AICPA Record Retention Guidelines: What They Actually Say

This is general commentary, not legal or tax advice. Retention obligations for an accounting firm come from several places at once — state board rules, IRS requirements, engagement letters, and professional standards — and they interact differently depending on your state and the service you're providing. Confirm your specific obligations with your state board and current AICPA guidance before setting policy.

The AICPA publishes guidance, not a single retention period

Firms often search for 'the AICPA retention period' expecting a number. That's not how the guidance works. The AICPA provides a records retention framework and sample policy language that firms adapt, alongside professional standards governing client records — most notably the rules on returning client-provided records when a client requests them. The framework sets out categories of records and the considerations that should drive how long each is kept; it does not issue one universal retention period that applies to every firm and every document.

The distinction that matters most: client records versus work product

Professional standards draw a line that most firm policies should follow too. Client-provided records — the W-2s, bank statements, receipts, and source documents your client gave you — belong to the client. Your work product, working papers, and the deliverable itself sit in a different category with different obligations and different retention logic.

• Client-provided records: source documents the client supplied. These generally must be returned on request, and there is rarely a professional reason to hold them indefinitely once the engagement is complete.
• Firm work product: returns, financial statements, and reports you prepared. Retention here is driven by professional standards, statute of limitations, and your own risk management.
• Working papers: the documentation supporting your work. Typically retained on a defined schedule tied to the engagement type and applicable standards.
• Engagement documentation: letters, scope, and correspondence establishing the terms of the relationship. Usually retained alongside the work product.

Why 'keep everything forever' is the wrong default

The instinct behind indefinite retention is that more records mean less risk if a question surfaces years later. That's half true and it ignores the other half: every client document a firm stores is a document that can be exposed in a breach. Client-provided records are the highest-sensitivity, lowest-ongoing-value category you hold — full of Social Security numbers, account numbers, and identity documents — and after an engagement closes, most of their value to you has already been extracted into your work product.

The result is a policy that trades a small, speculative risk (needing a source document you could request again) for a large, concrete one (holding a decade of client PII you no longer need).

Building a policy you can actually follow

• Write separate retention periods for client-provided records and for firm work product — they are not the same category and shouldn't share a schedule.
• Check your state board's rules, which may impose minimums that override your preference.
• State the policy in your engagement letter so clients know what will be kept and for how long.
• Define what triggers the clock — engagement completion, filing date, or delivery — because an undefined start date makes any period unenforceable in practice.
• Make deletion automatic rather than a task someone has to remember, or the policy will exist only on paper.

The operational problem behind the policy

Most firms' retention policies fail at the last step. Deleting old client uploads is nobody's priority, so files accumulate in the portal for years regardless of what the policy says. That's an argument for building deletion into the intake tool rather than into someone's calendar: ClientBrief automatically deletes uploaded documents seven days after an engagement is marked complete, so client-provided records don't linger past the point where you've downloaded what you need.

Try ClientBrief free for 14 days — no credit card required.