear.

Treating records retention as a back-office administrative task rather than a strategic risk management function has created a largely invisible problem: an estimated $2.3 billion in annual compliance-related costs that most organizations neither anticipate nor fully understand.

A retention schedule is a documented guideline detailing how long business records should be kept to meet tax, employment, regulatory, and contractual needs, including when records can be destroyed if no longer required. It offers predictability, reduces storage and discovery costs, and prevents operational confusion from inconsistent filing habits and undocumented exceptions. A “minimum viable” retention program targets key record categories with the greatest legal risks for small and mid-sized businesses. Smaller companies often rely on informal practices, which can weaken during audits or disputes. The goal isn’t to mimic large compliance departments but to establish a defensible, business-aligned framework.

This article focuses on the seven major record categories most small businesses should understand when developing a defensible retention approach. It will outline what to retain, how long to keep it, what can be safely destroyed, how to establish a regular schedule that supports both compliance and day-to-day operations, and a table of general guidelines.

1. Tax and Accounting Support

Tax documentation drives a significant portion of retention risk. Federal tax authorities generally have multiple years to examine returns, and longer in cases involving substantial under-reporting.

According to the IRS, tax returns should be kept for three to seven years, depending on the situation. But if a return is not filed, the IRS recommends keeping records indefinitely. Keep federal tax returns, including payroll tax records, for seven years to stay on the safe side.

For operating businesses, this category typically includes filed tax returns, supporting schedules, general ledgers, financial statements, expense documentation, accounts payable and receivable records, and documentation of major asset purchases and depreciation.

What commonly goes wrong is not a failure to keep tax returns, but a failure to retain the supporting documentation that substantiates deductions, payroll expenses, or asset basis. When support lives in email attachments, third-party platforms, or an individual employee’s folder, it can become fragmented or lost. Retention thinking in this category means linking financial documentation to a defined accounting period and ensuring the supporting documentation survives long enough to defend that period if questioned.

2. Payroll and Wage Records

Wage-and-hour disputes are among the most common areas of small-business litigation. Federal and state wage laws require employers to maintain payroll and timekeeping records, and disputes often turn on whether those records are complete.

According to industry guidance on record retention from sources such as Corodata, a records management company, records such as payroll registers, timecards, pay rate histories, and wage calculations should not be treated lightly. These records often need to be retained for multiple years beyond the end of employment.

Operationally, problems arise when timekeeping systems change, payroll providers rotate, or managers maintain unofficial spreadsheets that are not centrally preserved. A defensible retention schedule ensures that payroll and wage documentation is preserved in a consistent format and that the company can reconstruct compensation history if challenged.

3. Hiring and Work Authorization

Hiring files carry a regulatory risk that is separate from general personnel records. Employment eligibility verification forms, background check documentation, and applicant materials may be subject to distinct retention requirements.

What often goes wrong is commingling. Application materials, interview notes, and verification forms are stored in separate folders or mixed into personnel files, without regard for their unique retention logic. A minimum viable schedule separates these categories and assigns retention periods that reflect the underlying regulatory framework.

Retention thinking here focuses on traceability. If an applicant later alleges discriminatory hiring practices or if work authorization is audited, the company should be able to demonstrate a consistent process supported by retained documentation.

4. Personnel and Employment Decisions

Personnel files are frequently misunderstood. Owners assume that once an employee leaves, the file can be discarded after a short period. In reality, employment claims may arise years later, and statutes of limitations vary by claim.

Personnel documentation typically includes offer letters, disciplinary records, performance reviews, promotion and compensation decisions, leave documentation, and termination materials. The National Federation of Independent Business (NFIB) has noted that clear documentation practices are often the difference between early dismissal of a claim and prolonged litigation.

The most common failure is inconsistency. Some managers document thoroughly; others document nothing. Files may exist in part in email, in part in HR software, and in part in paper form. A workable retention schedule identifies what belongs in the official personnel file, how long it is retained after separation, and how electronic records are preserved when systems change.

5. Safety and Incident Documentation

Workplace safety reports, accident investigations, workers’ compensation documentation, and internal incident reviews create exposure long after the event itself. Claims may arise years later, particularly in cases involving injury or alleged negligence.

Industry retention guidance consistently emphasizes that incident documentation should not be destroyed casually. Inconsistent retention in this category can appear suspicious in litigation.

Practically, retention thinking involves keeping incident records long enough to support potential claims and centralizing reports instead of leaving them in individual department folders. It also includes incorporating these records into a comprehensive litigation-hold process when a dispute appears imminent.

6. Core Corporate Records

Corporate governance documents often receive less attention in smaller organizations. Formation documents, operating agreements, bylaws, shareholder minutes, board resolutions, ownership records, and significant contracts define the company’s legal existence.

Unlike routine operational records, many core corporate documents should be retained permanently. As highlighted in general business record retention guidance, foundational documents and major contracts frequently outlive the transactions they supported.

The primary operational risk is informal management, where amendments can be made but not consolidated. Signed copies might only be stored as email attachments. A clear retention schedule is essential to differentiate between permanent records and those that can be destroyed after a specified period. a specified period.

Retention Is Not Just About Keeping—It Is Also About Destroying

A schedule is incomplete if it addresses only preservation. Routine, documented destruction in accordance with a written policy is often a company’s strongest defense against allegations of selective deletion. Improper document disposal cam open the door to risk: A stray client invoice or employee record tossed in the trash could lead to identity theft, corporate espionage, or major compliance violations.

However, destruction must cease when a duty of preservation arises. As explained earlier in this article regarding litigation holds, once a dispute is reasonably anticipated, normal destruction of records must stop. A retention schedule and litigation-hold protocol must function in tandem.

Without this integration, even a well-intentioned retention program can create risk.

Building a Defensible, Workable Retention Schedule

A real retention schedule is not a spreadsheet copied from the internet. It reflects overlapping federal and state requirements, industry-specific regulations, contractual obligations, and the company’s own systems and staffing realities.

Swiecicki & Muskett assist business owners in translating those overlapping requirements into a practical framework. That process typically begins by identifying the core records buckets that drive most legal exposure, mapping them to existing systems, and defining retention logic that is clear, documented, and consistently applied. The result is not an enterprise compliance manual. It is a schedule that fits the organization’s risk profile and daily operations.

Minimum viable does not imply minimal effort; rather, it signifies intentional design. By concentrating on tax and accounting support, payroll and wage records, hiring and work authorization documentation, personnel decisions, safety and incident reports, and essential corporate records, most small and mid-sized businesses can effectively address the most important areas.

A retention schedule created by accident—shaped by habit, turnover, and convenience — will eventually fail under scrutiny. A retention schedule created intentionally reduces risk, lowers discovery costs, and brings order to systems that might otherwise work against you.

If your current approach to document retention is to keep everything, keep nothing, or hope no one asks, it may be time to replace guesswork with structure.

Below is a general guideline for business record retention for small businesses and large corporations by record type to get anyone started:

Type	Example	Record Retention Period
Legal	Business formation records, deeds, trademarks, and ownership records.	Forever
IRS	Business federal tax returns	Seven years
Personnel	OSHA accident forms	Five years (up to 30 in some cases)
Legal	Business formation records, deeds, trademarks, and ownership records.	Forever
Payroll	Paystubs	Three years
Accounting	Financial statements and depreciation schedules	Seven years
Professional Documentation	Permits, insurance policies, and licenses	Until they are replaced
Banking	Bank statements, credit card statements, and canceled checks	Seven years
Hiring	Job advertisements and resumes	One year

Data provided by Corodata in “Business Record Retention Guidelines: How Long Should You Keep Documents?”