Collecting Documents and Information for Compliance or Audits

An IRS letter does not wait while you search a client’s inbox. SCORE says you have 30 days to answer an audit notice and that the IRS sends that notice by mail. A document request form collects the proof during the year so the file is ready when the letter comes.

This guide is general education. It is not tax advice. Publication 583 sets the federal tax periods below. A contract or a state rule or an insurer can ask you to keep a file longer.

What the file has to prove

Publication 583 says the law does not require one specific kind of record except in a few cases. The system has to show income and expenses. The books have to show gross income and deductions and credits. For most small businesses the business checkbook is the main source of those entries. Supporting documents sit behind the entries.

The IRS says you must keep business records available for inspection. If an exam happens you may have to explain the items on the return. A complete set of records shortens that exam.

Supporting documents in Publication 583 include sales slips and paid bills and invoices and receipts and deposit slips and canceled checks. Keep them in order and in a safe place. The publication’s example is to organize them by year and by type of income or expense.

Match the ask to the kind of record.

• Gross receipts. Cash register tapes and bank deposit slips and receipt books and invoices and credit card charge slips and Forms 1099-MISC and Forms 1099-NEC.
• Inventory. Canceled checks and cash register tape receipts and credit card sales slips and invoices. The papers should show the amount and that the amount was for inventory.
• Expenses. Canceled checks and cash register tapes and account statements and credit card sales slips and invoices and petty cash slips for small cash payments. Attach the petty cash slip to the receipt.
• Assets. Purchase and sales invoices and real estate closing statements and canceled checks. The record should show when and how you got the asset and the price and improvements and the Section 179 deduction and depreciation and casualty losses and how you used it and when you sold it and the sale price and the expenses of the sale.
• Employment taxes. Publication 583 points to Publication 15 for the list. Keep the records for the employment-tax period below.
• Travel and gifts and transportation. Publication 583 says specific rules apply and points to Publication 463.

If you have no canceled check, Publication 583 says a financial account statement can prove payment when it is easy to read. A check payment needs the check number and the amount and the payee’s name and the date the bank posted it. An electronic transfer needs the amount and the payee’s name and the date posted. A credit card line needs the amount and the payee’s name and the transaction date.

The SBA describes two ways to record a purchase. Accrual records the sale when it is complete. Cash records the sale when the money arrives. In the SBA’s example a January sale paid in February lands on January’s books under accrual and on February’s books under cash. The supporting paper has to match the method you use. A deposit slip with no invoice will not show the source.

Use a business checking account for the business. Publication 583 says to deposit each day’s receipts there and to note the source of each deposit. Reconcile the account when the bank statement arrives so the statement and the checkbook and the books agree.

If you run more than one business, Publication 583 says to keep a complete and separate set of records for each. A corporation should keep minutes of board meetings.

Who you ask and what you ask them to send

A compliance document collection fails when the request says “send everything.” Name the year and the type and the proof you need.

Clients. Ask for the invoice and the proof of payment for that job. If they paid you and issued a 1099, ask for that form as well. Publication 583 lists Forms 1099-MISC and 1099-NEC as gross-receipt documents. That is client document collection. It is not a dump of their whole archive.

Partners. Ask for the records of that entity and keep them apart from any other business you own. SCORE’s article on what to keep and what to shred says to hold partnership or LLC partnership agreements and amendments in hard copy for the life of the partnership. It says S corporation acceptance letters and Form 2553 should be kept with no end date. Those are SCORE’s file rules. They are not rows in Publication 583’s limitation table.

Team members. The SBA’s hiring example has each new employee complete a W-4. The owners examine documents for Form I-9 and keep the I-9. They do not send the I-9 to the federal government. The same example says the IRS requires employment-tax records for at least 4 years. In that example the owners report new hires to the state directory within 20 days because their state requires it. Your state can differ. Ask the state.

SCORE’s article on an audit says to separate business files and personal files. Mixed personal papers in a home office can stand out to an auditor. A business recordkeeping form should ask for business documents. It should not invite personal files into the same folder.

