How Long to Keep Financial Records: Tax, Payroll, and OSHA

How long you need to keep financial records depends on the document, but most fall in a three-to-seven-year band: three years is the general IRS rule, four years applies to employment tax records, six years covers employee benefit plan filings under ERISA, and seven years is prudent for bad-debt and worthless-securities deductions. Corporate formation documents, intellectual property records, and anything tied to employee vesting should be kept for the life of the business. The retention clock generally starts when a return is filed or a reporting period closes, and it pauses only when an audit, investigation, or lawsuit is on the horizon.

The Basic Retention Periods at a Glance

Three years: general federal income tax records and basic payroll records under the FLSA
Four years: employment tax records (Form 941, W-2s, withholding documentation)
Five years: OSHA injury and illness logs
Six years: ERISA employee benefit plan filings and supporting documents
Seven years: records supporting bad debt or worthless securities deductions
Indefinite: corporate formation documents, active intellectual property records, property records while owned, and any records covered by a litigation hold

Tax Records: Three, Six, or Seven Years

The IRS requires you to keep enough records to establish the income, deductions, and credits reported on your return.¹ The actual number of years comes from the statute of limitations on assessment.² Your records need to last at least as long as the IRS can come back and question the return.

Three years is the default. The IRS has three years from the filing date to assess additional tax, and returns filed early are treated as filed on the due date.

Six years applies if you omit more than 25 percent of your gross income. The assessment window doubles, so the retention window should too.²

Seven years applies to deductions for bad debts or losses from worthless securities. These losses can surface years after the original transaction, so the IRS gives itself a longer look.³

There is no time limit at all if you filed a fraudulent return or never filed one. Records for those years should be kept indefinitely.²

Payroll and Employment Records

Employment tax records must be kept for at least four years after the tax becomes due or is paid, whichever comes later.³ That covers Form 941 filings, W-2s, and documentation of withheld income and payroll taxes. The four-year rule catches people off guard because it runs a year longer than the general three-year rule for income tax returns.

The Department of Labor imposes a parallel three-year requirement under the Fair Labor Standards Act for basic payroll records: employee names, addresses, hours worked, wages paid, and any additions or deductions from pay.⁴ Supporting documents that feed wage calculations — time cards, work schedules, wage rate tables, and piece-rate computations — carry a shorter two-year requirement.⁵ Many employers keep everything for the full four-year IRS window rather than sort documents into separate two-year and three-year piles.

Personnel and Hiring Records

The EEOC requires employers to preserve personnel and employment records — applications, resumes, promotion decisions, termination documentation — for at least one year from the date the record was made or the personnel action was taken, whichever is later.⁶

If a discrimination charge is filed, the one-year rule stops applying. You must preserve all records relating to the charge, including files for other employees in similar positions, until the matter is fully resolved through any lawsuit and appeals.⁶

OSHA Injury Logs: Five Years

Employers covered by OSHA must retain the 300-series forms — the Log (Form 300), the Incident Report (Form 301), and the annual Summary (Form 300A) — for five years after the end of the calendar year each set covers. During that window, you also have to update the log when new information about a recorded injury or illness comes to light.

Businesses with ten or fewer employees and companies in certain low-hazard industries are exempt from routine recordkeeping, though they still have to report fatalities and hospitalizations directly to OSHA.

Employee Benefit Plans: Six Years, Longer for Vesting

ERISA sets one of the longest mandatory retention periods in federal law. Records supporting a benefit plan filing — Form 5500 annual reports along with the vouchers, worksheets, and receipts behind the numbers — must be kept for at least six years after the filing date.⁷ If your plan qualified for a simplified reporting exemption, the six-year clock runs from the date the filing would have been due.

Records tied to individual eligibility, vesting, and benefit distributions deserve longer retention. If a former participant later claims unpaid benefits, the burden of proving the money was already distributed falls on the plan sponsor, not the participant. Companies that destroyed vesting records after six years have paid benefits twice.

Records to Keep for the Life of the Business

Some documents should stay in your files as long as the business exists. Articles of incorporation, bylaws, operating agreements, partnership agreements, and board minutes establish your legal identity and govern your authority to act. Losing them creates problems ranging from re-filing with the state to disputes over ownership and governance.

Property deeds and titles should be kept while you own the asset and for at least three to seven years afterward, since a sale can trigger capital gains questions that tie back to your original basis. Significant contracts — leases, licensing agreements, loan documents — should be retained through the life of the agreement plus the statute of limitations on any potential breach claim.

