Document Retention Policy (Nonprofit)
Drafts a board-adoptable document retention policy with legally grounded retention schedules, destruction protocols, and litigation hold procedures for nonprofit organizations.
Prerequisites
Gather before drafting:
- Organization details — name, state of incorporation, operating states, EIN, tax-exempt type
- Record inventory — types and volume (paper and electronic)
- Industry context — mission area for sector-specific regulations (healthcare, education, etc.)
- Federal grant status — whether org receives federal funds (triggers 2 CFR Part 200)
- Existing policies — any current retention or records management documents
Quick Start
- Collect prerequisites above
- Draft header block: policy title, effective date, version, board resolution reference, chair signature line
- Define scope: all personnel, all formats, adopted by board resolution
- Build retention schedule using the table below, adjusted for state requirements
- Add storage, destruction, litigation hold, and roles sections
- Close with review cadence and adoption block
Policy Sections
Scope
Applies to all employees, officers, directors, volunteers, and contractors. Governs all records in any format (paper, electronic, cloud).
Retention Schedule
Minimum periods — adjust upward for state-specific requirements.
| Category |
Examples |
Minimum Retention |
Authority |
| Tax Returns & 990s |
Form 990, 990-T, schedules |
Permanent |
IRS Rev. Proc. 98-25 |
| Tax Supporting Docs |
GL, receipts, donor records |
7 years |
IRC § 6501(e) |
| Governance |
Articles, bylaws, minutes, COI disclosures |
Permanent |
State nonprofit corp. statutes |
| Audit Reports |
External audit, management letters |
Permanent |
Best practice; grantor requirements |
| Bank & Financial |
Statements, reconciliations, AP/AR |
7 years |
IRC § 6501; UCC § 2-725 |
| Grant Records |
Applications, reports, budgets |
Per grant terms or 7 yrs after closeout |
2 CFR § 200.334; funder terms |
| Employment Tax |
W-2s, W-4s, 941s |
4 yrs after tax due/paid |
IRC § 6501(a); Treas. Reg. § 31.6001-1 |
| Personnel Files |
Applications, evaluations, termination docs |
7 yrs after separation |
Title VII; ADA; ADEA |
| I-9 Forms |
Employment verification |
3 yrs from hire or 1 yr after separation (later) |
8 CFR § 274a.2(b)(2)(i) |
| Payroll Records |
Timesheets, pay stubs |
7 years |
FLSA § 11(c); state wage laws |
| Benefits/ERISA |
Plan docs, SPDs, 5500s |
6 yrs after filing |
ERISA § 107 |
| Contracts & Leases |
Vendor agreements, MOUs, leases |
10 yrs after expiration |
Statute of limitations + buffer |
| Insurance Policies |
Policies, certificates, claims |
Permanent |
Occurrence-based claims |
| Program/Client Records |
Service delivery, case files |
7 yrs or per funder/licensing |
Sector regulation |
| Correspondence |
Substantive letters, emails |
3 years |
Operational (unless tied to above) |
| Electronic Backups |
System backups, databases |
Per source record category |
Mirror source retention |
Always verify state nonprofit corporation act and sector licensing (e.g., HIPAA = 6 yrs for PHI [VERIFY]).
Storage
Physical: Secure climate-controlled storage, restricted access, labeling tied to retention categories, annual inventory review.
Electronic: Encrypted storage with access controls and audit logging, automated backups (on-site + off-site/cloud), email retention aligned to schedule, version control for governance documents.
Destruction Protocol
- Records Manager confirms retention period expired
- Cross-check against active litigation holds
- Department head approves destruction list
- Execute: paper via cross-cut shredding; electronic via secure deletion/degaussing (NIST SP 800-88)
- Log: document type, date range, destruction date, method, authorized by, executed by
- Retain destruction logs permanently
Litigation Hold
Triggers: Anticipated litigation, subpoena, government investigation, audit, or regulatory inquiry.
