Record Retention in the Digital Age

Previously, we put together a business record retention resource to answer the question, “How long do you need to keep business records?” It gave clear record retention recommendations based on standard business practices for tax filings, audits, property ownership, insurance, employment records, and permits/licenses. And yet, only five years later we’re revisiting the topic because there is growing confusion around how long companies and nonprofits should retain their records now that so many of them are digital.
​
The question we’re being asked today is, “How long do I need to keep digital business records – are the rules different?”

---

​With so many organizations using cloud-based accounting software like QuickBooks Online and apps like BILL these days, the question becomes trickier to answer and the solution more difficult to administer. Let’s take a look at how long digital records need to be kept and how best to handle doing so!

Keeping (and Deleting) Records
Back when paper accounting records all used to be kept in filing cabinets in a storage room, it was easy to physically set aside what was being saved and then go in periodically and toss out anything that was over seven years old. But what do companies do now? How should digital files be earmarked for retention, and what does getting rid of them look like?

Record retention is no one’s favorite topic, but it’s an incredibly important component of an organization’s overall financial management. Why? Because keeping business records for an appropriate amount of time:

• Facilitates Compliance – Business records will need to be kept long enough to fulfill regulatory requirements and assist in any possible audits and investigations that may arise. Typically, these are clearly spelled out by federal/state/local authorities, other applicable governing bodies, and funders. For nonprofits, in particular, there can be additional layers of compliance requirements to abide by related to their grant sources. 
  
  
• Provides Legal Protection – If a dispute arises or litigation is brought against an organization, its business records can serve as evidence to help to defend it and avoid costly penalties.
  
  
• Aids in Financial Analysis – Its’s important to remember that business records can also be an instrumental part of analyzing past financial performance, identifying patterns, and capitalizing on trends.

Since the records aren’t taking up physical space, some organizations have simply opted to hold onto them indefinitely so that they don’t run the risk of deleting them too soon. However, that is a mistake because doing so:

• Adds Security Risk – Holding onto needless business records digitally puts a target on an organization’s back, increasing its chances of falling victim to a data breach, cyber-attack, or fraudulent activity. Simply put, the more records that are out there, the more likely they are to be compromised. 
  
  
• Carries an Ongoing Cost – Do not overlook the cost of holding onto records past their required retention windows. Digital data storage has a sneakier cost than physically holding onto records (where you can visually see how much space they are taking up, and understand the cost associated with that space), which leads many business owners to overlook its true cost. Holding onto digital records carries a significant cost not only in terms of data storage space on hard drives and servers but also in ongoing technology needs. Organizations that choose to hold onto records permanently need to understand that as technology becomes obsolete there are added carrying costs in the way of data migration or conversion to continue accessing old records.
  
  
• Reduces Efficiency – Old records can bog down accounting systems, making them slower to access, update, and use regularly. Unneeded accounting records clutter up the system, reducing users’ efficiency across day-to-day activities.

So, with all that in mind, how long should you keep digital business records?

Recommended Retention Timeframes
The following are some generally accepted best practices when it comes to holding onto business records:

Keep for 3 Years:

• Contracts/agreements for contractors and consultants.
  
  

Keep for 7 Years:

• Time reports and attendance records.
• Payroll checks and records.
• Commission and bonus reports.
• Medical benefits costs.
• Stock transaction records.
• Business ledgers.
• Bills and invoices.
• Mileage logs.
• Bank and credit card statements.
• Brokerage statements.
  
  

Keep for 10 Years:

• Worker’s compensation benefits.
• Employee withholdings and exemptions.
  
  

Keep Forever:

• Proof of insurance and insurance contract specifics.
• Tax records and returns.
• W-2 and 1099 forms.
• Retirement plan agreements and account records.
• Previous audit records.
  
  

Contingent:

• Business permits and licenses – retain for as long as the business is in operation.
• Employment records – retain for one year after an employee leaves or is terminated.
• Property records – retain for three years after the property is sold or written off.
• Employment tax records – retain for 4 years or per individual state requirements (will vary).

​Keep in mind, these are generalized recommendations and should not be construed as legal or tax advice. For more detailed information around record requirements, please visit:

IRS: Keeping Business Tax Records

A Practical Approach to Record Retention
Once you have a handle on how long you need to keep each type of digital business record, how do you go about managing it? Follow these five steps:
​

1. Develop a Formal Digital Record Retention Policy – Every organization should have a written record retention policy that they can reference and update as needed. Rely on the organization’s unique combination of compliance requirements, cost considerations, technological tools (software systems, integrated apps, etc.), and personnel to shape the policy to best meet the organization’s ongoing needs.
2. Organize Records – Categorize and classify records based on how long they need to be retained and create a system for removing them when they are no longer required.
3. Utilize Secure Storage – Always use a secured platform to store business records and restrict access to stored records in accordance with the organization’s internal controls measures.  
4. Establish a Reviews Process – For business records with ambiguous or subjective retention timeframes, create the expectation that accounting personnel will review them periodically to determine whether they are still required.
5. Document Record Deletion – If records are no longer required, securely delete them to ensure that they are safely and effectively removed. Then, leave an audit trail by documenting when they were deleted, by whom, and how in case this information is ever needed for any reason later.

When you need help administering accounting policies and procedures, give us a call! We have an experienced team of accounting consultants that can help improve your accounting activities while keeping an eye on compliance. Every day we provide US-based accounting services to small and mid-sized businesses to provide as much or as little help as you need!