A keep result means the retention clock is still running. A review result means the file may be affected by a legal hold, contract term, state rule, or special category. A dispose result means the ordinary retention period has ended and the file can enter the approved destruction process if no hold applies.

Start With a File Inventory

A retention policy breaks down when it uses labels such as “financial records” without identifying the actual documents in that category. Start by listing the files your office creates, receives, and stores.

Include record streams such as:

  • Invoices, receipts, and bank statements
  • Tax returns and supporting schedules
  • Payroll reports and wage records
  • Employee personnel files and I-9 forms
  • Contracts, statements of work, and client approvals
  • Insurance policies and claims records
  • Customer files and correspondence
  • Email exports, chat records, and shared-drive folders
  • Records stored in accounting, payroll, HR, and cloud platforms

For each record stream, write down five details:

  1. Record category: Tax, HR, payroll, contract, customer, operational, health, or safety.
  2. Trigger date: The event that starts retention, such as a tax filing date, employee termination, contract expiration, final payment, or project closeout.
  3. Official repository: The approved location for the authoritative copy.
  4. Retention rule: The retention period and the reason it applies.
  5. Disposition method: Secure deletion, shredding, archival transfer, or preservation under a legal hold.

The trigger date matters more than the date a file was created or uploaded. A contract drafted in 2021 but signed in 2022 should be tied to the signed date and the end of its obligations. An employee’s I-9 form follows hire and termination dates, not the date an administrator saved it to a folder.

Keep one master schedule for the whole office. A spreadsheet can work for a solo operator with a limited number of files. Offices with employees, several departments, or sensitive data need a controlled register with named record owners, review dates, and a disposition log.

Compare Record Type, Trigger Date, and Official Copy

The useful comparison is not paper versus digital. It is the record’s purpose, retention trigger, and legal exposure. A scanned invoice and a paper invoice may follow the same retention period, but staff still need to know which copy is the official business record.

Record stream Retention clock starts What belongs in the official file Common mistake
Tax returns and supporting records Return filing or due date Returns, source records, income support, deduction support, basis records, and payroll tax records Destroying source documents as soon as the return is filed.
Employee and payroll records Pay period, termination, or employment action Payroll records, personnel actions, benefits files, leave records, and separate I-9 documentation Keeping HR records only in managers' email inboxes.
Contracts and client files Expiration, final performance, or account closure Signed agreements, amendments, statements of work, approvals, deliverables, and material correspondence Deleting the signed agreement while retaining only drafts.
Operational files Project closeout or superseded date Current procedures, approved policies, final reports, and records that support active work Keeping outdated procedures beside current versions without clear version control.
Health and safety records Employment end date or incident year Incident reports, injury logs, exposure records, medical documentation, and related required records Applying a general office purge rule to specialized records.

Separate working copies from records of authority. Draft attachments, duplicate downloads, copied email threads, and routine scheduling messages can follow a short cleanup rule once the signed, approved, or final version is stored in the official repository.

This keeps shared drives usable without shortening required retention. It also prevents a common problem: a former employee’s inbox becomes the only place where the office can find an executed agreement, client approval, or payroll authorization.

When a Spreadsheet Is Enough—and When You Need More Control

A short retention schedule can work well when the office has a limited number of record types and one person can keep the system organized. More detailed records management becomes necessary when different rules, locations, and access restrictions overlap.

A spreadsheet-based policy suits a solo consultant, small agency, or professional office with one legal entity, few employee records, and a manageable number of contracts. The schedule should still identify record owners, trigger dates, legal holds, official repositories, and secure destruction methods.

Use a more structured system when the office has any of these conditions:

  • Payroll and personnel files for multiple employees
  • Operations in more than one state
  • Health, financial, education, or other sensitive client records
  • Retention clauses in customer, insurer, landlord, lender, or government contracts
  • Large paper archives stored on-site or off-site
  • Frequent staff turnover that disrupts informal folder knowledge
  • Active disputes, claims, audits, or investigations

More structure brings more administration. Every record category needs an owner. Every shared drive or cloud platform needs an official-copy rule. Every deletion process needs a reliable way to stop when a legal hold applies.

A loose policy creates different problems: excess storage, privacy exposure, inconsistent responses to records requests, and slow document searches when a former employee, client, regulator, or attorney asks for files. Keeping everything forever also leaves unnecessary personal information exposed to breaches, subpoenas, and internal access mistakes.

Paper archives need their own plan. A banker’s box in off-site storage creates retrieval costs, storage costs, and destruction coordination. Scanning can make records easier to retrieve, but it does not automatically authorize destruction of the original. Signed originals, notarized records, title documents, and files subject to contract-specific requirements need separate handling rules.

Choose a Policy Structure That Matches the Office

The checklist should lead to a retention schedule that fits the office’s record types and legal obligations.

Office situation Recommended policy structure Priority records Watch for
Solo operator with contractors Short record schedule with an annual review Tax support, contracts, invoices, insurance, and client approvals Contractor records are not the same as employee files.
Small employer Separate schedules for HR, payroll, medical information, and I-9 forms Personnel actions, wage records, benefits, leave documentation, and hiring records Employment rules use different retention clocks for different files.
Client-service office Contract-LED schedule for client files Statements of work, deliverables, approvals, invoices, and material correspondence Client contract terms may require retention beyond internal defaults.
Health- or safety-sensitive office Specialized schedule with restricted access Medical, exposure, incident, privacy, and safety documentation Some categories have much longer retention periods than ordinary office records.
Multi-state or remote team State-aware schedule with centralized record custody Payroll, personnel, tax nexus, and customer privacy files Employee location can affect the applicable rule.

