Client Data Retention and Destruction Checklist for CPA Firms

What it is

A retention policy is a list of record types, a retention period for each with its source, and a destruction process. This checklist covers audit and attest records, tax and client records, firm administrative records, storage and security, destruction and legal hold, and it includes a retention schedule table to complete.

Periods come from several sources, including AU-C 230, the Uniform Guidance for single audits, the tax code for return preparers, state boards of accountancy, contracts and insurers. The longest applicable period governs. Confirm each period with counsel and your state board before adopting a schedule.

When to use it

• Writing or updating the firm’s retention policy.
• Before a scheduled file destruction.
• When a client leaves and the retention clock starts.

What’s inside

• Policy ownership and scope
• Audit and attest documentation periods
• Tax and client records
• Quality and administrative records
• Secure destruction, legal hold and the schedule table

Standard cited

This template follows AU-C 230 / 2 CFR 200.517 / IRC 6107. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use. See AU-C 230 explained.

Questions

Related templates

• Client Offboarding and Records Return Checklist
• Audit Completion and File Review Checklist (AU-C 230 / AU-C 700)
• Peer Review Readiness Checklist

Last updated 11/05/2026. All free templates.