A folder of receipts is not a records system. A defensible record preserves content, context, approval, integrity, retrieval, retention authority, and a controlled end of life.
Define the evidence packet
For purchases, preserve request, contract or order, invoice, receipt of goods or service, approval, payment confirmation, tax treatment, ledger code, and related-party declaration where relevant. Revenue needs contract, performance evidence, invoice, collection, and recognition basis.
Assign immutable evidence IDs and link rather than duplicate files. Capture creator, approver, event date, legal entity, transaction currency, amount, version, checksum or audit log, and access classification.
Build retention from authority
A schedule should name record class, jurisdiction, legal or contractual authority, start event, minimum period, privacy limit, litigation hold, owner, repository, and approved disposal method. Do not copy one country's tax period across all records.
IRS guidance explains U.S. tax substantiation, while regulated firms may face longer SEC or sector rules. Local tax, payroll, company, privacy, insolvency, sanctions, grant, and investor obligations must be mapped separately.
Test retrievability and completeness
Worked June 2026 test: select 40 ledger entries across value bands and currencies. Thirty-four packets are complete, five lack at least one required element, and one has no support; completeness is 85%, explicitly a case result rather than a benchmark.
Assumptions: the ledger population is complete, evidence requirements were approved before sampling, links were tested with reviewer access, and amounts remain in transaction currency with a dated USD translation only for aggregation. Record missing fields individually; a single percentage hides severity.
- Entries tested40 count
- Complete34 count
- Partial5 count
- Missing1 count
ISO 15489 Records Management (2026-06). Worked 40-entry test, not an expected error rate.
Protect, hold, and dispose
Use least-privilege access, encryption, backups, version history, export tests, and monitored deletion. Separate preparation from approval and ensure departures do not remove business records or encryption keys.
Sensitivity: if five partial packets are remediated, completeness reaches 97.5%; the one absent packet still needs root-cause review. A legal hold suspends routine disposal, while privacy law may prohibit indefinite retention; local advice resolves the conflict.
Frequently asked questions
Are bank statements enough?
No. They prove movement, not necessarily business purpose, authorization, receipt, or tax treatment.
Can email be the archive?
It can be evidence, but records need controlled capture, access, retention, and retrieval independent of one mailbox.
How long should records be kept?
Use the longest applicable, justified requirement per class and jurisdiction, subject to privacy and holds.
Should originals be scanned?
Where law permits, verify image completeness, metadata, integrity, legibility, and disposal authority first.
Answers to the questions this topic usually leaves hanging.
How we sourced this
Every statistic in A Financial Record Must Prove the Event and Its Approval is attributed. Where a number is an estimate rather than a census, the note says so.
- IRS recordkeeping guidanceOfficial U.S. tax record substantiation guidance.
- ISO 15489 records managementInternational records-management concepts and controls.
- SEC books and recordsExample of sector-specific official retention duties.
- NARA records managementAuthoritative lifecycle and disposition practices.
Primary sources used for this edition.
The bottom line
Trace one material ledger entry from approval to evidence, payment, and retention rule.
If you want the adjacent decisions after A Financial Record Must Prove the Event and Its Approval, start with Financial controls, Legal documentation, Financial Metrics Every Startup Should Track, Financial Performance Benchmarking.
