Business Records: What to Keep, and What It Costs You Not To

Records retention is the most boring topic in business administration right up to the moment a record decides something. A lender computing your borrowing capacity, a customer disputing a charge, a lien claim on an unpaid invoice, an investigation establishing how far a compromise reached — each of those turns on a document that either exists or doesn't, and by then the decision was made months or years earlier by whoever configured a default setting. This guide organizes retention around what records actually decide, because that's what determines how long they need to survive.

What records decide

Retention periods follow from what the record proves, not from a general rule.

Record	Decides	Needs to survive
Financial statements and books	Borrowing capacity, valuation	The periods a lender or buyer examines
Tax records	Examination outcomes	Assessment and examination windows
Contracts and change orders	Who was right in a dispute	The claim period on the contract
Invoices and proof of delivery	Whether you get paid	Claim and lien periods
Payment and dispute evidence	Chargeback outcomes	The full dispute window
System and access logs	Scope of a compromise	Longer than any plausible dwell time
Employment records	Claim outcomes	Applicable claim periods
Formation and ownership	Who owns what	Permanently

The pattern worth noticing: almost every row's period is set by how long someone else has to raise something, not by how long you need it. Which means the periods are outside your control and knowable in advance, and the only decision is whether you'll have the record when it's asked for.

Specific periods vary by record type, jurisdiction, and circumstance, so the right approach is to establish the longest period any category faces and set retention there rather than trying to run different clocks. Storage is cheap; reconstruction is impossible.

The default settings problem

The most common cause of a missing record, and the easiest to fix.

Most systems retain data for a period somebody set for storage reasons rather than evidentiary ones, and nobody in the business chose it. Which systems to check:

• Payment processing. How far back does transaction detail go? Per our representment guide, dispute evidence has to survive the full dispute window, which can run well past a default.
• Point of sale software, including signature and receipt records.
• Email. Automatic deletion policies frequently remove the correspondence that establishes what was agreed.
• Access and system logs. Per our breach guide, logs determine the scope of a compromise, and unknown scope is treated as maximum scope — a rotation setting is a financial control.
• Accounting software, particularly around archived periods and closed years.
• Messaging platforms, where business decisions increasingly happen and default retention is often short.
• Cloud storage, including what happens to files when someone leaves.

The last one causes disproportionate damage. Records held in a departing employee's account and deleted with it are gone, and businesses discover this months later.

Reviewing every system's retention setting is an afternoon's work and it's the highest-return item in this guide. Most defaults are shorter than the periods that matter, and none of them were chosen by anyone thinking about disputes.

Records a lender needs

The category where absence has the most quantifiable cost, per our bookkeeping guide.

What gets asked for and what happens without it:

• Monthly financial statements for the periods examined. Without them, annual figures only, and per our valuation guide a lender assessing capacity from annual figures assumes the worst about the variability it can't see.
• Bank statements, complete and reconcilable to the books.
• The add-back schedule with supporting documentation — the item that per our compensation analysis was worth around $139,000 of borrowing capacity on otherwise identical businesses.
• A complete debt schedule with the underlying agreements.
• Receivables ageing and the invoices behind it.
• Major contracts, particularly with concentrated customers.
• Tax returns for the examined years.

The general rule that governs all of it: a document created contemporaneously is credited and one reconstructed during an application is discounted. Lenders can tell the difference, they assume the reconstruction was favourable to you, and there is no way to recover the position later.

Which makes retention a capital planning question rather than an administrative one — the periods a lender examines were produced before you knew you'd need them.

Records that win disputes

Two dispute types with different evidence requirements, both decided by what you kept.

Customer payment disputes. Per our representment guide, what wins is specific: proof the customer authorized, received, and understood the transaction. That means transaction detail, delivery or service confirmation, the terms they agreed to, communications, and any signature or authentication record. All of it has to survive the dispute window, which is longer than most default retention.

Commercial disputes. Per our unpaid invoice analysis, most disputes trace to scope ambiguity rather than bad faith — which means they're decided by:

• The signed agreement and any amendments.
• Change orders, which are where scope disputes are usually won or lost.
• Sign-offs and approvals, including informal ones by email.
• Delivery evidence and dated communications.
• The invoice trail and any acknowledgments.

