Small Business Payroll Recordkeeping Checklist: What to Keep and How Long

Most owners treat payroll records as filing-cabinet hygiene. In a Wage and Hour investigation they are the case. The basic FLSA record set under 29 CFR Part 516 (the 14 records listed in DOL Fact Sheet #21) carries a three-year retention floor. Wage-computation records carry a two-year floor. Federal employment-tax records run four years. I-9s run the longer of three years after hire or one year after termination. ERISA plan records run six. Seven years is the safe default that swallows every federal rule and most state statutes of limitations on wage claims.

When an employee disputes hours or pay and the employer's records are missing or incomplete, wage-and-hour investigators and courts will often lean heavily on the employee's reasonable reconstruction of hours worked. DOL Fact Sheet #21 lists the records employers must keep, and inadequate records make the employer's defense much harder. Once the employee's reconstructed number becomes the operative number, the only thing left to argue about is how many pay periods to multiply it by.

A small employer's payroll archive should contain seven record categories, each with its own retention clock. The longest applicable rule always wins:

• Employee identification and classification records (W-4, state withholding certificate, offer letter, exempt/nonexempt memo): retain 4 years after separation
• Time and attendance records (punch logs, schedules, workweek definition): retain 2 years (FLSA wage-computation floor)
• Wage, deduction, and paystub records (pay-rate history, register, every pay-period wage statement): retain 4 years (tied to W-2)
• Federal and state tax filings (W-2, W-3, 941, 940, 1099-NEC, EFTPS confirmations, state SUTA returns): retain 4 years after the tax is paid (IRS Pub 15, IRC §6001)
• Benefits and §125 plan records (401(k) deferral elections, cafeteria-plan enrollments, Form 5500): retain 6 years (ERISA §107)
• I-9 employment eligibility forms, stored separately from personnel files: retain the longer of 3 years after hire or 1 year after termination
• Separation and termination records (final paycheck, COBRA notice, unemployment determination): retain 4 years from separation

A safe default is at least 7 years for everything in the archive. One year of buffer past the longest federal rule has saved more small employers than any clever filing scheme. To model the gross-to-net side of a hire before you make the offer, the MyStubs paycheck tax calculator runs each state's rates against the same gross.

#Why Payroll Recordkeeping Is a System, Not a Filing Drawer

A complete payroll record proves the employee existed, was paid at or above minimum wage on a verifiable schedule, received overtime when owed, and was issued a state-compliant wage statement. It also proves the employer remitted FICA, federal income tax, and quarterly and annual returns.

Every record serves one of three audiences, each with a different request pattern.

Meet Carla Maddox, bookkeeper-owner of Maddox Landscape Design, a six-employee firm operating in California, Nevada, and Oregon. Carla runs biweekly payroll out of Gusto. Her crew: three nonexempt landscape technicians, two exempt designers, one part-time office manager, plus four 1099 subcontractors handling irrigation installs. Every worked example below reconciles to her March 14, 2026 pay run.

#Document-by-Document Breakdown

The seven categories below are the spine of every audit-proof payroll archive. Each has a primary-source citation, "Use it when" bullets, a worked-dollar table tied to Carla's run, and a clarifying paragraph.

#1. Employee Identification and Classification

The IRS at Publication 15 requires every employer to keep a signed Form W-4, the state withholding equivalent (CA DE 4, NY IT-2104, OR W-4), a direct-deposit authorization, and the offer letter showing exempt or nonexempt status. 29 CFR §516.2 layers on identifying data: full name as used for SSA, home address, date of birth if under 19, sex, and occupation.

Use it when:

• You are onboarding any new W-2 employee
• An employee changes withholding, marital status, or address
• You reclassify an employee between exempt and nonexempt
• A DOL or state investigator opens a misclassification inquiry

Carla's identification file for Diego Vargas, a nonexempt landscape technician:

The single field DOL investigators scrutinize hardest is occupation paired with exempt status. This is where small employers get burned the most. A title like "office manager" doesn't by itself satisfy the executive, administrative, or professional exemption. Carla's signed duties-test memo sits in this folder alongside the W-4 for each exempt employee.

#2. Time and Attendance

Identification records prove who Diego is; time and attendance records prove what he worked, which is the input every wage calculation downstream depends on. 29 CFR §516.2 and §516.6 require employers to record each employee's workweek start, hours per workday, and total weekly hours, retained two years. The DOL Fact Sheet #21 treats time cards, punch logs, project codes, schedules, and PTO requests as wage-computation records.

Use it when:

• Any employee is nonexempt
• You operate in a state with mandatory meal- or rest-break attestations (CA, OR, WA, NY)
• A nonexempt employee disputes hours worked
• You compute overtime under a fluctuating workweek or weighted-average regular rate

For Carla's March 1-14 pay period, Diego's time card:

Carla's workweek memo, "Sunday at 12:00 a.m. through Saturday at 11:59 p.m.," was signed and dated the day she incorporated and sits at the front of this folder. FLSA investigators ask for it within the first ten minutes of any visit, because daily and weekly totals are meaningless without the workweek anchor. California meal-break waivers also live here.