- Executive Director or counsel issues written hold notice identifying matter, affected categories, and preservation obligations
- Distribute to all relevant staff and departments
- Suspend all destruction of identified categories immediately
- Confirm receipt and compliance in writing from each custodian
- Maintain hold until written release by counsel
Non-compliance risk: spoliation sanctions, adverse inference. 18 U.S.C. § 1519 (SOX § 802) may impose criminal penalties for obstruction [VERIFY applicability to org type].
Roles
| Role |
Responsibilities |
| Board of Directors |
Adopt policy; review biennially; approve amendments |
| Executive Director |
Overall compliance; authorize holds; approve destruction |
| Records Manager / CFO |
Maintain schedule; coordinate annual review; manage logs |
| Department Heads |
Identify records; ensure proper storage; flag expirations |
| All Staff & Volunteers |
Comply; report questions; preserve records under hold |
Review & Adoption
- Management review: annually; board review: every two years or upon material legal changes
- Amendments require board approval with version tracking
- Staff training at adoption and upon substantive amendment
- Include adoption block: board resolution date, chair signature, effective date, version number
Pitfalls
- State variations — retention periods differ by state; verify incorporation state and all operating states
- Federal grantees — 2 CFR Part 200 Subpart D applies; retention runs from final expenditure report, extends if audit findings unresolved
- Donor records — IRC § 170 substantiation may require permanent retention of gift instruments and pledges
- Sector overlays — HIPAA, FERPA, child services regulations may exceed general minimums; flag for separate analysis
- No compliance gap advice — flag existing issues for counsel review, do not opine
- Plain language — policy must be implementable by non-lawyers
- Mark uncertainties with [VERIFY], especially state-specific statutes and sector regulations
1---2name: document-retention-policy3description: Drafts board-adoptable document retention policies for nonprofit organizations with IRS-grounded retention schedules, destruction protocols, and litigation hold procedures. Use when creating retention policies, records management governance, document destruction schedules, or compliance frameworks for 501(c)(3) and other tax-exempt entities.4---5
6# Document Retention Policy (Nonprofit)
7
8Drafts a board-adoptable document retention policy with legally grounded retention schedules, destruction protocols, and litigation hold procedures for nonprofit organizations.
9
10## Prerequisites
11
12Gather before drafting:
13
14- **Organization details** — name, state of incorporation, operating states, EIN, tax-exempt type
15- **Record inventory** — types and volume (paper and electronic)
16- **Industry context** — mission area for sector-specific regulations (healthcare, education, etc.)
17- **Federal grant status** — whether org receives federal funds (triggers 2 CFR Part 200)
18- **Existing policies** — any current retention or records management documents
19
20## Quick Start
21
221. Collect prerequisites above
232. Draft header block: policy title, effective date, version, board resolution reference, chair signature line
243. Define scope: all personnel, all formats, adopted by board resolution
254. Build retention schedule using the table below, adjusted for state requirements
265. Add storage, destruction, litigation hold, and roles sections
276. Close with review cadence and adoption block
28
29## Policy Sections
30
31### Scope
32
33Applies to all employees, officers, directors, volunteers, and contractors. Governs all records in any format (paper, electronic, cloud).
34
35### Retention Schedule
36
37Minimum periods — adjust upward for state-specific requirements.