How long organized compliance records stay

Publication 583 says you keep records as long as they may be needed for the tax law. For an item of income or a deduction that means until the period of limitations for that return ends. Returns filed before the due date count as filed on the due date. Keep copies of filed returns. They help the next return and an amended return.

Publication 583’s table works like this.

• You owe more tax and the special cases below do not apply. The period is 3 years.
• You do not report income you should report and the missing amount is more than 25 percent of the gross income on the return. The period is 6 years.
• You file a fraudulent return. The period has no limit.
• You do not file a return. The period has no limit.
• You file a claim for a credit or a refund after you filed the return. The period is the longer of 3 years or 2 years after the tax was paid.
• You claim a loss from worthless securities or a bad debt. The period is 7 years.

Employment tax records last at least 4 years after the date the tax becomes due or is paid. Use the date that falls farther out.

Asset records last until the limitation period ends for the year you dispose of the property in a taxable sale or other taxable disposition. You need them for depreciation and for gain or loss. If you received the property in a nontaxable exchange, Publication 583 says your basis is the basis of the property you gave up plus any money you paid. Keep the records of the old property and the new property until the period ends for the year you dispose of the new property in a taxable disposition.

When the tax period ends, do not throw the file out until you check other duties. Publication 583 gives insurance companies and creditors as examples of people who may want the records longer than the IRS. The SBA says you may be required to keep tax and employment records and other files. It calls a span of 3 to 7 years a common guideline. That guideline is not a substitute for the table above.

SCORE’s keep-or-shred article tells small businesses to hang onto returns and supporting documents for at least 7 years. The same article says a Form 1040 and supporting papers can be stored for a minimum of 3 years and that Schedule K-1 papers for an S corporation or a partnership should be held for a minimum of 6 years. It says employee records can be stored for a minimum of 7 years to be safe. That 7-year employee line is longer than the 4-year employment-tax period in Publication 583. Use Publication 583 for the tax period. Use SCORE’s list as a prompt to ask your accountant before you shred. SCORE says to make that check.

A form that can collect compliance documents

The request should say what to upload and what file type you accept and what you will do after it arrives. Cognito Forms tells you to put that in the field label and in help text. Its examples of labels are “Upload Supporting Documents” and “Upload Signed Contract.” People hesitate when the ask is vague. A clear label is how you collect compliance documents the first time.

Cognito says you can limit the field to certain types. A field for documents can allow PDF and DOCX. A field for PDF files can allow PDF. If you leave the type list blank, Cognito allows the other types and blocks executable files. The default cap is 20 files in one upload field if you leave that setting blank. Cognito’s field reference says one file can be as large as 100MB on the Individual plan and 250MB on the Pro and Team and Enterprise plans. Email notices can attach files up to a total of 17MB. A larger file stays in the account and you download it after you log in.

Cognito says uploaded files keep the name the person gave them. You cannot rename them in the field. Ask for a naming pattern in the help text if you need the name 2024 invoice 1042 and the file arrives named scan.pdf. That pattern is your instruction. It is not a Cognito rename tool.

Cognito says files are encrypted at rest and the connection uses HTTPS. You can turn on extra encryption for a form. That extra layer covers submissions that arrive after you turn it on. Older entries stay at the baseline. You can protect the upload field so the file is not sent out in an email notice. Team members download it from the entries after they log in.

Cognito can copy files to Google Drive or OneDrive or SharePoint. The copy is a second file. A new submission adds files. It does not replace the copy you have. Deleting the file in Cognito does not delete the cloud copy.

None of that is an IRS electronic storage system by itself. Publication 583 says an electronic system has to index and store and preserve and retrieve and reproduce the records in a format a person can read. The record has to be complete and accurate and accessible to the IRS. The same retention rules apply as for paper. The IRS may test the equipment and the index and the software and the retrieval. That test is not an exam and the IRS must share the results with you. If the system fails the test you can face penalties unless you keep the original paper in a way that lets you and the IRS determine the correct tax. You may destroy the paper after the system has been tested and your procedures keep it in compliance. You remain responsible for any other books the rules require you to keep. Publication 583 points to Revenue Procedure 97-22 for the detail.

A compliance form template can gather the year’s invoices. It does not by itself meet that storage test. After the upload, file the document by year and by income or expense the way Publication 583 describes. Keep a path the IRS can open.

