Compliance

SOX Record Retention Requirements: What to Keep and for How Long

November 12, 2026 | 7 min read

Most guides answer “how long do we keep SOX records?” with a single number: seven years. That number is right, but it comes from a rule written for auditors, and the rule that most often catches companies out has no number at all. This guide separates the two, lists the records public companies usually keep, and gives a retention schedule you can adapt.

Quick answer

→Auditors: keep audit records for 7 years after the audit or review is concluded (SEC Rule 2-06 of Regulation S-X, adopted under SOX Section 802; PCAOB AS 1215 also requires 7 years).
→Public companies: SOX sets no single period for every company record. Most keep financial records and internal control evidence for 7 years to match their auditors.
→Never destroy records that relate to an actual or expected federal investigation: that is a crime under 18 U.S.C. 1519, with up to 20 years in prison.

What SOX actually says about record retention

Section 802 of the Sarbanes-Oxley Act added two sections to the U.S. criminal code. 18 U.S.C. 1520 requires accountants who audit an issuer to keep their audit and review workpapers, and it told the SEC to write the detailed rule. 18 U.S.C. 1519 makes it a crime for anyone to destroy, alter or falsify a record with intent to obstruct a federal investigation.

The SEC’s rule is Rule 2-06 of Regulation S-X. It requires auditors to keep records relevant to an audit or review for seven years after the audit or review is concluded. The proposal said five years; the final rule settled on seven. The PCAOB’s auditing standard on audit documentation, AS 1215, also requires seven years.

Rule 2-06 is broader than “workpapers”. It covers the documents that form the basis of the audit, and memos, correspondence, communications and other records, electronic ones included, that are created, sent or received in connection with the audit and contain conclusions, opinions, analyses or financial data.

Which records a public company should keep

The seven-year rule binds your auditor, but your auditor’s file is built from your records. If you delete a reconciliation or an approval after two years, you cannot support an audit, a restatement or an SEC inquiry that reaches back further. That is why most companies align their own schedule with the auditor’s seven years. The records that usually matter:

→Financial statements and filings. Annual and quarterly reports, the supporting trial balances and consolidation workpapers.
→General ledger and journal entries. Including who prepared and who approved each manual entry.
→Account reconciliations. With preparer and reviewer sign-off and the supporting detail.
→Internal control documentation. Control descriptions, the SOPs behind them, walkthroughs, test evidence and remediation of deficiencies (Sections 302 and 404).
→System logs for financial applications. Access provisioning, privileged access and change management records that show IT general controls worked.
→Board and audit committee materials. Minutes, presentations and communications with the auditor.
→Email and messages about financial reporting. SOX does not name email, but these are often the evidence of a decision or approval.

A practical SOX retention schedule

This schedule shows what is required and what is common practice. Use it as a starting point with your legal and audit teams; local, tax and industry rules (for example SEC Rule 17a-4 for broker-dealers) can require longer.

Record	Typical retention	Basis
Auditor workpapers and audit records	7 years after the audit or review concludes	Required: SEC Rule 2-06, PCAOB AS 1215
Annual reports and audited financial statements	Permanently	Common practice
General ledger, journal entries, reconciliations	7 years	Common practice, matches the auditor’s period
Internal control documentation, SOPs and test evidence	7 years after the version is superseded	Common practice for Section 302 and 404 support
Access and change logs for financial systems	7 years where they evidence controls	Common practice for IT general controls
Email and messages about financial reporting	7 years	Common practice
Anything under a legal hold	Until the hold is released	Required: 18 U.S.C. 1519 and court rules

Legal holds come before any schedule

Section 1519 has no retention period. It applies whenever a record is destroyed “in relation to or contemplation of” a federal matter, which means an investigation does not have to have started. When litigation, a subpoena or an inquiry is reasonably expected, suspend deletion for the relevant records, including automated deletion jobs, and document that you did.

Making retention auditable

Auditors test retention the same way they test any control: is there a written procedure, and is there evidence it was followed?

→Write the schedule down with an owner for each record type and the reason for each period.
→Automate deletion only with exceptions built in: legal holds must stop the job, and the job should log what it deleted.
→Document the procedures themselves. The SOP for month-end close or access reviews is control evidence, and it needs its own version history.
→Review once a year and after any change in systems, regulators or business lines.

Where Claudia fits

Claudia records a procedure as you do it in the browser, such as a journal entry approval or a quarterly access review, and turns it into a numbered SOP with a screenshot for each step. Recordings stay on your device, and Claudia deletes them after 90 days by default, so it is not a retention system: export each SOP as a printable guide or a .zip, export the audit log as CSV, and keep both in the system that holds your seven-year records.

Frequently asked questions

How long must SOX records be retained?

For auditors of public companies, seven years after the audit or review is concluded: SEC Rule 2-06 of Regulation S-X, adopted under SOX Section 802, and PCAOB AS 1215 both set seven years. SOX does not set one period for every record a public company keeps, so most companies keep financial records and internal control evidence for seven years to match their auditors.

Does SOX require companies to keep emails for seven years?

SOX does not mention email by name. Email that forms part of the audit record, or that is relevant to an investigation, must be kept, and destroying it to obstruct an investigation is a crime under 18 U.S.C. 1519. Many public companies keep email about financial reporting for seven years as policy.

What is the penalty for destroying records under SOX?

Under 18 U.S.C. 1519, added by SOX Section 802, knowingly destroying, altering or falsifying records to obstruct a federal investigation is punishable by up to 20 years in prison. Under 18 U.S.C. 1520, an auditor who knowingly and willfully breaks the audit record retention rules faces up to 10 years.

Do SOX retention rules apply to private companies?

The seven-year rule in SEC Rule 2-06 applies to accountants who audit or review the financial statements of issuers, meaning public companies. Section 1519 is broader: it applies to anyone, including private companies, who destroys records to obstruct a federal investigation.

Sources

This article is for informational purposes only and does not constitute legal advice. Confirm your retention schedule with your legal counsel and auditors.