A document retention policy for CPA firms is a written schedule saying how long the firm keeps each kind of client record, such as source documents, filed returns, workpapers, engagement letters and payroll records, plus how it destroys them and who signs off. The periods come from IRS rules, Treasury regulations, state boards and contracts, not from habit.
This post describes what official sources say and offers a starting template. It is not legal advice. A firm should confirm its periods with its state board of accountancy, its professional liability carrier and, where needed, its own lawyer.
How long to keep client tax documents and copies of returns
How long to keep client tax documents depends on how long the return they support stays open. The IRS says to keep records until the period of limitations for that return runs out: three years in the usual case, longer in specific situations. Preparers have a separate rule for copies of returns they prepare.
What the IRS says about a taxpayer's records
The IRS page How long should I keep records? and IRS Publication 583 set out the periods:
- 3 years is the general period.
- 3 years from filing or 2 years from paying the tax, whichever is later, if a claim for credit or refund is filed after the return.
- 6 years if income that should have been reported was not, and it is more than 25% of the gross income shown on the return.
- 7 years if the return claims a loss from worthless securities or a bad debt deduction.
- Indefinitely if no return was filed or a fraudulent return was filed.
- At least 4 years for employment tax records, after the date the tax becomes due or is paid, whichever is later.
The IRS also says to keep copies of filed returns, and to check whether insurers, creditors or others need records kept longer before discarding them. Publication 583 adds that records about property should be kept until the period of limitations expires for the year the property is disposed of in a taxable disposition.
These periods describe the taxpayer's records. A firm holding copies of those records on the client's behalf often sets its own period to cover the longest one that could apply, because it rarely knows at filing time whether an exception will come up.
What the preparer must keep
Section 6107(b) of the Internal Revenue Code requires a tax return preparer, for the period ending 3 years after the close of the return period, to keep either a completed copy of each return or claim for refund it prepared, or a list with the name and taxpayer identification number of each taxpayer. That is a floor for copies of returns, not a ceiling.
Workpapers and engagement letters
No single federal period covers a CPA firm's own workpapers or engagement letters for tax engagements in the sources reviewed for this post. State boards of accountancy, peer review programs, professional liability carriers and client contracts may set periods, so the firm should check each one and use the longest.
Treasury Circular 230 does set one specific period: under section 10.29, written consents to a conflict of interest must be retained "for at least 36 months from the date of the conclusion of the representation of the affected clients."
Example retention schedule
The table pairs each record type with the official source and an example firm period. The example periods are illustrations only; choose your own after checking the sources and your state's rules.
| Record type | What official sources say | Example firm period |
|---|---|---|
| Client source documents (W-2s, 1099s, statements) | IRS: generally 3 years; 6 or 7 years or indefinitely in listed cases | Example: 7 years after filing |
| Copies of filed returns | IRC 6107(b): copy or list for 3 years after the close of the return period; IRS advises taxpayers to keep copies of filed returns | Example: permanently, or 10 years |
| Firm workpapers | No single federal period found; check state board, peer review, insurer | Example: 7 years after filing |
| Engagement letters | No single federal period found; check state board and insurer | Example: 7 years after the engagement ends |
| Conflict-of-interest consents | Circular 230 10.29: at least 36 months after the representation ends | Example: 7 years after the engagement ends |
| Payroll records (for payroll clients) | IRS: at least 4 years after the tax is due or paid, whichever is later | Example: 7 years |
What goes in a document retention policy for CPA firms?
A document retention policy for CPA firms needs seven sections: purpose and scope, the retention schedule, who owns the policy, how files are closed and dated, how records are destroyed, how holds override the schedule, and how the policy is reviewed. A one-page version is enough for a small firm, as long as each section is filled in.
- Purpose and scope. Which records the policy covers: client records the firm holds, the firm's own workpapers, paper and electronic copies, email attachments and backups.
- Retention schedule. The table of record types and periods, with the event that starts each clock, such as filing date or end of engagement.
- Owner. The person who runs the schedule each year and approves destruction. The IRS guide Publication 4557, Safeguarding Taxpayer Data suggests firms consider "designating or hiring a records retention manager to supervise the disposal of records containing customer information."
- Closing and dating files. When a file counts as closed and where its destruction date is recorded.
- Destruction. Methods for paper and electronic records, and the destruction log.
- Holds. What suspends destruction and who can lift a hold.
- Review. When the policy is checked against current rules.
The FTC Safeguards Rule bears on section 5. The FTC's guide FTC Safeguards Rule: What Your Business Needs to Know says to "securely dispose of customer information no later than two years after your most recent use of it to serve the customer," unless there is a legitimate business need or legal requirement to keep it, or targeted disposal is not feasible. The same guide lists tax preparation firms among the financial institutions the rule covers. The post on the FTC Safeguards Rule for tax preparers covers the rest of the rule.