38
39| Category | Examples | Minimum Retention | Authority |
40|---|---|---|---|
41| Tax Returns & 990s | Form 990, 990-T, schedules | Permanent | IRS Rev. Proc. 98-25 |
42| Tax Supporting Docs | GL, receipts, donor records | 7 years | IRC § 6501(e) |
43| Governance | Articles, bylaws, minutes, COI disclosures | Permanent | State nonprofit corp. statutes |
44| Audit Reports | External audit, management letters | Permanent | Best practice; grantor requirements |
45| Bank & Financial | Statements, reconciliations, AP/AR | 7 years | IRC § 6501; UCC § 2-725 |
46| Grant Records | Applications, reports, budgets | Per grant terms or 7 yrs after closeout | 2 CFR § 200.334; funder terms |
47| Employment Tax | W-2s, W-4s, 941s | 4 yrs after tax due/paid | IRC § 6501(a); Treas. Reg. § 31.6001-1 |
48| Personnel Files | Applications, evaluations, termination docs | 7 yrs after separation | Title VII; ADA; ADEA |
49| I-9 Forms | Employment verification | 3 yrs from hire or 1 yr after separation (later) | 8 CFR § 274a.2(b)(2)(i) |
50| Payroll Records | Timesheets, pay stubs | 7 years | FLSA § 11(c); state wage laws |
51| Benefits/ERISA | Plan docs, SPDs, 5500s | 6 yrs after filing | ERISA § 107 |
52| Contracts & Leases | Vendor agreements, MOUs, leases | 10 yrs after expiration | Statute of limitations + buffer |
53| Insurance Policies | Policies, certificates, claims | Permanent | Occurrence-based claims |
54| Program/Client Records | Service delivery, case files | 7 yrs or per funder/licensing | Sector regulation |
55| Correspondence | Substantive letters, emails | 3 years | Operational (unless tied to above) |
56| Electronic Backups | System backups, databases | Per source record category | Mirror source retention |
57
58Always verify state nonprofit corporation act and sector licensing (e.g., HIPAA = 6 yrs for PHI [VERIFY]).
59
60### Storage
61
62**Physical:** Secure climate-controlled storage, restricted access, labeling tied to retention categories, annual inventory review.
63
64**Electronic:** Encrypted storage with access controls and audit logging, automated backups (on-site + off-site/cloud), email retention aligned to schedule, version control for governance documents.
65
66### Destruction Protocol
67
681. Records Manager confirms retention period expired
692. Cross-check against active litigation holds
703. Department head approves destruction list
714. Execute: paper via cross-cut shredding; electronic via secure deletion/degaussing (NIST SP 800-88)
725. Log: document type, date range, destruction date, method, authorized by, executed by
736. Retain destruction logs permanently
74
75### Litigation Hold
76
77**Triggers:** Anticipated litigation, subpoena, government investigation, audit, or regulatory inquiry.
78
791. Executive Director or counsel issues written hold notice identifying matter, affected categories, and preservation obligations
802. Distribute to all relevant staff and departments
813. **Suspend all destruction** of identified categories immediately
824. Confirm receipt and compliance in writing from each custodian
835. Maintain hold until written release by counsel
84
85Non-compliance risk: spoliation sanctions, adverse inference. 18 U.S.C. § 1519 (SOX § 802) may impose criminal penalties for obstruction [VERIFY applicability to org type].
86
87### Roles
88
89| Role | Responsibilities |
90|---|---|
91| Board of Directors | Adopt policy; review biennially; approve amendments |
92| Executive Director | Overall compliance; authorize holds; approve destruction |
93| Records Manager / CFO | Maintain schedule; coordinate annual review; manage logs |
94| Department Heads | Identify records; ensure proper storage; flag expirations |
95| All Staff & Volunteers | Comply; report questions; preserve records under hold |
96
97### Review & Adoption
98
99- Management review: **annually**; board review: **every two years** or upon material legal changes
100- Amendments require board approval with version tracking
101- Staff training at adoption and upon substantive amendment
102- Include adoption block: board resolution date, chair signature, effective date, version number
103
104## Pitfalls
105
106- **State variations** — retention periods differ by state; verify incorporation state and all operating states
107- **Federal grantees** — 2 CFR Part 200 Subpart D applies; retention runs from final expenditure report, extends if audit findings unresolved
108- **Donor records** — IRC § 170 substantiation may require permanent retention of gift instruments and pledges
109- **Sector overlays** — HIPAA, FERPA, child services regulations may exceed general minimums; flag for separate analysis
110- **No compliance gap advice** — flag existing issues for counsel review, do not opine
111- **Plain language** — policy must be implementable by non-lawyers
112- **Mark uncertainties** with [VERIFY], especially state-specific statutes and sector regulations
CaseMark