How long do we need to keep invoices, approvals, and payment records?

The IRS generally expects records supporting a tax return to be kept until the period of limitations runs - typically three years, extended to six if income is substantially understated, and indefinitely for fraudulent or unfiled returns - which is why a conservative seven-year baseline is common. Digital records are acceptable: the IRS and most authorities recognize legible, accurate, accessible electronic copies, so you generally don't need paper originals if your scans are complete and retrievable. The caveat is that the digital record must be the real record - captured at the source, not a degraded photo - and your system must be able to produce it on demand for the full retention period.

Yes - and this is where many retention schedules quietly fail. An invoice kept seven years with an approval log purged after one loses its evidentiary value for years two through seven: you can prove the liability existed but not that it was authorized. Retain the full approval trail (who approved, when, at what amount, comments, delegations) for at least as long as the underlying document, and confirm that any system you decommission carries the activity history into the archive, not just the invoice images.

Three years is the baseline period of limitations, six if income is materially understated, and indefinite for fraud or unfiled returns. Most companies adopt seven years as a safe blanket policy for AP documents, adjusting upward where other rules (employment, contracts, industry regulation) require longer.

Generally no - complete, legible, accessible electronic copies are accepted for tax and audit purposes. Keep the originals only where a specific law or contract demands a wet-ink original (rare for invoices). The control requirement shifts to ensuring the digital record is faithful, complete, and retrievable for the full period.

List each record type (invoices, POs, receipts, approval evidence, payment records, vendor tax forms, correspondence), assign a retention period per the longest applicable requirement, define where it's stored and who owns it, and specify the disposition method and trigger at end of life. Review it periodically and align it with your overall records policy.

Export the complete record before access ends - invoices, documents, and crucially the activity/approval history, not just images - and verify the archive is complete and retrievable against the retention schedule. Confirm format usability for the full retention horizon. A decommissioning that drops the audit trail destroys evidence you're still required to hold.

A legal hold suspends scheduled destruction for records relevant to anticipated or active litigation, investigation, or audit - those records must be preserved regardless of their normal end-of-life date until the hold lifts. Build the ability to suspend disposition for specified records, and document who can issue and release holds; destroying held records is spoliation.

Often yes, and longer - government contracts and grants commonly impose extended retention (frequently several years past contract or grant closeout) and stricter documentation standards. Check the specific contract/grant terms and applicable regulations; default to the longest applicable period across all your obligations.

Yes - states vary, and other countries impose their own (often longer) commercial and tax retention requirements, sometimes with data-residency implications. For multi-jurisdiction operations, set retention to the longest applicable requirement per record population, and factor in where the data may legally be stored.

Through a documented, authorized disposition process: confirm no legal hold applies, verify the retention period has fully elapsed, destroy securely (especially anything with personal or banking data), and keep a record of what was destroyed, when, and under whose authority. Ad hoc deletion is as much a control gap as keeping everything forever.

Stampli keeps the complete record together - the invoice, its documents, coding history, and the immutable approval trail live as one retained object, so retention covers the evidence and the authorization, not just the document. Invoice data can be exported when records need to move to an archive or be produced for auditors. Because the activity history is part of the invoice record rather than a separable log, the common failure mode - keeping the invoice but losing the approval evidence - doesn't occur by design.