Intellectual Property

Patents are valid for up to 20 years from the application filing date, so applications, assignment agreements, and licensing records should be kept at least that long.⁸ Trademarks can be renewed indefinitely; registration certificates, renewal filings, and evidence of use should be kept as long as the mark is active. Copyright registrations and related licensing agreements warrant permanent retention.

Electronic Storage: What Counts as Kept

Federal agencies accept digital records, but only if the system meets specific standards. The IRS requires that an electronic storage system accurately transfer, index, store, preserve, retrieve, and reproduce your books and records, with controls that prevent unauthorized changes or deletions and a regular inspection program to verify data integrity.⁹

Two failure modes come up during audits. A scanned document too blurry to read does not count as a record. And if you switch software or stop maintaining the hardware needed to open old files, the IRS treats those records as destroyed.⁹ Migrating data during system upgrades is a legal obligation, not a nice-to-have.

The Department of Labor applies similar standards. The system needs an indexing method that allows specific documents to be located and retrieved, and records must be legible both on screen and when printed. If a document cannot be accurately converted to digital form, you have to keep the paper original.

Litigation Holds Override Every Retention Schedule

When your company reasonably anticipates litigation, an investigation, or a government audit, you must immediately stop any routine document destruction. A litigation hold covers paper files, emails, electronic documents, text messages, and anything else potentially relevant. It stays in place until the matter is fully resolved through any appeals. Destroying records subject to a hold can lead to court sanctions, adverse rulings, and even criminal obstruction charges.

Destroying Records the Right Way

Once a retention period expires and no litigation hold applies, get rid of the records. Old files create liability. They can be subpoenaed in future disputes, and storing sensitive data longer than needed enlarges your exposure in a data breach.

For records containing consumer or employee personal information, the FTC’s Disposal Rule requires reasonable measures to prevent unauthorized access during destruction. Paper should be shredded, burned, or pulverized so it cannot be reconstructed. Electronic media must be wiped or physically destroyed to the same standard.¹⁰

Hiring a shredding or destruction vendor does not transfer the responsibility. The FTC expects due diligence: review the vendor’s security policies, check references, and confirm certification by a recognized industry association.¹⁰ Businesses subject to the Gramm-Leach-Bliley Act must fold disposal into their broader information security program.

State Rules May Run Longer

State retention rules run alongside the federal requirements and sometimes exceed them. State income and sales tax records generally follow a three-year retention period that mirrors the federal standard, but some states extend this to four, five, or even seven years. Unemployment insurance records are typically governed by each state’s labor agency and often track the three-year federal payroll rule.

Workers’ compensation records tend to carry the longest state-mandated retention periods, ranging from three to ten years depending on jurisdiction and the nature of the claim. Open claims and long-term disability files can push retention well beyond the standard window. A policy built solely around federal minimums can leave you exposed at the state level, so check your state tax authority and labor department.

What Missing Records Cost You

If the IRS audits you and your records are inadequate, the agency can reconstruct your income using bank deposit analysis, industry comparisons, or third-party data. The resulting assessment rarely favors the taxpayer, and unsubstantiated deductions get disallowed.

Department of Labor investigations into wage and hour complaints lean heavily on employer records. If you cannot produce time and pay records, investigators generally accept the employee’s account of hours worked and wages owed. Civil monetary penalties for willful or repeated FLSA violations apply on top of any back-wage liability.¹¹

OSHA recordkeeping violations carry per-violation fines that add up quickly across multiple deficiencies. And for employee benefit plans, missing ERISA documentation can mean paying benefits a second time to a former participant you cannot prove you already paid. The pattern across every agency is the same: when records are gone, the assumptions run against the company that should have kept them.

1
Office of the Law Revision Counsel. 26 U.S. Code 6001 – Notice or Regulations Requiring Records, Statements, and Special Returns
2
Office of the Law Revision Counsel. 26 U.S. Code 6501 – Limitations on Assessment and Collection
3
Internal Revenue Service. Topic No. 305, Recordkeeping
4
eCFR. 29 CFR 516.5 – Records to Be Preserved 3 Years
5
U.S. Department of Labor. Wage and Hour Division Fact Sheet 21 – Recordkeeping Requirements Under the Fair Labor Standards Act
6
U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
7
Office of the Law Revision Counsel. 29 U.S. Code 1027 – Retention of Records
8
United States Patent and Trademark Office. Manual of Patent Examining Procedure 2701 – Patent Term
9
Internal Revenue Service. Revenue Procedure 97-22 – Guidance to Taxpayers on Electronic Storage Systems
10
eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information
11
U.S. Department of Labor. Civil Money Penalty Inflation Adjustments