How to Create a Nonprofit Document Retention Policy

Why the IRS Asks About This on Form 990

Form 990's governance section asks whether the organization has a written document retention and destruction policy, per the IRS. The IRS doesn't require every nonprofit to adopt one as a matter of law, but answering "no" on a publicly available tax return is the kind of governance gap that board members, grantmakers and watchdog groups notice. A written policy also does something more concrete: it gives staff and volunteers clear, consistent rules for what to keep, for how long, and how to dispose of it, instead of ad hoc decisions made differently by whoever happens to be cleaning out a filing cabinet or an inbox.

The Federal Law That Makes This More Than a "Nice to Have"

Separate from the Form 990 question, a federal criminal statute makes document destruction a real legal risk, not just a governance best practice. 18 U.S.C. Section 1519, added by the Sarbanes-Oxley Act, makes it a crime to knowingly alter, destroy, conceal or falsify any record or document with intent to impede, obstruct or influence a federal investigation, punishable by up to 20 years in prison. Unlike most of the Sarbanes-Oxley Act, which applies only to publicly traded companies, this particular provision applies broadly to any organization, including a nonprofit. A documented, routinely followed retention policy, paired with a clear rule to stop any destruction once litigation or an investigation is reasonably anticipated, is the practical way an organization protects itself and its staff from this exposure.

What to Include in a Document Retention Policy

A usable policy generally covers:

• Categories of documents the organization creates or receives, such as corporate records, financial records, personnel records, donor records, grant and contract files, and electronic records and email.
• A retention period for each category, stated as either a specific number of years or "permanent."
• Who is responsible for storing, and eventually destroying, each category, by role (such as the finance staff for financial records, HR for personnel files).
• A litigation or investigation hold provision, stating that normal destruction schedules are suspended for any document reasonably related to pending or anticipated litigation, an audit, or a government investigation, regardless of what the regular schedule would otherwise allow.
• A destruction method, such as shredding for paper and secure deletion for electronic files, so the policy actually addresses disposal, not just storage.

Common Retention Periods to Start From

While the right schedule depends on your organization's specific records and any grant or state requirements that apply to you, a few categories have a reasonably well-established baseline:

• Permanent: articles of incorporation, bylaws, the IRS determination letter, board meeting minutes, and the organization's own policies.
• 7 years: financial statements, bank records, and documents supporting a tax return or Form 990, reflecting that the IRS generally keeps the right to audit a return for 3 years, extended to 6 years if more than 25% of gross income was underreported, and indefinitely if no return was filed or the return was fraudulent, per the IRS.
• 3 to 7 years: routine correspondence, employment applications for non-hired candidates, and expired contracts, depending on your state's statute of limitations for related claims.

Adopting and Enforcing the Policy

Have the board formally adopt the policy by resolution, the same as any other governance policy, and store the adopted version where staff can actually find it, not just in a board binder. Train new staff and volunteers on it as part of onboarding, and revisit it periodically, since recordkeeping systems and legal requirements both change over time.

Electronic Records Need the Same Discipline as Paper

Email, shared drives, donor databases and cloud storage all count as records under most retention policies and under 18 U.S.C. Section 1519 itself; the statute doesn't distinguish between paper and electronic formats. Make sure your IT setup, including automatic email deletion rules or cloud storage expiration settings, doesn't quietly destroy records your written policy says to keep, or keep records past when your policy says to delete them.

A Litigation or Investigation Hold Always Overrides the Normal Schedule

The moment your organization reasonably anticipates litigation, an audit, or a government investigation touching specific records, normal destruction of those records needs to stop immediately, even if your written schedule would otherwise call for disposal. This is the exact scenario 18 U.S.C. Section 1519 is aimed at, and it is the one place where strictly following your own written schedule is not a defense if you knew a hold should have applied.

Don't Set a Shorter Period Than a Grant or State Law Requires

Some grant agreements and state charitable-registration rules specify their own minimum recordkeeping periods for grant-related records, which can be longer than your organization's general schedule. Check grant terms and your state's requirements before finalizing retention periods for grant-funded programs, rather than applying a single generic schedule to everything.

Revisit the Policy as Your Systems Change

A policy written when your nonprofit kept everything on paper may not map cleanly onto cloud storage, shared drives, and a donor database years later. Review the policy periodically, especially after a major change in your recordkeeping systems or software, to make sure the categories and storage locations it describes still match reality.

This Is Not Legal Advice

What your organization is legally required to retain, for how long, and what counts as reasonably anticipated litigation for hold purposes depends on your specific circumstances and state law. Talk to a nonprofit attorney when drafting your policy, and especially before destroying any records once a dispute, audit or investigation becomes a realistic possibility.