The IRS guide Publication 5708, Creating a Written Information Security Plan suggests keeping the retention policy as an attachment to the firm's security plan, so that "If regulatory records retention standards change, you update the attached procedure, not the entire WISP."
A retention policy is one job within document management. The others, storage, search, versions and access, are described in what accounting document management covers in a CPA firm.
How should a CPA firm destroy documents at the end of retention?
A CPA firm should destroy paper records at the end of retention by cross-cut shredding, pulverizing or burning them, and destroy electronic records by deleting and overwriting them or destroying the media they sit on. A log records each destruction: client, record types, years, method, date and the person who did it.
Publication 4557's checklist suggests firms "burn, pulverize, or shred papers containing customer information so that the information cannot be read or reconstructed," and "destroy or erase data when disposing of computers, disks, CDs, magnetic tapes, hard drives, laptops, PDAs, cell phones, or any other electronic media or hardware containing customer information." It adds that a firm hiring an outside disposal company should check references or require certification by a recognized industry group first.
Publication 5708's sample policy says paper records "shall be securely destroyed by cross-cut shredding or incineration," and electronic records by deleting and overwriting the file directory, reformatting the drive, or destroying drives that have reached the end of their service life.
Electronic records are the hard part, because copies multiply. A client's 2019 file may exist in the main storage system, in email, in a backup and on a laptop. The policy should say which copies are destroyed and how backups age out.
A sample destruction log entry, with fictional values:
| Client | Records | Years | Method | Date | By |
|---|---|---|---|---|---|
| Ellison household | Source documents and workpapers | 2017, 2018 | Electronic: deleted and overwritten; paper: cross-cut shred | Jun 12 | Office manager |
Methods and vendors for destruction are covered in more depth in secure document destruction for accountants.
Edge cases: retention holds that make a CPA firm keep documents longer
A retention hold makes a CPA firm keep documents past their scheduled date. Common holds are an open IRS examination, a pending or threatened lawsuit, a client's records request, a year still open because of an exception to the usual three-year period, and a contract term requiring longer storage. A hold suspends destruction until the owner lifts it.
Open examinations. If a client's return is under examination, keep everything for that year and any related years until the matter closes.
Litigation. If the firm or a client is in a dispute, or one seems likely, keep every related record. Ask a lawyer when the hold can end.
Longer IRS periods. A client with unreported income above the 25% threshold, a worthless securities loss or an unfiled year falls under the longer periods listed earlier in this post. Keep that client's records for the longer period.
Property records. Records showing the basis of property a client still owns stay relevant until the year the property is sold, plus the period of limitations for that year.
Records requests. Circular 230 section 10.28 says a practitioner must, at a client's request, promptly return client records needed for the client's federal tax obligations, and may keep copies. The AICPA's Journal of Accountancy reported in 2021 that the revised AICPA records-request interpretation does not let a member withhold client-provided records on a client's initial request over unpaid fees. Do not destroy records a client has asked for.
Record each hold in the client's file with the date, the reason and who placed it.
A document retention policy template for CPA firms
A document retention policy template for CPA firms gives a starting text to adapt: fill in the periods after checking the sources above and your state's rules, name the owner, and have a partner sign it. The template below is a sample, not legal advice, and the bracketed values are placeholders.
[Firm name] Document Retention Policy
1. Purpose and scope. This policy covers client records and firm workpapers held by [Firm name] in paper or electronic form, including email attachments, client uploads and backups.
2. Retention schedule. The firm keeps records for the periods below, measured from the event stated. Where a longer period applies under law, contract or a hold, the longer period governs.
- Client source documents: [__] years after the return is filed.
- Copies of filed returns: [__] years after filing, and never less than the period required by IRC 6107(b).
- Workpapers: [__] years after the return is filed.
- Engagement letters and conflict consents: [__] years after the engagement ends, and consents never less than 36 months.
- Payroll records held for clients: [__] years after the tax is due or paid.
3. Owner. [Name, role] owns this policy, runs the schedule each [month], and approves every destruction.
4. Closing files. A file is closed when [the return is filed and fees are settled]. The owner records each closed file's destruction date in [system or log].
5. Destruction. Paper is destroyed by [cross-cut shredding or incineration]. Electronic records are destroyed by [deleting and overwriting, or destroying the media], including copies in email and backups. Each destruction is logged.
6. Holds. Destruction stops for any record under an IRS examination, dispute, client records request or contract term. Only the owner, with a partner's approval, can lift a hold.
7. Review. The owner reviews this policy every [year] and when rules change.
Approved by [partner name], [date].
Keep the signed policy where staff can find it, and attach it to the firm's written information security plan.
Retention is easier when files are already in a consistent layout. The posts on how to organize client tax documents and how to organize client documents cover the folder structure that makes destruction dates easy to apply by client and year.
Schema CPA is not a records system and does not run a retention schedule. It reads what clients send and sorts it by document type, issuer and period before the firm files it, which makes each record's year plain when the schedule comes due. The plans for firms are on the homepage.