Data Room Retention Policies: What Auditors Must Keep and for How Long

Here's a question most audit firms answered casually until recently: when the engagement wraps, what happens to the data room?

It used to not matter much, because the data room wasn't the evidence; the printed or PDF'd workpapers were. But once your PBC collection, version history, and client correspondence all live in a room, the room itself is audit documentation. Which means documentation retention rules apply to it, the same rules that carry disciplinary and, post-Sarbanes-Oxley, criminal teeth.

This guide lays out what the rules actually require, what specifically to keep from a data room, the archive-versus-live decision, and a policy template you can adapt.

Standard disclaimer: this is practitioner guidance, not legal advice. Your firm's retention policy should be reviewed by counsel, especially if you practice in multiple states or audit issuers.

The Retention Rules That Apply

PCAOB: 7 Years (Issuer Audits)

For audits of public companies, PCAOB Auditing Standard 1215 (formerly AS 3) requires audit documentation to be retained for 7 years from the report release date. Complete assembly of the final documentation set must happen within 45 days of release, and after that date, nothing may be deleted, though additions (properly documented) are allowed.

Sarbanes-Oxley Section 802 sits behind this with criminal penalties for destruction of audit workpapers, and SEC Rule 2-06 of Regulation S-X separately requires retention of records relevant to the audit, including those that are inconsistent with final conclusions. That last clause matters for data rooms: superseded versions of a client schedule can fall inside it.

AICPA and State Boards: 5 Years (Private Company Audits)

For non-issuer audits, AU-C 230 requires retention "not shorter than five years from the report release date," with document assembly complete within 60 days. State boards of accountancy layer on their own minimums, mostly 5 years, some 7, and a few with quirks (California's rules, for instance, are notably specific about what must be retained and produced on demand). Multi-state firms should apply the longest rule in play, which in practice usually means running a single 7-year standard.

Other Regimes That Can Extend the Clock

• Department of Labor (EBSA): ERISA's general records provision reaches 6 years for benefit plan filings; many firms keep plan audit files 7
• Government audits (Yellow Book / Uniform Guidance): retention follows the award terms, commonly 3 years from final expenditure report, but the audit standard's own rule still applies on top
• Litigation holds: any pending or reasonably anticipated litigation, investigation, or subpoena freezes deletion regardless of the schedule. Your policy needs a hold mechanism, not just a calendar
• Tax workpapers: not audit documentation, but firms commonly align tax file retention to the same 7-year clock for simplicity

What in the Data Room Counts as Audit Documentation

Not everything in the room is workpapers, but more of it qualifies than most firms assume. Sort the contents into three buckets:

Bucket 1: Clearly audit documentation (must retain)

• Client-provided evidence: the PBC deliverables themselves, every version that was subject to audit procedures
• The request list with final statuses, showing what was asked for and received
• The activity log: who uploaded what, when, and which versions the team accessed
• Q&A threads and rejection notes that document the back-and-forth on evidence

That activity log deserves emphasis. It's the receipt trail proving when evidence arrived and which version was tested, exactly the chain described in our guide to running PBC lists through a data room. If you retain the documents but discard the log, you've kept the evidence and thrown away its provenance.

Bucket 2: Judgment calls (define in policy)

• Superseded versions the team never used in procedures
• Administrative chatter (scheduling messages, reminder notifications)
• Duplicate uploads

The safe default, given SEC Rule 2-06's reach and cheap storage, is to keep the full export and let the whole thing age out together.

Bucket 3: Not audit documentation (governed by other obligations)

• Engagement letters and billing (firm business records, own schedule)
• Personal data subject to privacy law deletion duties, which is where retention rules and GDPR-style minimization collide. The resolution: legal retention obligations override deletion requests for the retention period, but you must be able to say so precisely, which requires knowing exactly what personal data the room holds.

Archive vs Live: The 45/60-Day Decision

At report release, you have two options, and the wrong choice is the expensive one.

