How Long to Keep Corporate Tax and Audit Records
Most retention policies get written once, filed away, and never actually followed, which means when a document is needed years later, whether it exists depends on luck rather than policy. The retention question isn't really how long to keep things; it's building a system where the policy and the reality of what's actually on hand match.
The standard lookback period tax authorities use isn't the only clock running, and several categories of records need to survive well past that window.
Vendors Covered in this Article
Disclosure: We may earn a commission if you buy through some links on this page. It doesn't change what we recommend.
The Statute of Limitations Isn't the Only Clock
The IRS generally has three years from the filing date to examine a return, six years if you omit more than 25 percent of the gross income shown on the return, and no time limit at all if a return was never filed or was fraudulent. That's the floor, not the ceiling, for how long to keep supporting records. Records tied to an asset's basis, equipment, property, an ownership stake, need to survive until well after that asset is disposed of, since the basis calculation on a sale years from now depends on records from the year of purchase.
A Practical Retention Schedule by Category
Different document types genuinely need different retention periods.
- Filed tax returns and supporting workpapers: keep permanently, or at minimum well beyond the standard examination window
- Records supporting an asset's basis (purchase documents, capital improvements): keep until well after the asset is sold or fully depreciated
- Payroll tax records and Forms W-2/1099: keep for several years past the filing, longer if a worker classification dispute is possible
- Corporate formation documents, bylaws, and equity records: keep permanently
- Board minutes and major corporate resolutions: keep permanently
Why Deleting on Schedule Matters as Much as Keeping
A retention policy isn't only about keeping records long enough; it's also about actually deleting or archiving records once their retention period passes, on a documented schedule rather than an indefinite hoard. An indefinite retention habit for everything can actually create risk in litigation or a broad document request, since more records existing means more records that could contain something unhelpful. A written, consistently applied schedule that's actually followed protects you better than either extreme: losing things too early or keeping everything forever.
Where the Actual Gap Usually Is
The failure mode isn't usually a policy that's too short on paper; it's records that were supposed to be kept but got lost anyway, a departed employee's laptop, a closed vendor's portal, an acquired subsidiary's records that never made it into the parent's system. Building retention around actual, centralized storage that survives personnel and system changes matters more than the specific number of years written in the policy document, since a policy that says seven years means nothing if the records were only ever on one person's hard drive.
Special Categories That Need Longer Retention
Net operating loss carryforwards, tax credit carryforwards, and any position you're still relying on in a current year's return need their original supporting records kept until that carryforward is fully used and its own examination window closes, which can mean keeping records for a decade or more after the year they were originally generated. The same logic applies to records supporting any legal settlement, ongoing litigation, or a transaction still generating tax consequences in later years; tie retention to when the position stops mattering, not to a flat number of years from creation.
Building an Actual Enforcement Habit, Not Just a Policy Document
A retention schedule only works if something on your calendar actually triggers a review, so tie it to an event that already happens every year rather than hoping someone remembers. Pair an annual records review with your year-end close or your annual board meeting, checking what's aged past its retention period and can be archived or destroyed, and confirming that anything tied to a still-open carryforward or ongoing matter is flagged to stay put. Treat the review itself as a recurring line item with an owner, the same way you'd treat a recurring compliance filing, rather than a one-time project that quietly stops happening after the first year.
What Good Looks Like
A good records retention program ties each document category's retention period to when the underlying tax position actually stops mattering, stores records centrally rather than on individual devices, and actually purges records on schedule rather than keeping everything indefinitely.
Building The Capability (5-Stage Skill Ladder)
How to Get Started
Disclosure: We may earn a commission if you buy through some links on this page. It doesn't change what we recommend.
Use it to centralize retention evidence for compliance-related records so a specific document's retention status is verifiable rather than assumed.
Use it if you're already tracking broader compliance controls and want document retention schedules and actual retrieval evidence in the same system.
Frequently Asked Questions
Do we really need to keep tax returns forever?
Keeping the returns themselves permanently is the safer, common practice, since they're small in volume and establish your filing history. The bigger retention question is usually the supporting workpapers and records behind them, which take up more space and are more often accidentally discarded early.
What's the biggest gap companies actually have in records retention?
It's rarely the written policy itself; it's records that exist only on an individual's device, in a departed vendor's system, or in an acquired company's files that never got integrated into centralized storage. A policy is only as good as the retrieval system behind it.
Should we keep records indefinitely just to be safe?
Not necessarily. Keeping everything forever can create its own risk in litigation or broad document requests, since more records existing means more that could be unhelpful. A documented, consistently followed schedule tailored to each record type is usually better than an indefinite blanket policy.
About the numbers
This guide doesn't quote a sourced benchmark. Figures in it are estimates or general guidance, so check them against your own numbers.
Related Guides
Preparing for an IRS ERC Examination
What the IRS actually asks for when it examines an Employee Retention Credit claim, and the documentation gap that trips up most companies that claimed it.
Employee Spend Policy: What to Write and How to Set Limits
Write an employee spend policy that covers cards, reimbursements, approval limits, travel and receipts, with sample structure and the mistakes to avoid.
Corporate Card Policy: What to Put in It and How to Enforce It
Write a corporate card policy that covers who gets cards, spending limits, receipts, software subscriptions and offboarding, with clauses you can adapt.
409A Valuation Methods: Market, Income, or Backsolve?
Compare market, income and backsolve approaches to a 409A valuation, which one fits your stage, and what protects the safe harbor if it's questioned.
FloQast vs. AuditBoard for Federal and Defense Contractors
Indirect rate pools, timekeeping controls, and DCAA-style expectations make a federal contractor's close unlike almost any other. Compare here.
What to Expect From a California FTB Audit
How a California Franchise Tax Board audit differs from an IRS audit, what triggers one, and the specific records the FTB tends to ask for first.