Small employers should use separate folders and access controls for personnel files, medical information, payroll records, and I-9 forms. Combining all of these records in one employee folder gives too many people access to sensitive information and makes targeted records requests harder to handle.

Assign a records custodian for each major category. That person does not need to create every file. Their job is to maintain the schedule, confirm the official repository, respond to holds, and approve routine disposal.

Build Retention Into Monthly, Quarterly, and Annual Work

Retention is an ongoing office process, not a document written once and forgotten. Put it on the calendar.

Use this schedule:

  • Monthly: Move completed files into the official repository, apply naming conventions, and remove routine duplicates.
  • Quarterly: Review records that reached their scheduled destruction date. Identify legal holds, contract exceptions, and records that must remain in place.
  • Annually: Update the schedule for new states, new services, employment changes, new software, contract changes, and revised business processes.

A legal hold suspends ordinary deletion. When the office receives notice of a lawsuit, credible dispute, government inquiry, audit, or preservation demand, preserve the relevant records and stop automated deletion for that scope.

A hold can include relevant emails, chat messages, shared-drive documents, paper files, and backups under office control. The retention period does not matter while the hold remains active.

Keep a deletion log with:

  • Record category
  • Date range covered
  • Destruction date
  • Destruction method
  • Approving person
  • Legal-hold status

The log shows that the office followed an ordinary retention process instead of selectively deleting documents after a problem arose.

Access control belongs in the same process. Restrict HR, payroll, client financial information, and health information to staff with a job-related need. Remove former employees’ access promptly while keeping business records in company-controlled systems.

Federal Retention Baselines and State Rules

Federal rules provide useful starting points, but no single federal schedule covers every file in a small office. State law, industry requirements, insurance terms, and client contracts can require longer retention.

Record type Published federal baseline Policy implication
Federal income tax records 3 years in many situations Keep supporting documents with the return. Longer periods apply to substantial omissions, fraud, and other exceptions.
Employment tax records At least 4 years Tie the clock to the later of the tax due date or payment date.
FLSA payroll records 3 years Preserve payroll records separately from wage-calculation support.
FLSA wage calculation records 2 years Include timecards, schedules, wage-rate tables, and work-time records.
I-9 forms 3 years after hire or 1 year after termination, whichever is later Use a separate I-9 repository.
FMLA records 3 years Protect medical and leave information with restricted access.
EEOC personnel records 1 year in many cases A charge or lawsuit extends the preservation duty.
OSHA injury and illness logs 5 years Maintain the annual log and related summary requirements.
OSHA employee exposure and medical records 30 years after employment ends Do not place these records under a general HR purge rule.
HIPAA documentation 6 years State medical-record laws and professional rules can require longer periods.

The IRS recordkeeping guidance, Department of Labor FLSA guidance, USCIS I-9 guidance, and OSHA recordkeeping rules support these federal baselines.

Property records deserve special handling. Records that establish the basis of equipment, real estate, or other business property should remain in the file until the limitation period expires for the year in which the property is sold or disposed of. Keep purchase records, improvement records, and disposal documents with the fixed-asset register.

Quick Checklist

Before adopting the schedule produced by the tool, complete this operating checklist:

  • List every recurring file category, not just broad departments.
  • Assign a trigger date for each category.
  • Identify one official repository for each record.
  • Separate employee personnel, medical, payroll, and I-9 records.
  • Add state-specific rules for every employee and operating location.
  • Read client, landlord, insurer, lender, and government contract retention clauses.
  • Write a legal-hold procedure that pauses deletion immediately.
  • Set a secure shredding and digital-deletion method.
  • Keep a disposition log for destroyed records.
  • Review the schedule annually and after major business changes.

Bottom Line

Solo operators and small offices without employees can use a short, disciplined retention schedule centered on tax support, contracts, client approvals, insurance, and official financial records. Keep it simple enough that it gets updated and followed.

Employers, multi-state teams, and offices handling health, safety, or sensitive customer information need a category-by-category schedule with separate access controls and longer retention rules where required.

A strong policy gives every record a clear retention clock, pauses destruction during legal holds, identifies the official copy, and documents disposal of expired files.

FAQ

How long should a small office keep business records?

Keep records according to their category and trigger date. Federal tax records often follow a three-year baseline, employment tax records require at least four years, and payroll, HR, safety, and health records follow separate rules. Contracts, state requirements, and legal holds can require longer retention.

Should small offices keep every email?

No. Keep emails that document approvals, contract changes, customer commitments, financial decisions, personnel actions, or other business records. Delete routine scheduling messages, duplicate attachments, newsletters, and transitory discussions under a documented cleanup rule.

Does scanning paper files mean the originals can be shredded?

No. Scanning improves retrieval and can reduce storage pressure, but some original documents require retention because of law, contract terms, signature requirements, or evidentiary value. Use a separate rule for original signed documents and records tied to property, legal filings, or regulated activity.

What is the most important retention-policy rule?

A legal hold overrides ordinary deletion. Stop destruction for records connected to a dispute, audit, investigation, or anticipated claim, even when the standard retention period has expired.

Who should own the file retention policy?

Assign ownership to an office manager, administrator, finance lead, or another designated records custodian. Department leaders should provide category-specific input, but one person should maintain the master schedule, annual review, hold process, and disposition log.