How Long to Keep Business Records: A Plain-English Retention Schedule Tied to the IRS Statute of Limitations

Three years. Four years. Six years. Seven years. Forever.

Ask five small-business owners how long they keep their tax records and you will hear five different answers — and at least one of them is wrong. The IRS does not publish a single retention number because the right answer depends on what kind of record you are holding and what you did (or did not do) on the related return. A receipt that supports a deduction is on a different clock than a Form W-2, which is on a different clock than the closing statement on the building you bought eleven years ago.

Get this wrong in one direction and you shred a document the IRS later asks for. Get it wrong in the other direction and you are paying to warehouse twenty years of bank statements you legally do not need. The aim of this guide is to give you a defensible retention schedule you can actually implement — built on the IRS statute of limitations, layered with the Department of Labor and OSHA rules most owners forget about, and updated for a world where the records live in cloud storage rather than a banker's box.

The Core Idea: Records Live as Long as the Statute of Limitations

The reason there is no single retention number is that the IRS does not tell you to keep records for "X years." It tells you to keep records "until the period of limitations for that tax return runs out." The retention period is downstream of the limitations period — the window during which the IRS can still assess additional tax, or you can still amend your return to claim a refund.

For most returns, that window is three years. But several specific situations stretch it — and a couple of situations remove the window entirely. Once you internalize that, the rest of the schedule writes itself.

The IRS Period of Limitations — Five Scenarios

The IRS's own guidance for small businesses lays out five scenarios that determine how long the tax-assessment clock runs:

Three years (the default). You filed your return on time, reported your income honestly, and did not claim a loss from worthless securities or bad debt. The IRS has three years from the filing date to assess additional tax. Keep the supporting records for at least three years.
Three years from filing or two years from payment, whichever is later. If you file an amended return to claim a credit or refund, the clock is the longer of these two windows. In practice this matters for taxpayers who paid late.
Seven years. If you claim a loss from worthless securities or a deduction for a bad debt, you must keep the records for seven years. These deductions are scrutinized harder than most because the underlying facts (when did the debt actually become uncollectible?) are subjective.
Six years. If you under-report your gross income by more than 25%, the statute of limitations doubles to six years. You do not get to choose this category — the IRS does, after the fact, if it concludes that you substantially understated. Plan for it preemptively if your income is hard to pin down (cash businesses, complex pass-throughs, large barter activity).
Indefinite — no time limit at all. If you never file a return, or if you file a return the IRS later determines was fraudulent, there is no statute of limitations. The government can come back twenty years later and assess. The records you would need to defend yourself live on the same clock: forever.

A small but important footnote: the three-year default applies from the date you filed the return, not from the tax year. A 2026 return filed on April 15, 2027 stays open through April 15, 2030. File an extension and the clock starts from the actual filing date.

Employment Tax Records: A Separate, Four-Year Clock

Employment taxes — Forms 941, 940, W-2, W-3, and the underlying payroll registers — sit on their own retention shelf. The IRS rule is that you must keep employment tax records for at least four years after the date the tax becomes due or is paid, whichever is later. That is one year longer than the standard income-tax window, and it applies even if nothing about the employment return is in dispute.

Add the Department of Labor's Fair Labor Standards Act rules on top, and the practical minimum for most payroll-adjacent records is between three and four years:

Payroll registers, collective bargaining agreements, sales and purchase records: three years under the FLSA, but extended to four by the IRS payroll rule.
Records on which wage computations are based (time cards, piece-rate tickets, wage tables, shift schedules, deduction records): two years under the FLSA, but most employers default to four to stay compliant with the IRS rule above.
I-9 forms: three years after the date of hire or one year after termination, whichever is later. Maintain them separately from personnel files so you can produce only the I-9s during an ICE audit without exposing unrelated personnel information.

Property and Asset Records: The Disposition + Limitations Rule

Records for any capital asset — real estate, vehicles, equipment, intangibles you have capitalized — follow a different rule entirely. You keep them "until the period of limitations expires for the year in which you dispose of the property."

That phrase is doing a lot of work. It means the retention clock for your 2008 office building does not even start until you sell it. If you sell that building in 2030 and report the gain on your 2030 return, the records supporting your basis must be kept until at least 2033 — twenty-two years after the original purchase.

Why? Because the IRS needs to verify the gain or loss on disposition, which requires the original cost basis, every capital improvement you added to basis, and every depreciation deduction you took against it. Throw out the closing statement for the building when you have only owned it five years and you have no defensible answer when the IRS later asks how you arrived at your basis.

