The short answer
Records and documents covers the papers and files your business must keep, where you store them and when you get rid of them. Good records protect you in a tax audit, a lawsuit or an insurance claim, and they make the business easier to run and easier to sell.
Key Points
The three things to take away.
- 1
List required records
Make a list of every record type your business creates or receives. Common ones include tax returns, receipts, bank statements, payroll records, W-4 and I-9 forms, 1099-NEC copies, contracts, licenses, permits, insurance policies, certificates of insurance, warranties and job files.
For each type, note who is in charge of it and where it lives. IRS Publication 583 explains basic business recordkeeping and is a good starting point. Your state may require more, such as sales tax or licensing records, so ask your accountant what applies to you.
- List every record type you create or receive
- Assign an owner to each record type
- Read IRS Publication 583 on recordkeeping
- Ask your accountant about state requirements
- 2
Set retention periods
Write down how long you keep each record type, then follow it. The IRS gives guidance on how long to keep tax records, and the time varies by situation. Payroll records and I-9 forms have their own rules, and contracts or warranty files may need to outlast the work.
Put the periods in a simple table with the record type, how long to keep it and the reason. Have your accountant and attorney review it once. When a rule is unclear, keep the record longer rather than shorter.
- Build a table of record types and keep periods
- Use IRS guidance for tax records
- Have your accountant and attorney review it
- Keep records longer when a rule is unclear
- 3
Store and protect records
Store records in one main place with a clear folder system, and back up anything digital. A cloud drive such as Google Drive or OneDrive with folders by year and record type works for most small businesses. Scan paper receipts and contracts so you have a copy if the original is lost.
Limit who can open sensitive files like payroll, tax IDs and customer payment details. Turn on two-step login for every account that holds records. Keep any paper originals you must hold in a locked, fire‑resistant cabinet.
- Pick one main cloud drive for records
- Scan paper receipts and contracts
- Restrict access to payroll and tax files
- Turn on two-step login for every account
- 4
Keep shared files tidy
Set simple naming rules so anyone can find a file in seconds. A pattern like year, customer or vendor, then document type works well. Use the same folder layout for every year and every job.
Put one person in charge of cleaning up shared folders each month. Move stray downloads into the right folder, delete duplicates and remove access for people who have left. A tidy drive saves time every day and makes an audit or a sale far less stressful.
- Write a file naming rule and share it
- Use the same folder layout every year
- Clean shared folders once a month
- Remove access when someone leaves
- 5
Use a legal hold
Stop destroying any record that could relate to a lawsuit, claim, audit or government inquiry as soon as you know one is coming. This is called a legal hold, and it overrides your normal retention schedule.
Write a short note listing what is on hold and tell everyone who handles those records, including email and text messages. Pause any automatic deletion settings that touch them. Keep the hold in place until your attorney says it can end. Destroying records under a hold can cause serious legal trouble.
- Pause deletion when a claim or audit is likely
- List the records on hold in writing
- Turn off auto-delete for held records
- Lift the hold only when your attorney agrees
- 6
Destroy records safely
Destroy records once their retention period ends and no legal hold applies. Shred paper that holds names, tax IDs, bank details or health information. Use a shredding service for large batches and keep the certificate they give you.
For digital files, delete them from the drive and the trash, and wipe or physically destroy old hard drives and phones before you sell or toss them. Keep a short log of what you destroyed and when. Some states have data disposal laws, so check yours.
- Check the retention table before destroying
- Shred paper with personal or financial data
- Wipe old drives and phones before disposal
- Log what was destroyed and when
Mistakes to avoid
- Keeping receipts in a shoebox with no backup copy.
- Deleting emails or files after hearing a customer plans to sue.
- Throwing out old computers without wiping the drives first.
Common questions
How long should a small business keep tax records?
It depends on the record and your situation. The IRS publishes guidance on retention periods, and some records need to be kept longer than others. Ask your accountant to set a schedule for your business.
Can I keep scanned copies instead of paper receipts?
In many cases the IRS accepts clear electronic copies if they are complete and readable. Some documents may still need originals. Check with your accountant before you shred paper you might need.
What is a legal hold?
A legal hold is a pause on destroying records that could matter in a lawsuit, audit or investigation. It overrides your normal schedule. Your attorney tells you when it can end.
What is the safest way to get rid of old customer files?
Shred paper files that hold personal or financial details, or use a shredding service and keep the certificate. Delete digital files fully and wipe old devices. Some states have disposal laws, so check yours.
General information only, not legal, tax or financial advice. See the Disclaimer.