And the lien point from that analysis applies directly here: lien and bond claim rights depend on dates and documentation, and a business that can't establish when work was performed or materials supplied may lose a right on evidence rather than on merit.

The habit worth building: confirm anything agreed verbally in a short email the same day. It costs a minute, it creates a dated record, and it's the single most useful documentation practice available to a small business.

What to keep forever

Small in volume, expensive to reconstruct, no natural expiry:

• Formation documents — articles, operating agreement, bylaws.
• Ownership records and every change to them, per our ownership guide.
• Governance records — resolutions, minutes, consents. These also support the entity separation in our liability guide.
• Tax returns as filed, distinct from supporting documents.
• Property acquisition and improvement records, which determine basis whenever the property is eventually sold — potentially decades later.
• Intellectual property registrations and assignments.
• Resolved legal matters — settlements, judgments, releases.
• Insurance policies, particularly claims-related ones, since some claims arise long after a policy period.
• Licences and permits, including superseded ones.
• Guarantees you signed, per our guarantee guide, and any release from one.

The last is worth singling out. A release from a personal guarantee is a document you'll need years later to prove you're not liable, and it's exactly the kind of thing that gets filed once and lost. Keep it where you keep formation documents.

Retained isn't the same as retrievable

The distinction that determines whether retention accomplished anything.

A record nobody can find within a deadline is functionally absent. Dispute responses, lien filings, and lender requests all have dates, and a business that has the document but takes three weeks to locate it has lost on timing.

What makes records retrievable:

• A consistent structure — by year, then by category. Any consistent scheme beats an inconsistent good one.
• Naming conventions including dates and counterparties.
• One location per category, so nobody has to check three places.
• Searchable formats — a scanned image nobody can text-search is slower than paper.
• Access by more than one person, so a departure or absence doesn't lock records away.
• Verified backups — a backup nobody has ever restored from is a hypothesis, not a backup.
• An index for permanent records, listing what exists and where.

The test worth running once: pick a transaction from two years ago and try to assemble the complete record in twenty minutes. What you can't find is what you'd be missing when it counted, and the exercise usually reveals one system nobody had thought about.

When a matter arises

The situation where ordinary practice becomes a serious problem if it continues.

Once a claim, dispute, or investigation is reasonably anticipated, continuing routine deletion of relevant records is treated very differently from ordinary retention — and the consequences can exceed those of the underlying matter.

What to do when something arises:

1. Suspend automatic deletion for anything potentially relevant, immediately.
2. Tell the people who hold relevant records not to delete anything.
3. Document what you did and when, since the reasonableness of your response matters.
4. Include everything — email, messages, drafts, and system data, not just formal documents.
5. Get advice on scope, which is frequently broader than instinct suggests.
6. Don't resume deletion until the matter is resolved and you've been advised it's appropriate.

This applies to more situations than litigation. A payment dispute, a regulatory inquiry, an employment complaint, or a suspected security incident all trigger the same instinct to preserve — and per our breach guide, the preservation instinct in a security incident conflicts directly with the instinct to fix the system, which is why it needs to be a rule rather than a judgment.

Setting it up once

1. List your systems and check each one's retention setting.
2. Extend anything shorter than the period its records need to survive.
3. Set a single organizing structure and use it consistently.
4. Separate permanent records into their own location with an index.
5. Automate — anything requiring someone to remember will fail.
6. Test retrieval once, on a real old transaction.
7. Verify a backup restore once.
8. Write down the hold procedure so it isn't invented under pressure.
9. Confirm periods with your accountant and attorney, since they vary by jurisdiction and industry.
10. Review annually, particularly when systems change.

Items one and two carry most of the value and take an afternoon. Everything else is refinement on a problem you've already largely solved by not letting defaults decide.

Frequently asked questions

---

This guide is educational and does not constitute legal, tax, or accounting advice. Record retention requirements, limitation periods, lien deadlines, and preservation obligations vary substantially by jurisdiction, industry, and circumstance, and no specific periods are recommended here. Consult a qualified attorney and accountant to establish retention periods for your business.