Audit Readiness, Corporate Tax Strategy & Fiduciary GovernancePlaybook3 min readUpdated September 2026

How Long to Keep Corporate Tax and Audit Records

Most retention policies get written once, filed away, and never actually followed, which means when a document is needed years later, whether it exists depends on luck rather than policy. The retention question isn't really how long to keep things; it's building a system where the policy and the reality of what's actually on hand match.

The standard lookback period tax authorities use isn't the only clock running, and several categories of records need to survive well past that window.

Vendors Covered in this Article

Disclosure: We may earn a commission if you buy through some links on this page. It doesn't change what we recommend.

The Statute of Limitations Isn't the Only Clock

The IRS generally has three years from the filing date to examine a return, six years if you omit more than 25 percent of the gross income shown on the return, and no time limit at all if a return was never filed or was fraudulent. That's the floor, not the ceiling, for how long to keep supporting records. Records tied to an asset's basis, equipment, property, an ownership stake, need to survive until well after that asset is disposed of, since the basis calculation on a sale years from now depends on records from the year of purchase.

A Practical Retention Schedule by Category

Different document types genuinely need different retention periods.

  • Filed tax returns and supporting workpapers: keep permanently, or at minimum well beyond the standard examination window
  • Records supporting an asset's basis (purchase documents, capital improvements): keep until well after the asset is sold or fully depreciated
  • Payroll tax records and Forms W-2/1099: keep for several years past the filing, longer if a worker classification dispute is possible
  • Corporate formation documents, bylaws, and equity records: keep permanently
  • Board minutes and major corporate resolutions: keep permanently

Why Deleting on Schedule Matters as Much as Keeping

A retention policy isn't only about keeping records long enough; it's also about actually deleting or archiving records once their retention period passes, on a documented schedule rather than an indefinite hoard. An indefinite retention habit for everything can actually create risk in litigation or a broad document request, since more records existing means more records that could contain something unhelpful. A written, consistently applied schedule that's actually followed protects you better than either extreme: losing things too early or keeping everything forever.

Where the Actual Gap Usually Is

The failure mode isn't usually a policy that's too short on paper; it's records that were supposed to be kept but got lost anyway, a departed employee's laptop, a closed vendor's portal, an acquired subsidiary's records that never made it into the parent's system. Building retention around actual, centralized storage that survives personnel and system changes matters more than the specific number of years written in the policy document, since a policy that says seven years means nothing if the records were only ever on one person's hard drive.

Special Categories That Need Longer Retention

Net operating loss carryforwards, tax credit carryforwards, and any position you're still relying on in a current year's return need their original supporting records kept until that carryforward is fully used and its own examination window closes, which can mean keeping records for a decade or more after the year they were originally generated. The same logic applies to records supporting any legal settlement, ongoing litigation, or a transaction still generating tax consequences in later years; tie retention to when the position stops mattering, not to a flat number of years from creation.

Building an Actual Enforcement Habit, Not Just a Policy Document

A retention schedule only works if something on your calendar actually triggers a review, so tie it to an event that already happens every year rather than hoping someone remembers. Pair an annual records review with your year-end close or your annual board meeting, checking what's aged past its retention period and can be archived or destroyed, and confirming that anything tied to a still-open carryforward or ongoing matter is flagged to stay put. Treat the review itself as a recurring line item with an owner, the same way you'd treat a recurring compliance filing, rather than a one-time project that quietly stops happening after the first year.

Executive Capability Standard

What Good Looks Like

A good records retention program ties each document category's retention period to when the underlying tax position actually stops mattering, stores records centrally rather than on individual devices, and actually purges records on schedule rather than keeping everything indefinitely.

Building The Capability (5-Stage Skill Ladder)

1. Learn:Inventory where your key tax and audit records currently live, and check whether any depend on an individual's device or a vendor relationship that could disappear.
2. Do Manually:Write a retention schedule by document category, tied to when each category's underlying tax position actually closes out, not a flat number of years.
3. Delegate:Assign one person to own moving records into centralized storage as part of offboarding any departing employee or closing out any vendor relationship.
4. Automate:Use document management or e-signature platforms like Foxit eSign to centralize and timestamp records automatically as they're created, rather than relying on manual filing.
5. Buy:Bring in a records management consultant if you're carrying legacy paper records or records scattered across multiple acquired entities' old systems.

How to Get Started

Disclosure: We may earn a commission if you buy through some links on this page. It doesn't change what we recommend.

Frequently Asked Questions

Do we really need to keep tax returns forever?

Keeping the returns themselves permanently is the safer, common practice, since they're small in volume and establish your filing history. The bigger retention question is usually the supporting workpapers and records behind them, which take up more space and are more often accidentally discarded early.

What's the biggest gap companies actually have in records retention?

It's rarely the written policy itself; it's records that exist only on an individual's device, in a departed vendor's system, or in an acquired company's files that never got integrated into centralized storage. A policy is only as good as the retrieval system behind it.

Should we keep records indefinitely just to be safe?

Not necessarily. Keeping everything forever can create its own risk in litigation or broad document requests, since more records existing means more that could be unhelpful. A documented, consistently followed schedule tailored to each record type is usually better than an indefinite blanket policy.

About the numbers

This guide doesn't quote a sourced benchmark. Figures in it are estimates or general guidance, so check them against your own numbers.

Related Guides