What are some of the implications of California CPA’s having to retain their workpapers for seven years after the report date (section 5097)? Accessibility, lockdown, and offsite backup seem to be three issues that make it more difficult that just keeping the files on your server for a long time.
Accessibility – You have to be able to get to your files for seven years. A major switch in software might make old formats unreadable. Say for example, a super-duper version of Windows comes out in a few years that means you cannot access those files created in XP. More seriously, say you jump to a new vendor for your audit workpapers. In that case, you have to keep the software for the old program around for seven years. Depending on the vendor, that means you might have to pay duplicate maintenance fees for seven years. Essentially being held hostage by your vendor would not be a good position. My backup protocol incorporates all mission critical software so I will have that software available for seven years.
Lockdown – You have to maintain the integrity of the files and document any changes to them. Watch out for how your software handles lockdown. I used software from one vendor that prohibited changing files and in the process the date was changed on all files to the lockdown date. The downside is that if you needed to change ANY file, such as making calculations on some workpapers for tax return preparation several months later, or documenting a conversation on how to post a certain adjustment, all the files had to be unlocked, and then relocked. This changed the visible lockdown date on every file in the audit. So it looked like I changed every file on the audit when I really only accumulated a few tax disclosures.
Offsite backup – If you have electronic documentation, which we probably all do now that paperless is so common, you have to maintain offsite backups. See section 68.5 of the regs. That would presumably be for seven years as well. My firm is small enough that I can use DVDs placed in a safe deposit box. Eventually I will have portable hard drives cycled offsite.
You don’t have to be very large to need to hit the web for offsite backup. Be careful of that requirement since seven years is a long time to keep data alive on the net with the rate of change and business mergers. You might also want to check the encryption issues and ponder whether you are inadvertently taking tax data outside the country. One popular web-based backup does not allow deletion of any old files — instead, it makes constant incremental backups. That doesn’t work for me because I don’t want permanent copies of every iteration of my workpapers.
Like I said, the seven-year documentation issue has some serious implications. Ponder them well.