What records do we have to keep and for how long?

What do we have to keep and for how long?

We are often asked about how long records should be kept, but there is not a quick and easy answer to this question.  There are three distinct steps in setting up a Records Destruction Policy:

• Making strategic decisions about what needs to be kept
• Formalizing those decisions into an actionable plan
• Training and ongoing execution

UltraShred Technologies has the tools to help with the second two… but the initial strategy decision is unique to every company because of why businesses keep records in the first place.  At a high level, there are two reasons.  Generally speaking, organizations keep records to guide them in making business decisions and to comply with laws about record-keeping.

On consideration, it becomes obvious why the first part would be unique to every company because no two companies operate in an identical fashion.  If a certain company has a sales cycle of a year, the Marketing Department might want to track 3 or 4 years of activity to predict future orders.  But with a long-fused sales cycle of maybe 5 years, one would need more years of supporting records to assemble the same report.  The records should exist to support the business processes (and not the other way around).

Some businesses are governed by specific retention laws.  For example, in New York State, the NY Office of Professional Responsibility (OPR) mandates by law that Medical Professionals must keep the records of adult patients for 6 years after the last appointment.  However… that law pertains just to the medical records.  The business and payroll records of the same practice are subject to different regulations and practical requirements.

Many people think there is a law stating that tax records must be kept for 7 years, and that is not so.  It may be a common practice but is not law.  That is because the Materiality Rule (CFR  1-6001-1) states that all books and records must be maintained as long as they remain material in the computation of any tax.   This is where the discussion gets very technical because someone has to interpret how long that might be.  A highly risk-adverse company might be inclined to keep records for a very long time in case there is ever a tax liability question.  But on the other hand, the Attorney for that same risk-adverse firm might argue for speedy destruction because stored records are subject to Discovery in the case of a lawsuit.  There is no simple or universal answer.

UltraShred Technologies can readily assist with the second and third phases of the process.  We have detailed drafts of Destruction Policies and Procedures, Training Materials, and all of the forms that would be needed to implement an ongoing and compliant records destruction program.

First, though, the fundamental question must be decided of “what needs to be kept and what needs to be destroyed?”  For most companies, the process is that a Committee is formed with representatives of each of the Departmental Stakeholders: Finance, Legal, Sales, Marketing, Operations, IT, and at some point with a representative of the Lawyer and the Accountant for professional guidance.  Once it is determined what needs to be kept, we have all the tools to formalize a repeatable process (which could withstand an audit) to manage the process of shredding and information destruction.  Keep in mind that we are not just talking about paper-based records.  Be sure your IT people are part of the discussion to protect the data on old laptops, computers, servers, and other places with hard drives and digital storage media.

There are a tremendous number of resources available online to help categorize the retention times for various types of documents; a simple Google search of the phrase “Business Records Retention Schedule” will set you in the right direction.  You may also want to check ARMA International, the not-for-profit professional organization who is the authority on information governance.

Best Regards,

Margaret