CPA Record Retention Requirements for Tax Practitioners

CPA record retention requirements run from three years for basic preparer copies, payroll files, and e-file authorizations up to seven years for tax engagement workpapers and PCAOB audit documentation, with employee benefit plan records at six years, non-issuer audit files at five, and destruction certificates kept permanently. The rules come from overlapping sources — federal tax law, PCAOB and AICPA auditing standards, ERISA, state boards of accountancy, and federal data security regulations — and where they overlap on the same document, the longest period wins. Getting it wrong exposes a firm to civil fines, criminal prosecution under Sarbanes-Oxley, and license revocation.

Tax Engagement Records

Why Seven Years Is the Working Minimum

The IRS generally has three years from the later of the due date (including extensions) or the filing date to assess additional tax. That window stretches to six years if the taxpayer reported 25% or less of their gross income, and there is no limitation period at all for fraudulent or unfiled returns.¹

Because the six-year extended window can surface long after a return is filed, most firms adopt a seven-year minimum for tax engagement files. That covers the longest non-fraud assessment period plus a buffer. A shorter period is a bet that every client reported all their income correctly, and it also leaves you without the workpapers you need to defend a preparer penalty under IRC 6694 if the return is later challenged.²

The Three-Year Preparer Copy Rule

Separately from the assessment statute, federal law requires every tax return preparer to either retain a completed copy of each return or maintain a list of taxpayer names and identification numbers. The obligation runs for three years after the close of the return period, and the copy must be available for IRS inspection.³ Most firms keep the full return rather than maintain a separate list.

Form 8879 E-File Authorizations

Firms that file returns electronically must keep each signed Form 8879 in a secure, tamper-proof system for three years from the return’s due date or the IRS received date, whichever is later.⁴ A missing 8879 can disqualify the firm’s e-file privileges, so this needs a systematic process during tax season, not an ad hoc one.

Basis Records

Records supporting the cost basis of assets sit outside the ordinary schedule. The IRS instructs taxpayers to keep property records until the statute of limitations expires for the year the property is sold or otherwise disposed of.⁵ In practice, that means holding purchase documents, improvement records, and depreciation schedules for the entire ownership period plus three to six years after the disposal year’s return is filed. Property received in a tax-free exchange carries over the original basis, so the original records must survive until the replacement property is finally sold. Losses from worthless securities or bad debts require seven years of supporting records.⁶

Section 7216 Consent Forms

IRC Section 7216 prohibits any preparer from knowingly or recklessly disclosing or using a taxpayer’s return information for any purpose beyond preparing that return.⁷ Sharing data with an affiliated entity, using it to market other services, or passing it to a subcontractor for processing all require the taxpayer’s prior written consent, which must be knowing and voluntary and cannot be a condition of service.⁸ Retain signed consents for the duration of the engagement relationship and a reasonable period afterward, because you may need to produce them to demonstrate compliance.

Penalties operate on two tracks. Criminal conviction can bring a fine of up to $1,000 per violation, up to $100,000 for aggravated disclosures, plus up to one year of imprisonment.⁷ The civil penalty under IRC 6713 is $250 per unauthorized disclosure or use, capped at $10,000 per calendar year.⁹

Returning Client Records

Circular 230 imposes a separate obligation that sits alongside retention: when a client asks for their records back, you must promptly hand over everything they need to meet their federal tax obligations.¹⁰ You can keep copies, but the originals belong to the client, and a fee dispute doesn’t change that. The narrow exception is where state law permits holding records during a fee dispute, and even then the client must be allowed to review and copy the retained records. The internal workpapers you create to support the return are generally the firm’s property.

Audit and Attestation Documentation

PCAOB: Seven Years From Report Release

Audits of publicly traded companies carry the most demanding schedule. Under Auditing Standard 1215, audit documentation must be retained for at least seven years from the report release date. If no report is ever issued, the seven-year clock starts from the date fieldwork was substantially completed. The seven-year floor comes directly from Section 103 of Sarbanes-Oxley.¹¹

After the report release date, the engagement team has 45 calendar days to assemble and lock down the final file.¹¹ Once that completion date passes, nothing in the file may be deleted or discarded. Additions made afterward must include the date and the reason for the late entry.

