How long does my small business have to keep its records, and can I scan receipts and throw away the paper?

What should I check, step by step?

1. Keep copies of every filed tax return. The IRS says they help with future returns and amended returns.

2. Default to keeping income and expense records (sales records, invoices, receipts, deposit slips, canceled checks, bank statements) for at least 3 years after you file. Keep them 6 years if there's any chance more than 25% of gross income went unreported, and 7 years for bad-debt or worthless-securities claims.
3. Keep employment tax records for at least 4 years after the tax is due or paid, whichever is later.
4. Keep records for equipment, vehicles, buildings and other property until the limitations period runs out for the year you sell or dispose of it, since you need them for depreciation and gain or loss.
5. Before discarding anything, check whether a lender, insurer, state agency or contract needs it longer.
6. If you scan receipts and destroy the paper, use a system that indexes each document (for example a unique id per file), reproduces it legibly, and links it to the ledger entry it supports. Test that the scans are complete and readable before shredding.
7. Protect the scans against later changes: keep them where the person who does the books can add but not edit or delete, and record a hash of each file when you save it so a changed file can be detected.
8. Before canceling or switching accounting software, export the books and attachments. QuickBooks Online gives read-only access for one year after you cancel a single subscription.
9. Write down how your storage works (where files live, how they're named and indexed, who can change them). Rev. Proc. 97-22 says the IRS can ask for a description of the system and its index.

How long does the IRS say a business must keep records?

The IRS's How long should I keep records? page says you must generally keep records that support an item of income, deduction or credit on a return until the period of limitations for that return runs out, the period in which you can amend to claim a refund or the IRS can assess more tax. Years count from filing, and returns filed early are treated as filed on the due date.

• Its list: 3 years in the usual case; 3 years from filing or 2 years from paying the tax, whichever is later, if you file a claim for credit or refund; 7 years for a loss from worthless securities or a bad debt deduction; 6 years if you don't report income that you should and it is more than 25% of the gross income shown; indefinitely if you don't file a return or file a fraudulent one; and at least 4 years after the date employment tax becomes due or is paid, whichever is later.
• Property records are kept until the limitations period expires for the year you dispose of the property. And when records are no longer needed for tax, the IRS says not to discard them until you check whether you need them for other purposes, such as your insurance company or creditors.

Can I scan receipts and throw away the paper originals?

Publication 583 says all requirements that apply to hard copy books and records also apply to electronic storage systems that keep tax books and records. The system must index, store, preserve, retrieve and reproduce the records in legible format, and give a complete and accurate record accessible to the IRS. The original paper may be destroyed once the system has been tested to establish that it reproduces the records as required and procedures are in place to keep it compliant. The IRS may test the system, and that test isn't an examination.

• Revenue Procedure 97-22 sets out the requirements. An electronic storage system must include reasonable controls to ensure its integrity, accuracy and reliability; reasonable controls to prevent and detect the unauthorized creation of, addition to, alteration of, deletion of, or deterioration of stored records; an inspection and quality assurance program with periodic checks; a retrieval system with an index; and the ability to reproduce legible, readable hard copies. The stored records must be cross-referenced with the books in a way that provides an audit trail between the general ledger and the source documents.
• It also says using a third party to store the records doesn't relieve you of these responsibilities, and records in a system whose hardware and software you stop maintaining are treated as destroyed unless they stay available to the IRS.

What happens to my QuickBooks Online records if I cancel?

Cloud bookkeeping software keeps the books only while you pay for it. Intuit says that when you cancel a single QuickBooks Online subscription you have read-only access for one year, during which you can export to Excel or QuickBooks Desktop; after a free trial the window is 90 days. That's shorter than most of the IRS periods above.

• So the archive should be something you control: year-end exports of the reports and ledgers, the source documents with an index, and a record that shows the files weren't changed after the fact. Hashing each file when it's saved, and sealing the hash with the ledger entry it supports, gives you the alteration check and the ledger-to-document trail in one step.