How Long Should I Keep This Business Record For?

This is perhaps one of the most-asked questions in all of records management. Too often I hear one of two, equally bad answers:

1. Keep Records for Seven years: This seems to be the de facto answer, especially for financial services records. As near as I can tell, this comes from the U.S. Internal Revenue Service rules around when they can audit individual and corporate tax returns. If you've heard another original story for why we should keep all records for seven years, please share, and I'll update this post.
2. Keep Records Forever: This generally is presented as one of four arguments:
1. Just in case we get sued (or for some other legal reason)
2. There's gold in them thar records! Analytics! AI! BIG DATA!!!
3. Storage is cheap, figuring out what we can get rid of is not.
4. Storage is cheap, penalties for getting rid of records inappropriately aren't.

In my role here at AIIM as the Director of Professional Development, I get this question all the time from my students, session attendees, and sometimes even my colleagues. I remember I once had a discussion with a colleague, now some 20 years ago, about getting rid of records, the right ways to do it, etc. The colleague was aghast and demanded to know how I could ethically support the destruction of evidence like that?! After some discussion, I think I brought the person around to the point that destroying records is not destroying evidence – as long as you follow your records program consistently.

How Long to Keep Your Business Records - It Depends...

There are some records that do need to be kept for seven years, of course. And there may some that need to be kept permanently, especially if they have historical value. The latter, in particular, is especially true for federal governments and their component agencies. But these are generally a fairly small volume compared to all of their records that are not permanent.

So, how long should you keep that record for? The right answer, of course, is it depends – and it depends on a LOT of different variables, but we will define some of the characteristics that will help you find an answer to the question.

• Where does your organization do business? Even within a given industry or sector, retention requirements vary dramatically across jurisdictions and countries.
• What kind of industry or business are you in? Highly regulated industries such as financial services or health care tend to have more retention requirements and to be much more specific about what, how, and how long to retain certain types of records.
• What kind of record is it? Financial records will often be retained for longer periods of time than individual expense reports or receipts. Human resources records might need to be kept anywhere from a year to the lifetime of an employee and beyond. Engineering drawings are retained for the life of whatever they were used to design.
• Is there a legal requirement to retain it? Every organization throughout the world creates records, and every one of them has some specific legal requirement to retain at least some of them for at least some period of time. It's also important to think beyond positive statutory or regulatory requirements and consider statutes of limitations.
• Is there operational value in retaining it? This goes beyond any legal or financial obligations noted above. With very few exceptions, legal and financial records retention requirements represent the minimum amount of time something can be retained. Records can always be retained longer than the minimum. However, this comes with a couple of caveats:
  • Records kept have to be stored, and someone has to pay for that storage.
  • The higher the volume of records and information, the harder it is to find a particular record when required.
  • Keeping records longer than required can significantly increase organizational liability. Most courts don't care whether some information asset has been formally declared as a record. Rather, they care whether it exists and is material to the matter at hand.

If the organization decides to keep records longer than the minimum retention period, there is an additional step to take. The length of retention with the new retention period should be documented in the retention schedule as the baseline moving forward. That is, the organization should make a formal decision, and document that decision, rather than leaving it to individual business leaders' whims.

Your Best Answer May Already Exist

The good news is that providing the answer(s) to this question is one of the foundational parts of an effective records management program. A solid records management program will have in place processes for:

• Inventorying the organization's information assets
• Determining which are records and which are copies or not business-related
• Determining the retention requirements of each type of record identified
• Ensuring that the organization is retaining all of the records that it should be according to its legal, regulatory, and operational environment
• Ensuring that records are disposed of when they no longer have business value and are not otherwise subject to legal or regulatory requirements for retention
• Ensuring that records that are needed for a legal or regulatory matter, an audit, etc. are preserved appropriately until the matter has been completely resolved

So, to answer the question posed in the title, "It depends" is the most correct, followed closely by "so go ask the records managers, they'll know." And they will! And if all else fails - then, maybe it's time to come train with AIIM. 😀