Option A: Keep the room live for the retention period. Tempting because it's zero effort. It's also fragile: you're betting that the vendor exists, that you remain a customer, and that the platform's own data handling matches your obligations for 7 years. Vendors get acquired, plans lapse during a switch, and "the room was deleted when the subscription ended" is not a sentence you want to say to an inspector. If you take this route, get the retention guarantee in the contract, not the sales deck.

Option B: Export at assembly and archive under your own control. This is the defensible default. Within the 45-day (PCAOB) or 60-day (AICPA) assembly window:

1. Export the complete room: all documents including version chains, folder structure intact
2. Export the activity log and request list (CSV or PDF), covering the full engagement period
3. Export Q&A threads with timestamps
4. Verify the export: spot-check that version history survived (some platforms export only latest versions by default, a nasty trap; test this before you buy, and it's on the evaluation checklist in our guide to the best data room for audits and accounting firms)
5. Lock the archive: store in your document management system or WORM-capable storage with access controls, indexed by client, engagement, period, and destruction date
6. Then delete the live room on schedule, and document the deletion

Ask vendors two pointed questions before signing: "Does a full export preserve version history and audit logs?" and "What happens to our data 90 days after subscription end?" Providers like Ansarada offer structured end-of-engagement archive exports for exactly this workflow; on flat-fee platforms like Firmex, confirm what the archive terms are for rooms you close mid-subscription.

Why Deletion Is Also a Duty

Retention policies fail in both directions. Keeping everything forever feels safe and isn't:

• Discovery exposure: everything you hold is discoverable. A 12-year-old superseded schedule can only hurt you in litigation you haven't imagined yet.
• Privacy liability: payroll registers and HR censuses are personal data. Holding them past legal necessity is itself a compliance failure in a growing number of jurisdictions, and it fattens the impact of any future breach.
• Cost and sprawl: a decade of unmanaged room archives is exactly the multi-client mess described in our piece on secure multi-client document management.

The mature posture is symmetric: keep everything the rule requires for exactly as long as it requires, then destroy it on schedule, verifiably, unless a hold applies.

A Retention Policy Template

Adapt this skeleton with counsel:

1. Scope. Audit documentation includes all engagement evidence in any system: workpaper software, data rooms, portals, and email pulled into the file.

2. Periods.

Engagement type	Retention	Clock starts
Issuer audits (PCAOB)	7 years	Report release date
Private company audits/reviews	7 years (5-year floor)	Report release date
Benefit plan audits	7 years	Report release date
Government/single audits	Longer of standard or award terms	Per award
Terminated engagements	Same as completed	Date of termination

3. Assembly. Data room export completed within 45 days (issuers) / 60 days (others) of release, using the six-step export procedure above. Engagement manager certifies completeness; certification is itself retained.

4. Post-assembly changes. No deletions after the documentation completion date. Additions documented with date, name, and reason.

5. Legal holds. Any partner learning of pending or anticipated litigation, investigation, or subpoena notifies the general counsel/risk partner, who suspends destruction for affected files. Holds override the schedule, always.

6. Destruction. Annual destruction cycle for files past their date and not under hold. Destruction is logged (client, engagement, period, date, method, approver) and the log is retained permanently.

7. Vendor terms. Data room contracts must guarantee full-fidelity export (versions and logs) and define post-termination data handling. Confirmed annually.

The Bottom Line

The moment your evidence collection moved into a data room, the room joined the audit file, and the audit file has rules: assemble within 45 or 60 days, keep 7 years for issuers and at least 5 for everyone else, freeze on any hint of litigation, and destroy on schedule when the clock runs out.

The operational core is the export: full documents, full version chains, full activity logs, under your own control, verified before the live room dies. Firms that build that export into engagement wrap-up spend an hour per engagement on it. Firms that don't will spend considerably more than an hour explaining to an inspector where year three went.