Part of our Compliance Guide series
Good record keeping protects your business during audits, compliance checks, and legal issues. This guide covers what to maintain and for how long.
Why Records Matter
Legal Protection
- Demonstrate compliance during investigations
- Support defense against violations
- Prove due diligence
- Document training and procedures
Business Value
- Track inventory accurately
- Support tax filings
- Identify trends and issues
- Inform purchasing decisions
Essential Records
Age Verification Records
What to keep:
- ID scan logs (if using scanner)
- Refusal logs (sales refused due to age)
- Employee training documentation
- Compliance check results
Retention: 5+ years recommended
Employee Training Records
What to keep:
- Training dates and topics
- Trainer information
- Employee acknowledgment signatures
- Training materials used
- Certification documents
Retention: Duration of employment + 3-5 years
Purchase/Supplier Records
What to keep:
- Supplier invoices
- Purchase orders
- Shipping documents
- Payment records
- Supplier contact information
Retention: 7 years (tax purposes)
Product Documentation
What to keep:
- Certificates of Analysis (COAs) for CBD/hemp
- Product lab testing
- PMTA documentation for vape products
- Safety data sheets
Retention: While selling product + 5 years
Sales Records
What to keep:
- Daily sales reports
- Transaction logs
- Returns and exchanges
- Cash reconciliation
Retention: 7 years (tax purposes)
Tax Records
What to keep:
- Sales tax filings and payments
- Tobacco tax filings and payments
- Tax stamps/receipts
- Income tax documents
Retention: 7 years minimum
Licensing Records
What to keep:
- All license applications
- Current and past licenses
- Renewal documents
- Correspondence with agencies
Retention: Permanently (or duration of business + 7 years)
Retention Schedule Summary
| Record Type | Retention Period |
|---|---|
| Tax records | 7 years |
| Purchase invoices | 7 years |
| Employee training | Employment + 3-5 years |
| Age verification logs | 5+ years |
| Product testing/COAs | While sold + 5 years |
| Licenses | Permanent |
| Insurance policies | Permanent |
| Contracts/leases | Term + 7 years |
Organization Systems
Physical Records
- Organized filing system by category
- Fireproof storage for critical documents
- Consistent labeling
- Annual archiving of old records
Digital Records
- Cloud backup (multiple locations)
- Organized folder structure
- Consistent naming conventions
- Regular backup verification
POS System Records
- Ensure data is backed up
- Know how to export records
- Understand retention policies of provider
- Don't rely solely on POS—keep independent backups
Audit Preparation
What Auditors Want
- Organized, accessible records
- Complete documentation
- Clear audit trails
- Evidence of compliance procedures
Being Ready
- Know where everything is
- Keep records current
- Review periodically
- Address gaps proactively
Common Mistakes
Inadequate Retention
- Throwing away records too early
- Not backing up digital records
- Losing records in transitions
Poor Organization
- Can't find records when needed
- Inconsistent systems
- No backup copies
Incomplete Records
- Missing training documentation
- No age verification logs
- Incomplete purchase records
Frequently Asked Questions
Do I really need to keep records for 7 years?
For tax purposes, yes. IRS can audit up to 6 years back in some cases. 7 years provides safety margin.
What if I can't find old records?
This can be problematic during audits. Going forward, implement better systems. For past records, document what you have and note gaps.
Can I keep everything digitally?
Generally yes, but some documents (signed originals, licenses) may need physical copies. Check specific requirements.