AICPA: Five Years for Non-Issuers

Audits of private companies and other non-issuers follow AU-C Section 230. The retention period is no less than five years from the report release date, and the documentation completion window is 60 days rather than 45. The same prohibition on post-lock deletion applies, and additions must be dated and explained.

Both standards treat management representation letters, engagement quality review documentation, and communications with those charged with governance as part of the audit evidence, so they follow the same schedule as the rest of the file.

Sarbanes-Oxley Criminal Backstop

18 U.S.C. § 1520 requires any accountant who audits a public company to maintain all audit and review workpapers for at least five years from the end of the fiscal period in which the engagement concluded. A knowing and willful violation carries a fine and up to 10 years in prison.¹² A broader provision, 18 U.S.C. § 1519, reaches anyone who destroys, alters, or falsifies any record with intent to obstruct a federal investigation, with a maximum of 20 years.¹³ Once you have any reason to suspect a federal investigation is possible, destroying records is a separate federal crime.

Employee Benefit Plan Records

Firms that audit or certify information for employee benefit plans face an ERISA mandate. Under Section 107, anyone required to file reports about a benefit plan must retain the underlying records for at least six years after the filing date. The records must include enough detail to verify, explain, and check the filed documents, including worksheets, receipts, and supporting resolutions.¹⁴ Plans that qualify for a filing exemption still must retain records for six years from when the filing would have been due.

State Licensing and Peer Review

CPE Documentation

Every state board conditions license renewal on continuing education, and every board requires proof of hours. Most states mandate at least five years of retention for CPE documentation, which lines up with the audit cycle boards use when randomly selecting licensees. Documentation includes completion certificates, course descriptions, and attendance records. A licensee who cannot produce proof when selected for audit risks suspension until the deficiency is cured. Verify your state board’s specific requirement, because periods and formats vary.

Peer Review

Firms performing audits, reviews, or compilations undergo periodic peer review as a condition of their state firm permit. Under the AICPA’s Peer Review Program, working papers, reports, and letters generated during the review should be retained for at least 120 days after the administering entity issues its acceptance letter.¹⁵ The underlying engagement workpapers the reviewer examined follow their own longer schedules.

Malpractice and Firm Registration

Records related to firm registration, permits to practice, and ownership changes should be retained for the life of the firm and a reasonable period after dissolution. The professional malpractice window matters too: depending on the jurisdiction and whether the claim sounds in negligence or contract, limitation periods generally run three to six years from when the error was discovered or should have been discovered. Engagement letters and confidentiality agreements should survive at least that long, because they define the scope of the engagement and can decide a malpractice case.

The Firm’s Own Employment Records

A CPA firm is also an employer, and federal employment law adds retention rules that have nothing to do with client work.

Payroll records under the Fair Labor Standards Act must be preserved for at least three years from the last entry. Basic time records, like daily start and stop times, must be kept for two years.¹⁶
Form I-9 must be retained for three years after the date of hire or one year after employment ends, whichever is later.¹⁷
Personnel and employment records under Title VII and the ADEA must be retained for one year from the date an employee separates, and longer if a discrimination charge has been filed.

These obligations apply regardless of what services the firm provides, and they frequently get missed in policies focused only on client engagement files.

Litigation Holds Override the Schedule

A litigation hold suspends your normal destruction schedule the moment you reasonably anticipate legal action. Trigger events include a demand letter, threat of suit, subpoena, notice of a regulatory investigation, or credible internal information that a dispute is heading toward litigation. Once triggered, destruction of any potentially relevant record stops immediately.

Courts treat destruction after a hold should have been in place as spoliation. Common sanctions include an adverse inference instruction — telling the jury to assume the destroyed material would have been unfavorable — as well as preclusion of evidence, dismissal, or default judgment. For a firm defending professional negligence claims, that instruction is close to fatal.

A written protocol should identify who can trigger a hold, how it is communicated to every custodian of relevant records, and how compliance is monitored. The hold covers both physical and electronic records, including email, text messages, and cloud-stored files.