A practical implication: keep a permanent "asset folder" for every capital purchase that survives independently of your yearly tax files. When the asset is sold, move it to the year-of-disposition file and apply the standard three-year rule from there.

OSHA and Workplace-Injury Records

Two OSHA retention periods catch employers by surprise:

OSHA 300, 300A, and 301 injury and illness logs: five years following the end of the calendar year the records cover.
Employee medical and hazardous-exposure records: the duration of employment plus thirty years. This is one of the longest retention requirements in U.S. law and applies to anyone working with regulated substances — manufacturers, body shops, dry cleaners, cleaning services, dental offices, and any business with bloodborne pathogen exposure.

If you employ anyone exposed to hazardous materials, you cannot get away with a "destroy after seven years" policy. Build a permanent medical-records archive.

A Practical Retention Schedule You Can Actually Use

Take the rules above and translate them into a single schedule you can hand to your bookkeeper or operations manager. The retention periods below are the minimum the law typically requires — many advisors add a buffer year to absorb late-discovered errors or state-law overrides.

Keep for at Least 3 Years

Cash register tapes and daily sales summaries
Credit card receipts and statements
Vendor invoices for non-capital expenses
Petty cash records
Bank deposit slips
Routine correspondence about returns

Keep for at Least 4 Years

All employment tax returns (Forms 941, 940, W-2, W-3, 1099-NEC, 1099-MISC)
Payroll registers and timesheets
Wage rate tables, work schedules, deduction records
Union and collective bargaining agreements
Backup withholding documentation

Keep for at Least 6 Years

Bank statements and reconciliations
General ledgers and journal entries
Sales invoices and customer ledger
Accounts payable detail
1099s issued and received
Inventory listings

This bucket is where most professionals default for routine financial records, because it covers the 25%-under-reporting scenario without requiring you to make a case-by-case judgment about which records might be implicated.

Keep for at Least 7 Years

Documentation for any worthless-securities loss
Documentation for any bad-debt deduction
Records of any abandonment loss
Records supporting net operating loss (NOL) carryforwards (keep through the year the NOL is fully absorbed plus three additional years)

Keep Permanently

Filed tax returns (the returns themselves — supporting documents can follow their own schedule)
Articles of incorporation, partnership agreements, operating agreements, bylaws
Corporate minute books and stock ledgers
Real estate deeds, title insurance, mortgage payoffs, original closing statements
Original purchase invoices and improvement records for all capital assets until disposition + 3 years
IRS audit reports, examination correspondence, and closing agreements
Pension and profit-sharing plan documents, Forms 5500, actuarial reports
Intellectual property registrations (trademarks, patents, copyrights)
Cancelled checks and supporting documentation for important payments (taxes, capital improvements, major contracts)
OSHA medical and exposure records (duration of employment + 30 years)

A reasonable rule of thumb: anything that establishes the existence or basis of an entity, an asset, or a long-term liability is permanent. Everything else is on a clock.

Don't Forget About Your State

The IRS sets the federal floor, but your state can — and often does — require longer. Several common examples:

California has a four-year statute of limitations on most income tax returns, not three.
Many states never let the clock start if no return was filed, mirroring the federal rule.
State sales tax often requires longer retention than federal income tax — typically four years, sometimes six.
Unclaimed property (escheat) records must often be retained for ten years or longer to defend against a state audit of dormant balances.

If you operate in multiple states, the safest move is to retain records for the longest applicable period. The cost of cloud storage is trivial compared to the cost of losing a state audit because you destroyed the underlying records in year four.

Accurate Bookkeeping Makes Retention Painless

Most of the headaches around document retention come from one root cause: the underlying books were never tight to begin with. If your accounting records are accurate, your retention schedule is mostly a matter of saving the source documents that already tie out to entries. If your books are a mess, you end up over-retaining everything because you cannot tell what supports what.

Three habits that make the next audit (or refund claim, or successor-buyer due diligence) dramatically easier:

File source documents the same way every month. Receipts, invoices, and bank statements should land in a predictable folder structure — by year, then by vendor or category — within a week of the underlying transaction.
Tie every entry to a document reference. If your bookkeeping system supports attachments, attach the source document directly to the journal entry. If it does not, use a consistent file-naming convention so any entry can be traced to its source in under a minute.
Run a quarterly retention sweep. Once a quarter, look at what is now older than the relevant retention window and either archive it offline or delete it under a written policy. A documented destruction routine is what protects you legally — ad-hoc shredding does not.

