A practical retention schedule for a ten-person office

Ask a small office how long it keeps client files and you will usually hear one of two answers: "forever" or "I'm not sure." Neither is a policy. Both have a cost, because every old file that still sits on a laptop or in a shared folder is something that can be lost, stolen, or emailed to the wrong person. A retention schedule is simply a written list that says what kind of record you hold, how long you keep it, and what happens when that time is up.

You do not need a consultant to start one. You need a spreadsheet, an hour, and a few phone calls.

Start with record types, not folders

Folders are how your files happen to be organized. Record types are how the law and your clients think about them. Walk through the office and list what you actually hold. For a typical ten-person professional office, the list looks something like this.

Record type	Where it usually lives	Owner	Retention period	Review cadence
Client work files (returns, workpapers, case files, policies)	Shared drive, practice software	Practice lead	To be confirmed with attorney, CPA or regulator	Yearly
Signed engagement letters and consents	Shared drive, paper	Office manager	To be confirmed	Yearly
Identity documents collected at intake (ID scans, W-9s, forms)	Downloads, scan folders, email	Office manager	Keep only as long as a rule or contract requires	Quarterly
Payroll and employee records	Payroll system, HR folder	Owner	To be confirmed	Yearly
Business financial records (your own books, bank statements)	Accounting system, shared drive	Owner or bookkeeper	To be confirmed	Yearly
Email with client attachments	Mailboxes, local exports	Each user	Set by record type of the attachment	Quarterly
Backups	External drives, cloud backup	IT provider or owner	Match the oldest record it must restore	Twice a year
Marketing, vendor and general admin files	Shared drive	Office manager	Short, set by the business	Yearly

The "retention period" column is deliberately mostly blank. That is the honest starting point, and the next section explains how to fill it in.

Finding the actual retention periods

Retention periods vary by record type, by state, and by regulator. A tax preparer, a bookkeeper, an insurance agency, and a law firm can each face different rules, and the same record can be covered by more than one rule at once. We are not going to print a list of years here, because a number copied from a blog post is exactly the kind of thing that turns out to be wrong for your situation. This is general education, not legal advice.

Here is how to find the real answers:

• Ask your attorney about client files, contracts, employment records, and anything tied to a dispute or a possible claim.
• Ask your CPA about tax and accounting records for your own business.
• Ask your regulator or licensing board (state board, professional association, insurance department) what they require for the records you hold on clients.
• Check your contracts. Insurance carriers, lenders, landlords, and client agreements sometimes set their own minimums.
• Ask about legal holds. If there is a pending audit, claim, or investigation, deletion stops for the affected records no matter what the schedule says.

When you ask, use the same question every time: "For this record type, in this state, what is the minimum we must keep, and is there a point where we should destroy it?" The second half matters. For some records, keeping them longer than necessary is the risk, not a safeguard.

Record the decision, not just the number

The schedule is only useful if someone can tell, a year later, why a number was chosen. Add three more columns to the table above: source of the period, who confirmed it and when, and what happens at the end (secure deletion, return to client, move to long-term archive). A single line in the spreadsheet might read: "Client work files, period confirmed by our CPA by email, filed in the Policies folder, destroy by deleting the folder and the matching backup set."

Save the confirming email or note next to the schedule. If a regulator or a client ever asks how you decide when to dispose of records, a dated schedule with sources behind it is a far better answer than a shrug. It also supports the written security program that some regimes expect, such as the FTC Safeguards Rule for tax preparers and many accounting firms.

Who decides, and how often to review

In a ten-person office, give the schedule one named owner, usually the owner or office manager, and one approver who can say yes to deletion. Everyone else follows it. Avoid "everyone is responsible," which in practice means no one is.

A review rhythm that fits a small office:

1. Quarterly: sweep the high-churn places (Downloads folders, scan folders, intake documents, email exports) for anything past its period.
2. Yearly: review the whole schedule after the busy season, confirm periods with your advisors, and destroy what has expired.
3. When something changes: a new service line, a new state, a new software tool, or a departing employee all warrant a look.

A first-week checklist

• Copy the table above into a spreadsheet and edit it to match your office.
• Name an owner and an approver for deletion.
• Send one email each to your attorney and CPA asking for the retention periods that apply to you.
• Record each answer, its source, and the date.
• Pick the first quarterly cleanup date and put it on the calendar.
• Decide how disposal is done and by whom: deletion, shredding, or secure device disposal.

A schedule tells you what should be gone. To find out what is still sitting around, MyVaultMate helps you find files that contain exposed sensitive data and ranks what to fix first; you can see what a report looks like at /sample.