If the letter arrives

SCORE’s home-business audit article says the IRS alerts you by mail. It does not alert you by phone or by email. The audit can be by mail or in person at an IRS office or at your office. You have 30 days to respond. Tell your tax preparer before you answer. They may answer for you or go with you. If you prepared the return yourself, SCORE says it is worth hiring a CPA or another qualified preparer.

During the audit the agent may request records for the past 3 years. If back taxes are a concern the agent may request 10 years. Have paper and digital files in an order that lets you produce what they ask for.

A second SCORE article says to review the letter with your accountant. It says tax you owe keeps growing until the audit is resolved. When you send documents, compile what they asked for. That article’s list is an income statement and an expense statement and Schedule C if you are a sole proprietor and receipts and other supporting documents and other statements that show the finances. Give them what they request. Do not add extra files. Do not hold back a requested file. Do not send originals. Make copies.

Audit ready documents are the copies you can pull by year and by type. They are not a box of mixed scans.

A week of requests

1. Pick the year and the items a return would have to support. Use income and expenses and assets and payroll if you have employees.
2. List the document that proves each item. An invoice plus proof of payment is the pair Publication 583 describes.
3. Send a regulatory document form or an audit document form that names the file and the year and the type. Limit the upload to PDF if that is all you can store in a readable way.
4. Tell the person what you will do with the file. Cognito says that line belongs in the help text.
5. File what arrives by year and by income or expense. Keep business files apart from personal files.
6. Note the destruction date from Publication 583’s table. Check an insurer or a creditor or your accountant before you shred.
7. If a notice comes, answer within 30 days with copies of what it lists.

You can host that audit document form as a link with Jotform. The client or the teammate opens the link and sends the named file. You file it with the year it supports.

Pitfalls

The request says “send your records.” People send the wrong year or a photo of a screen. Name the document.

You keep the proof of payment and lose the invoice. Publication 583 says payment alone does not establish the deduction.

You mix two businesses in one folder. Publication 583 requires a separate set of records for each business.

You treat 7 years as the IRS rule for every file. SCORE’s keep-or-shred article uses 7 years as a cautious hold for returns and for employee papers. Publication 583 uses 3 years or 6 years or 4 years or 7 years or no limit depending on the item.

You destroy paper and the electronic file cannot be read. Publication 583 says the system has to reproduce a readable record the IRS can reach. If it cannot, keep the paper.

You email a tax file as an attachment. Cognito’s guide is about collecting files on a form so they do not travel as mail attachments. Protect the field if the tool you use has that control. These sources do not say email is banned in every case. They do say the record has to stay safe and available.

You answer a phone call that claims to be an audit. SCORE says the IRS alerts you by mail.

You send originals. SCORE says to send copies.

Trade-offs

Paper versus an electronic system. Paper is simple to hand to an auditor. An electronic system can be the official record if it meets Publication 583’s tests. You may then destroy the paper. Until you have tested that system, keep both.

A short request versus a full archive. A named file for one year is easy to finish. A demand for every document the person has ever held will stall. Ask for the documents that support the return or the audit list.

SCORE’s 7-year habit versus the IRS table. Holding everything 7 years can cover the bad-debt case and SCORE’s employee-file caution. It can keep files you could have dropped after 3 years. It does not cover a fraudulent return or a missing return. Those have no time limit in Publication 583. Pick the period that matches the item.

Three years of audit copies versus 10. SCORE says a routine request may cover 3 years and a back-tax concern may cover 10. Build the recent years so you can produce them in the 30-day window. Do not assume a 3-year file answers a 10-year request.

A form link versus a portal login. Cognito says a login can tie the upload to a known person. A link is easier to send and easier for the wrong person to open. Use a login when the file is sensitive. Say who should open it either way.

What you do next

You can pull a year of invoices without a search through email. You can tell a preparer which files support which line. You can answer a mail notice with copies.

Set the retention date when the file arrives. Check Publication 583 before you shred. Check your accountant when SCORE’s longer holds and the IRS table do not match.

If you want one link for the document request form, Jotform can hold it. The decision about how long to keep the file stays with you.