How long do auditors need to keep workpapers?

Asked by: Lila Berge MD  |  Last update: October 3, 2026
Score: 4.7/5 (21 votes)

Auditors typically must retain workpapers for seven years for public companies (issuers) under Sarbanes-Oxley Act (SOX) regulations, while private company audits (non-issuers) generally require a five-year retention period from the report release date. However,, specific regulations or litigation may require longer retention times.

How long to retain audit workpapers?

The final rule, which is included in Regulation S-X, requires accountants to retain certain records for a period of seven years after the accountant concludes an audit or review of an issuer's or registered investment company's financial statements.

What is the 7 year audit requirement?

. 14 The auditor must retain audit documentation for seven years from the date the auditor grants permission to use the auditor's report in connection with the issuance of the company's financial statements (report release date), unless a longer period of time is required by law.

What is the 2 year rule for audit?

The 2-year rule for audit is quite simple. If a company meets two or more of the above criteria for two years in a row, then it must have a statutory audit. Conversely, a firm that currently has to be audited can't qualify for an audit exemption until it fails to meet at least two over the criteria over two years.

What is the 7 year retention policy?

A 7-year retention policy generally refers to legal requirements for keeping certain financial, audit, and specific organizational records for seven years, commonly seen with the IRS for tax records (especially for bad debt/worthless securities), SEC for audit workpapers (SOX), and Title IX for educational records, ensuring compliance and audit readiness, though specific document types vary. It's a common benchmark, but other periods (like 3, 6 years, or indefinite) might apply depending on the document and jurisdiction.

How To Audit Cash | Part 1 of 3 | Bank Reconciliation, Outstanding Checks and Deposits in Transit

18 related questions found

Can the IRS audit you after 7 years?

How far back can the IRS go to audit my return? Generally, the IRS can include returns filed within the last three years in an audit. If we identify a substantial error, we may add additional years. We usually don't go back more than the last six years.

How far back can they go for an audit?

The General Statute of Limitations for IRS Audits is 3 Years

This also means that an IRS audit can look back at 3 years of your tax filings. Those 3 years begin at the later of the: Date you filed your taxes, or. Due date for your taxes.

How far back can you audit a company?

The default audit window is typically three years. The IRS has six years to audit a business when there are substantial omissions or errors on the return. There is no statute of limitations for fraudulent or false returns or a return that was never filed.

What is the 2 year rule for small companies?

The two-year rule. The “two-year rule” is a provision that applies when determining a company's size for corporate reporting purposes. A company qualifies as micro, small or medium-sized once it has met the size limits in its first ever financial year or otherwise in two consecutive financial years.

Can IRS go back 20 years?

Quick Answer: The IRS can go back indefinitely if you've never filed a return. While they generally require the last six years to be filed to get back into compliance, there's no statute of limitations on unfiled tax returns. This means the IRS can pursue you for older years at any time.

What is the retention period for audit records?

Once the auditors have completed their workpapers for a given client, they must retain that audit documentation for a certain period of time. The retention requirements of audit documentation are 5 years for nonissuers and 7 years for issuers.

What records must be kept for 5 years?

5 years following the year records pertain to (medical exams, material safety data sheets and exposure to toxic substances records retained for the duration of employee's job tenure plus 30 years). Employee data, including: • Basic payroll and identifying employee data.

Can an auditor keep the audit working paper with him?

The auditor should adopt reasonable procedures for safe custody of his working papers and should retain them for a period sufficient to meet the needs of his practice and to satisfy any pertinent legal requirements of records retention.

Does IRS forgive after 10 years?

Yes, the IRS generally has a 10-year statute of limitations (Collection Statute Expiration Date or CSED) from the tax assessment date to collect unpaid taxes, meaning the debt usually goes away then; however, this clock can be paused or extended by certain events like filing for bankruptcy, entering installment agreements, or living abroad, and there's no time limit for fraud, says the IRS and tax professionals https://www.irs.gov/newsroom/taxpayer-bill-of-rights-6,.

Can you be audited after 7 years?

Generally, the IRS adheres to a three-year statute of limitations for tax audits. This means that they can review your tax returns for the three years preceding the current tax year.

What is the IRS 7 year rule?

The IRS 7-year rule primarily applies to keeping records for claiming a deduction for bad debts or losses from worthless securities, allowing a longer period to file for a credit or refund, but it's not a universal audit limit; it's often a recommended safe buffer for general record-keeping, with the standard IRS audit period usually being 3 years, extending to 6 years for substantial income omission (over 25%) or foreign income issues, and indefinitely for fraud.

Is there a statute of limitations on audits?

California Statute of Limitations

The Franchise Tax Board or FTB, California's income tax agency, has four years from the date of filing to complete an audit.

What is the 3 year rule for the IRS?

The IRS 3-year rule generally refers to the statute of limitations for claiming a tax refund, which is typically 3 years from when you filed your original return or 2 years from when you paid the tax, whichever is later, for the IRS to process your claim. For an audit, the IRS generally has 3 years from the date your return was filed or due (whichever is later) to assess additional tax, though this can extend to 6 years if you significantly underreport income or omit foreign income.
 

How many years does the IRS allow a business to fail to show a profit?

The IRS allows you to claim business losses for three out of five tax years. Afterward, it may classify your business as a hobby, making it ineligible for tax deductions. How can I prove my business is more than a hobby?

What records must be kept forever?

Keep Forever

  • Birth certificate or adoption papers.
  • Social Security cards.
  • Valid passports and citizenship or residency papers.
  • Marriage licenses and divorce decrees.
  • Military records.
  • Wills, living wills, powers of attorney, and retirement and pension plans.
  • Death certificates of family members.

Should I keep my 20 year old tax returns?

You generally don't need to keep 20-year-old tax returns; the standard IRS recommendation is to keep most tax records for 3 years, but 6 years if you significantly underreported income (25% or more), or even indefinitely if you never filed or filed fraudulently. For most people, keeping records for 3-7 years covers standard audits, but if those returns are from a time you bought/sold property or have complex investments (like worthless securities), you might need them longer, so consider shredding or securely disposing of anything older than 7 years unless it's for property records.

What is the 7 year rule?

The 7 year rule

No tax is due on any gifts you give if you live for 7 years after giving them - unless the gift is part of a trust. This is known as the 7 year rule.