Secure Storage and Compliant Destruction

FTC Safeguards Rule

CPA firms handling customer financial information qualify as financial institutions under the FTC’s Safeguards Rule and must maintain an information security program. The Rule requires encryption of customer information both on firm systems and in transit. Where encryption is not feasible, the firm must implement alternative controls approved by the designated Qualified Individual who oversees the security program.¹⁸ Cloud storage providers must meet the same standards, and data must remain within jurisdictions accessible to U.S. regulators.

Electronic Format Longevity

The IRS requires machine-readable records to be retrievable, printable, and producible on electronic media for the entire retention period.¹⁹ You cannot archive files in a format or on media that becomes unreadable. If your firm migrated from one practice management system to another, records in the old proprietary format must either be converted or remain accessible through the original system. Build periodic access testing into the retention procedure so you catch degradation before it becomes a compliance problem.

Destruction

Once the mandatory retention period has fully expired and no litigation hold is in effect, destruction is not optional. Holding records indefinitely creates unnecessary exposure: old data can be compromised in a breach, and stale records can be pulled into unrelated litigation. The FTC’s Disposal Rule requires anyone possessing consumer information to take reasonable measures to prevent unauthorized access during disposal.²⁰

For paper, that means cross-cut shredding or pulverizing so documents cannot be reconstructed. For electronic records, secure wiping or physical destruction of the storage media. Third-party destruction vendors need due diligence and a written contract specifying destruction standards.²⁰ Every destruction event should be documented with a certificate showing the date, method, and specific records destroyed, and those certificates should be kept permanently.

Retention Schedule at a Glance

Where multiple rules apply to the same document, the longest period controls.

Tax return workpapers and supporting documents: seven years from the filing date
Copies of filed returns or taxpayer lists under IRC 6107: three years after the close of the return period³
Form 8879 e-file authorizations: three years from the due date or IRS received date, whichever is later⁴
IRC 7216 consent forms: duration of the engagement relationship and a reasonable period afterward
Property basis records: entire ownership period plus three to six years after the disposal year’s return is filed⁵
PCAOB audit documentation: seven years from the report release date¹¹
Non-issuer (AICPA) audit documentation: five years from the report release date
Employee benefit plan records: six years from the filing date¹⁴
CPE documentation: five years, subject to your state board’s specific requirement
Payroll records: three years¹⁶
Form I-9: three years from hire or one year after termination, whichever is later¹⁷
Destruction certificates: permanently

Assign a specific person responsibility for monitoring the schedule, enforcing litigation holds, and authorizing destruction. Firms that run into trouble are rarely the ones that picked the wrong period; they’re the ones that never wrote the policy down and let each partner handle records their own way.

1
Internal Revenue Service. Time IRS Can Assess Tax
2
Office of the Law Revision Counsel. 26 USC 6694 – Understatement of Taxpayers Liability by Tax Return Preparer
3
Office of the Law Revision Counsel. 26 USC 6107 – Tax Return Preparer Must Furnish Copy of Return to Taxpayer and Must Retain a Copy or List
4
Internal Revenue Service. Frequently Asked Questions for IRS e-File Signature Authorization
5
Internal Revenue Service. How Long Should I Keep Records
6
Internal Revenue Service. Publication 583, Starting a Business and Keeping Records
7
Office of the Law Revision Counsel. 26 USC 7216 – Disclosure or Use of Information by Preparers of Returns
8
eCFR. 26 CFR 301.7216-3 – Disclosure or Use Permitted Only With the Taxpayers Consent
9
eCFR. 26 CFR 301.7216-1 – Penalty for Disclosure or Use of Tax Return Information
10
Internal Revenue Service. Treasury Department Circular No. 230 (Rev. 6-2014)
11
Public Company Accounting Oversight Board. AS 1215 Audit Documentation – Appendix A
12
Office of the Law Revision Counsel. 18 USC 1520 – Destruction of Corporate Audit Records
13
Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy
14
Office of the Law Revision Counsel. 29 USC 1027 – Retention of Records
15
AICPA & CIMA. AICPA Peer Review Program Document Retention Policy
16
eCFR. 29 CFR Part 516 – Records to Be Kept by Employers
17
U.S. Citizenship and Immigration Services. Retaining Form I-9
18
Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know
19
Internal Revenue Service. Revenue Procedure 98-25 – Retaining Machine-Sensible Records
20
eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records