Going Digital: What the IRS Will Actually Accept

You almost certainly do not need physical paper at this point. Revenue Procedure 97-22 is the IRS authority allowing taxpayers to maintain books and records in electronic format, and it has been in force long enough that the IRS no longer requires advance notification before you make the switch.

The IRS has five core expectations for electronic records:

Accurate reproduction. The image must be a complete, legible copy of the original — vendor name, amount, date, and line items must all be readable on the scan or photo.
Indexing. You must be able to locate any specific document on demand. This does not require special software. A consistent folder hierarchy in Google Drive, Dropbox, OneDrive, or iCloud is fine.
Alteration prevention. The storage system must reasonably prevent or detect changes to the underlying file. Write-once storage, version history, or a system audit trail all satisfy this.
Accessibility. Records must be retrievable by you and by the IRS within a reasonable time. Encrypted archives are fine — but you (and your accountant) need to know the passwords.
Quality assurance. You should periodically test that older records are still readable and that no corruption has crept in. A yearly spot-check is a defensible practice.

The IRS rule is technology-agnostic. You can use a cloud drive, a dedicated document-management system, a receipt-scanning app, or even local backups — as long as the five expectations above are met.

A few practical tips for a compliant digital archive:

Scan to PDF, not to JPG. PDFs preserve searchable text after OCR. JPGs do not.
Back up off-site. Two copies in the same cloud account is not redundancy. Either replicate to a second provider or pull a monthly offline backup.
Capture the metadata. When you snap a receipt with your phone, include the date and vendor in the filename or as metadata. Three years from now, "IMG_4872.jpg" tells you nothing.
Document your retention and destruction policy in writing. A one-page policy that says "records of type X are retained for Y years and then deleted under a quarterly sweep" is what a court or auditor will look for. Without a written policy, ad-hoc destruction looks like spoliation.

What Triggers a Longer-Than-Expected Hold

Several events freeze your normal retention schedule and require you to keep records that you would otherwise be free to destroy:

Open IRS examination. Anything potentially relevant to the audit must be preserved until the audit closes and the assessment window expires.
Pending litigation or anticipation of litigation. Once litigation is "reasonably anticipated," your normal destruction routine must pause for any document that could be evidence — a duty known as the litigation hold. Destroying documents under a litigation hold is sanctionable, even if your retention policy would otherwise permit it.
Government investigation or subpoena. Same logic. Pause routine destruction the moment you receive a subpoena, civil investigative demand, or grand jury request.
Pending M&A transaction. A buyer's diligence team will want to see further back than you might normally retain. Prudent practice is to extend retention through the close of any deal in negotiation.
Insurance claim or pending dispute. Records relevant to an unresolved claim should be held until resolution plus the relevant limitations period.

If any of these are active, your retention schedule is overridden for any potentially responsive document. When in doubt, hold.

Build the Schedule Once, Then Forget About It

The whole point of a written retention schedule is that you make these judgment calls once — in a calm moment, with your accountant, with the relevant statutes in front of you — and then let your team execute it on autopilot. You do not want to be debating whether the 2018 vendor invoices can be deleted while the IRS is asking for them.

A workable rhythm for most small businesses:

Adopt a written retention policy that mirrors the schedule above, adjusted for your state and industry.
Build a digital folder structure that reflects the policy (one folder per year, sub-folders by category, with retention deadlines noted on the folder).
Run a quarterly sweep that archives or destroys anything past its retention deadline, with a destruction log.
Review the policy annually with your accountant and update it when laws change or your business adds new record types (a new line of business, a new state, a new payroll provider).

Done this way, retention stops being a recurring crisis and becomes a single annual maintenance task.

Keep the Books That Make the Retention Worth Doing

A retention schedule is only as useful as the records it preserves. If the underlying books are sloppy, no amount of careful archiving will rescue you from a serious audit — the documents will be there, but they will not tie to anything. The cheapest insurance you can buy is an accounting system that produces clean, traceable records from the first transaction onward.

Beancount.io is built on plain-text accounting: every transaction lives in a human-readable file, every entry is fully version-controlled in Git, and every piece of supporting documentation can be linked directly to the entry it supports. You get full transparency, no vendor lock-in, and a complete audit trail by default — exactly what you want when the IRS asks "how did you arrive at this number?" five years from now. Get started for free and build a record-keeping foundation that makes any future retention question easy to answer.