Document Retention Policy for Accounting Firms: How Long to Keep Client Records
How long accounting firms should keep client documents, based on IRS periods of limitations, e-file rules and data security requirements, plus a sample retention schedule and secure disposal process.
Quick answer: The IRS says taxpayers should generally keep records that support items on a return until the period of limitations for that return runs out: usually 3 years, but 6 years if more than 25% of gross income was left off, 7 years for worthless securities or bad debt claims, and indefinitely for unfiled or fraudulent returns. Employment tax records should be kept at least 4 years. Accounting firms add their own requirements on top, such as keeping Form 8879 for 3 years from the due date or IRS received date, whichever is later, and must balance retention against the security obligation to dispose of data they no longer need.
Key takeaways
- Retention periods are driven mainly by IRS periods of limitations, which start after a return is filed.
- Property and basis records must be kept until the limitations period expires for the year the property is sold.
- Firms need a written policy covering both client records and the firm's own compliance documents.
- Keeping everything forever isn't safe either: every stored record is data that can be breached.
- Secure, documented disposal is part of a firm's written information security plan.
IRS retention periods at a glance
| Situation | Keep records for |
|---|---|
| Most income tax returns | 3 years after filing |
| Claim for credit or refund | 3 years from filing or 2 years from paying the tax, whichever is later |
| Unreported income over 25% of gross income shown on the return | 6 years |
| Claim for a loss from worthless securities or a bad debt deduction | 7 years |
| No return filed, or a fraudulent return | Indefinitely |
| Employment tax records | At least 4 years after the tax is due or paid, whichever is later |
| Property records | Until the limitations period expires for the year the property is disposed of |
Source: IRS, How long should I keep records? The IRS also notes that records may need to be kept longer for non-tax reasons, such as insurance or lender requirements.
Why property and basis records are different
Records showing what a client paid for a home, rental property, investment or business asset matter when the asset is sold, which might be decades later. The IRS says to keep property records until the period of limitations expires for the year the property is disposed of. When property is exchanged for other property, records for the old property must be kept until the limitations period expires for the year the new property is sold.
For firms, this means some client records, such as depreciation schedules and basis calculations, effectively need to be kept for the life of the asset plus several years.
Records your firm must keep for its own compliance
- Copies of returns or a client list: IRC section 6107(b) requires paid preparers to keep a copy of each return they prepare, or a list of taxpayers' names and TINs, for 3 years after the close of the return period.
- Form 8879 and Form 8878: 3 years from the return due date or IRS received date, whichever is later, per IRS Publication 1345.
- Section 7216 consents: keep with the client file. See our guide to engagement letters and 7216 consent.
- Engagement letters: commonly kept for the life of the engagement plus the limitations period for the last return prepared.
- IRS authorizations: copies of Forms 2848 and 8821, and records of revocations. See Form 8821 vs Form 2848.
- Security documentation: your WISP, risk assessments, training records and incident reports.
A sample retention schedule
| Record type | Suggested retention |
|---|---|
| Copies of filed returns | Permanently, or at least 7 years |
| Client source documents (W-2s, 1099s, receipts) | 7 years after filing, unless a longer period applies |
| Workpapers | 7 years after filing |
| Form 8879 / 8878 | At least 3 years from due date or received date, whichever is later |
| Depreciation and basis records | Life of the asset plus 7 years |
| Payroll and employment tax records | At least 4 years after the tax is due or paid |
| Engagement letters and consents | Life of engagement plus 7 years |
Many firms use 7 years as a default for tax records because it covers most of the IRS limitations periods in one rule. Check state requirements, professional standards and your liability insurer's guidance before finalizing your own schedule.
Bookkeeping client records
Bookkeeping firms hold a different mix of records: monthly bank and card statements, receipts, payroll reports and the general ledger itself. These support the client's tax returns, so the same IRS periods of limitations generally apply. Payroll records follow the employment tax rule of at least 4 years. Many bookkeeping firms also clarify in the engagement letter that the client owns the books and source documents, and how long the firm keeps its own copies after the engagement ends. See bookkeeping client onboarding and which payroll reports to collect.
Don't keep everything forever
It's tempting to keep every file indefinitely just in case. But every record you hold is sensitive data you must protect. The FTC Safeguards Rule requires covered firms, including tax preparers, to securely dispose of customer information no later than two years after it was last used to serve the customer, unless it's needed for a legitimate business purpose, required by law, or can't feasibly be disposed of in a targeted way. Record the reason for any longer retention period in your schedule. A clear schedule protects clients and limits what's exposed if your firm is ever breached.
How to dispose of records securely
- Paper: cross-cut shredding, or a certified shredding service that provides a certificate of destruction.
- Digital files: delete from primary storage, backups, email and synced devices. Records hiding in old email threads are the most commonly missed.
- Old hardware: wipe or physically destroy drives before disposing of computers, phones and copiers.
- Logging: record what was destroyed, when and by whom.
Where retention gets messy: email
A firm can have a perfect retention schedule for its document management system and still hold years of client W-2s and bank statements in staff inboxes. When documents arrive as email attachments, they get copied into sent folders, synced devices and backups, making them almost impossible to track or delete on schedule. Collecting documents through one secure channel keeps them in one place where your retention policy can actually be applied. Our guide on sending tax documents securely covers the options, and Correctdocs gives clients one secure place to upload every document you request.
Correctdocs is in early access. The first 10 US accounting, bookkeeping and tax firms get a free 30-day pilot on real client requests. Request early access.
Frequently asked questions
How long should an accounting firm keep client tax records?
The IRS's general rule for taxpayers is 3 years after filing, with longer periods in specific situations. Many firms keep client records for 7 years to cover most cases, and keep returns and basis records longer.
How long must Form 8879 be kept?
Three years from the return due date or the date the IRS received the return, whichever is later.
How long should payroll records be kept?
The IRS says employment tax records should be kept for at least 4 years after the tax becomes due or is paid, whichever is later.
Should records be kept longer for non-tax reasons?
Sometimes. Insurers, lenders and state rules may require longer retention, so check those before disposing of records.
Sources
- IRS, How long should I keep records?
- IRS, IRM 3.42.5, IRS e-file of Individual Income Tax Returns
- FTC, FTC Safeguards Rule: What Your Business Needs to Know
General information only, not legal advice.