Records are only useful if they can be found, trusted and produced. Most businesses have the documents somewhere; what they lack is a retention rule, a secure place to keep them, and controls that stop money leaving on a forged instruction.
This guide covers how long records are kept, how they are stored and destroyed, and the payment controls that stop money leaving on a forged instruction. Services depend on the firm accepting the engagement and the facts of your situation.
How long to keep what
Retention periods differ by document type, and the safe answer is rarely forever. A written rule is what stops both premature destruction and unmanageable archives.
The federal starting points below follow IRS guidance on the period of limitations. They are starting points rather than a policy: several of them extend depending on what was filed, and insurers, lenders, Florida requirements and your own agreements can all run longer.
| Situation | Federal period |
|---|---|
| Most business records, where none of the situations below apply | 3 years |
| Records behind a claim for credit or refund after filing | 3 years from filing, or 2 years from paying the tax, whichever is later |
| Records behind a claim for a loss from worthless securities or a bad debt deduction | 7 years |
| Where income that should have been reported is more than 25% of the gross income shown | 6 years |
| Where no return was filed, or a fraudulent return was filed | Indefinitely |
| Employment tax records | At least 4 years after the tax becomes due or is paid, whichever is later |
| Property, and the depreciation and basis records behind it | Until the limitations period expires for the year the property is disposed of |
Two of those are not a simple count from filing. Property records run from disposal rather than acquisition, which for equipment and real estate routinely means holding them for well over a decade. And the periods that extend do so because of what was on the return, which is not always known at the time the records would otherwise be destroyed. Florida sales and use tax records are a separate question from the federal periods above and should be confirmed for your filing history.
Source: IRS, How long should I keep records? Periods stated there are general federal rules and do not account for every circumstance. Discuss your own retention schedule before destroying anything.
Building a retention schedule you will actually follow
A retention schedule that lists every document type in the business is usually abandoned within a year. One that names a small number of categories, states a period for each, and says where each lives, tends to survive. The value is in it being followed rather than in it being complete.
Two points are worth settling in writing. First, which clock a period runs from, whether the filing date, the transaction date, or the disposal of an asset, because those diverge by years for property and equipment. Second, what happens at the end: records that are simply never deleted are a growing liability, and keeping everything forever is a decision rather than the absence of one.
Storing and destroying securely
Backups, access control and a deliberate destruction process are a single subject, not three. Records that cannot be restored are not retained, and records that anyone can reach are a liability.
Who should be able to see what
Access is where most small-business record risk actually sits. The common pattern is that everyone can see everything, because it was simpler when the business was smaller and no one revisited it. Reducing that is rarely about distrust; it limits how far a single compromised password reaches.
Three habits do most of the work: separate logins rather than shared ones, so activity is attributable; access removed the day someone leaves rather than the next time anyone remembers; and a periodic look at who still has access to the accounting system, the bank and the document store. Former staff and former bookkeepers retaining access is common, and is usually discovered by accident.
Moving documents safely
Tax documents travel between you, your CPA and third parties. Secure portals, the risks of email, and knowing the red flags of a fraudulent request are the practical defenses. A data-request checklist keeps the exchange orderly.
Payment controls
Wire-transfer approval, cash-receipt controls connecting deposits to invoices, and separation of bookkeeping from approval are what prevent the common small-business losses.
Records that live in cloud accounting systems
Records kept only inside a cloud accounting platform raise questions that paper did not. A subscription that lapses may restrict access to the history it holds; an export taken once a year is a different thing from a backup; and attachments stored against transactions may or may not be included in whatever export the platform offers.
It is worth knowing, before it matters, what an export contains, whether it includes attachments, and how the information would be produced if it were requested while the subscription was inactive.
Fraud patterns worth knowing
Business email compromise, vendor fraud and expense reimbursement fraud each have recognizable warning signs, and each is addressed by a control rather than by vigilance alone.
After an incident
A cybersecurity incident affects tax, insurance and accounting records at once. Preserving them properly shapes what can be claimed and what can be proven.
Frequently asked questions
How long do I have to keep tax records?
It varies by document type, and the safe answer is rarely forever. A written retention rule is what prevents both premature destruction and an archive nobody can search.
Is email safe for sending tax documents?
Not for anything carrying account numbers or identifying detail. A secure portal is the default, and the red flags of a fraudulent request are worth knowing before one arrives rather than after.
What single control prevents the most loss?
Separating whoever records a payment from whoever approves it. Most small-business losses trace back to one person holding both roles, and wire approval is where that gap costs the most.
Can I throw out paper once everything is scanned?
Generally yes for most business records, provided the scans are complete, legible and stored somewhere that is actually backed up. A few categories are worth keeping in original form, where the original itself carries legal force: deeds and titles, formation and ownership documents, wills and trust instruments, anything notarised, and promissory notes. The practical test is whether the copy would serve the purpose the original was kept for.
What is the single control that prevents the most loss in a small business?
Separating the person who can create a payment from the person who approves or reviews it. In a business too small to split those roles, the owner reviewing the bank statement independently each month, rather than a report prepared by whoever makes the payments, achieves most of the same effect.
A former employee may still have access to our accounting file. What now?
Treat it as current rather than historic. Change the credentials, review the access list across the accounting system, bank and document storage, and look at the activity log for the period since they left. Most platforms keep a user activity history that will show whether anything was accessed.
Discuss your records
Use the free 20-minute consultation to describe how records are kept, who has access and what prompted the question. You will finish the call knowing what the work would involve and whether CPA Firm South Florida is the right firm for it.