What Business Records Should I Keep, and How Long Should I Keep Them?

What business records should a small business keep?

Keep records that prove:

• What the business earned and spent
• What it owns and owes
• What it agreed to do
• What employees were paid and promised
• What taxes, licenses, and insurance obligations apply
• How important transactions and decisions were approved

Some periods below are federal legal minimums. Others are Owner Advisor recommended practices designed to preserve useful evidence after the minimum tax or payroll period has passed. State laws, contracts, insurance policies, benefit plans, licenses, grants, and industry rules may require longer retention.

Quick federal retention baselines

Longer federal, state, contractual, insurance, or industry requirements may apply. Confirm the applicable requirement before destroying records.

Federal wage-and-hour rules generally require covered employers to retain payroll records for at least three years and the records used to calculate wages for at least two years.

Employment records can be subject to several different federal and state rules. Do not treat one general personnel-record period as covering payroll, benefits, immigration, leave, safety, discrimination, or active claims.

Official references: IRS, How long should I keep records? — https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records; U.S. Department of Labor, Fact Sheet #21 — https://www.dol.gov/agencies/whd/fact-sheets/21-flsa-recordkeeping?lang=en

Recommended business retention practices

The periods below are practical Owner Advisor recommendations based on common business practice, not universal statutory requirements.

These insurance rows are intentionally conservative. Businesses whose work can produce claims years later should keep final policies, endorsements, certificates, claim records, and settlement documents permanently. Supporting correspondence and routine audit records can be reviewed after about ten years, but only after confirming that no active claim, completed-operations exposure, contract requirement, policy requirement, or insurer instruction requires longer retention.

Which records belong in the permanent company file?

Keep records that define the company and its ownership permanently.

These may include articles of incorporation or organization; bylaws or operating agreements; stock or membership records; major owner resolutions; merger, acquisition, or sale documents; EIN confirmation; amendments to governing documents; and major licenses and permits.

A contractor adding a partner, refinancing equipment, or later selling the company may need old ownership approvals to prove who had authority to make earlier decisions.

What belongs in a complete contract or job file?

A complete file should preserve the evidence needed to explain what was promised, what changed, what was delivered, and what was paid.

It may include proposals and estimates; signed agreements; plans and specifications; change orders; customer selections and approvals; schedules; inspection records; photographs; invoices and payment records; completion documents; warranty information; important emails and texts; and dispute or termination notices.

For a roofer, photographs of the deck, underlayment, flashing, and finished installation may matter years later. For an HVAC company, equipment serial numbers, startup readings, permits, customer approvals, and service history may help establish what was installed and when. For a professional-service firm, scope approvals and records of out-of-scope requests may explain why fees or deadlines changed.

Which employee records need special handling?

Employee records often contain payroll, wage, benefits, leave, performance, discipline, safety, and separation information.

Keep medical, accommodation, investigation, and other highly sensitive information separately with limited access where appropriate.

If an employee complaint, agency charge, investigation, or lawsuit is filed, preserve the affected employee's records, comparable employee records, relevant policies, communications, and decision documents until the matter and any appeals are fully resolved.

When should routine destruction stop?

Stop destroying related records when the business reasonably expects a lawsuit or legal claim; a tax audit; an employee complaint; an insurance claim; a contract or payment dispute; a regulatory request; lender or investor due diligence; or a business sale.

This applies to paper files, emails, texts, cloud storage, accounting systems, photographs, and employee devices used for business.

Once a dispute or investigation is reasonably foreseeable, the ordinary retention schedule should no longer control those records.

Do electronic records count?

Records generally do not need to remain on paper simply because they began on paper, but the electronic version must be complete, readable, retrievable, secure, and backed up.

A usable digital file should preserve the entire document; signature pages; attachments and exhibits; dates and approvals; necessary audit history; access controls; and reliable backups.

A scan that omits the back of a form, an exhibit, or a signature page is not a complete record.

Do not scatter critical records across personal phones, email accounts, filing cabinets, and software systems without a reliable way to retrieve them.

How should records be destroyed?

Before destroying records, confirm that the retention period has expired; no legal, tax, insurance, contract, or licensing requirement extends it; no dispute, claim, audit, or investigation is expected; and no permanent summary or final document is still needed.

Then shred sensitive paper; securely delete electronic files; remove unnecessary shared-drive copies; address backup copies under the company's deletion process; and record what was destroyed, when, and under which policy.

Payroll, tax, banking, employee, and customer information should not go into ordinary trash.

What should you do next?

Create a records inventory with record category, examples, legal minimum if known, company retention period, storage location, responsible person, event that starts the period, exception or hold status, and destruction method.

Start with the categories carrying the greatest risk: taxes, payroll, ownership, major contracts, insurance, employee matters, and active disputes.

Professional note

The federal periods in this guide are baselines, not a complete retention policy. Before destroying records tied to a legal claim, employee matter, tax issue, major contract, insurance exposure, regulated work, or business sale, confirm the applicable period with the appropriate CPA, attorney, insurer, regulator, or plan administrator. Longer federal, state, contractual, insurance, industry, audit, claim, dispute, investigation, litigation, or other requirements may apply.

Related Business Guides

• What Should a Small-Business Contract Include?
• When Does My Small Business Need a Bookkeeper, CPA, Attorney, or Other Professional?
• What financial reports should I review each month?
• How do I read and use a balance sheet for my small business?