#3. Wages, Deductions, and Paystubs

Diego's 78 regular hours and 6 overtime hours from bucket 2 become the gross wage, deductions, and paystub records here. These are the documents an employee, a court, or a state labor commissioner reads to verify the period was paid correctly. The wage-and-paystub bucket carries the heaviest state overlay. Federal law doesn't require an employer to issue a paystub at all. That mandate lives entirely in state law. California Labor Code §226 lists nine items; New York Labor Law §195.3 lists eight plus the WTPA wage notice; Washington and Massachusetts each have their own list. The 29 CFR §516.5 floor is 3 years, but the paystub PDF ties to the W-2 it rolls into, so the practical clock is 4 years.

Use it when:

• Any pay run is issued
• An employee asks for a copy of a prior paystub
• A wage claim or PAGA notice arrives
• You operate in California (§226), New York (§195.3), Washington, or Massachusetts

Carla's wage and paystub records for Diego, biweekly pay period ending March 14, 2026. Base rate $24.00/hour; 5% traditional 401(k) deferral; California is the work state, with CA income tax computed under the EDD DE 44 employer guide Method B (exact-calculation method, single filer, one regular allowance, biweekly payroll):

Note FICA applies to gross, not gross minus 401(k) deferral. The traditional 401(k) is exempt from federal income tax only, not FICA. This catches more first-year bookkeepers than any other line on the stub. The §226-compliant wage statement lists employer legal name and address, employee name with last four of SSN, pay-period dates, payday, hours at each rate, gross, itemized deductions, and net. Employees later reconstructing past paystubs can rebuild the same layout, which is what the MyStubs paystub generator is built to produce from real W-2 totals.

Diego is a worked-example employee inside Carla's records. The threaded character carrying this post is Carla (the bookkeeper-owner), and Diego's payroll line items are her records of one employee in one pay period. Carla is the accounting unit; Diego is documentation.

#4. Federal and State Tax Filings

The paystub bucket is the employee-facing record of each pay run. The tax-filings bucket is the agency-facing record showing Carla remitted what was withheld and matched it employer-side. IRS Publication 15 and IRC §6001 require employers to keep all employment-tax records for at least 4 years after the later of the due date or the payment date. The bucket includes every W-2, W-3, 941, 944, 940, 1099-NEC, 1096, state withholding return, state unemployment return, and EFTPS confirmation.

Use it when:

• A quarterly 941 is filed
• An annual W-2 or 1099-NEC is issued
• The IRS, state revenue department, or state workforce agency opens an audit
• You amend a prior return on Form 941-X or W-2c

Carla's Q1 2026 tax-filing artifacts:

Carla downloads every EFTPS confirmation the day the deposit clears and files it next to the 941 it supports. A late-paid Q1 941 that finally clears on June 30 carries its retention to June 30 four years out, not the original April 30 due date.

#5. Benefits and §125 Plan Records

Where the wage and tax buckets close at four years, anything plan-related (401(k) elections, cafeteria-plan enrollments) carries a longer clock and lives in its own bucket. ERISA §107 sets a 6-year retention floor for all records supporting Form 5500: 401(k) elections, deferrals, employer match, vesting schedules, plan documents, summary plan descriptions, and §125 cafeteria-plan elections. Health-plan records sit in the same bucket. The 6-year clock is the longest single rule in payroll, which is why the seven-year default sweeps it.

Use it when:

• An employee enrolls or makes a deferral change to a 401(k)
• A cafeteria-plan election period closes
• Form 5500 is filed for the plan year
• A DOL EBSA investigator or plan auditor opens a file

Carla's benefits records for Diego, plan year 2026:

The §125 enrollment matters because pre-tax health premiums reduce taxable wages for federal income tax, FICA, and most state income taxes, a different exemption pattern from the 401(k). Mixing those records into the general deduction folder is the mistake Carla saw at her prior firm. A plan auditor shouldn't have to wade through W-4 amendments to find an enrollment form.

#6. I-9 Employment Eligibility

The five buckets above sit inside the personnel file. The I-9 sits outside it, in its own root folder, because the audit authority that inspects I-9s is entitled to nothing else. USCIS at I-9 Central, under IRCA, requires Form I-9 within three business days of hire, retained for the longer of 3 years after hire or 1 year after termination. Electronic I-9 storage is permitted under 8 CFR §274a.2 with audit trails of every view, change, and re-verification.

Use it when:

• Any new employee is hired (within three business days)
• An employee's work authorization expires and must be re-verified
• USCIS, ICE, or DOJ-IER opens an I-9 audit (three business days' notice)
• An employee separates and the destruction clock begins

Carla's I-9 retention table, six current employees plus the part-time office manager hired in 2022:

Carla stores I-9s in their own root folder, never inside the personnel file. USCIS or ICE auditors are entitled to inspect I-9s but not the rest of the file. The structural separation keeps performance reviews, medical-leave docs, and protected-class information out of view. Terminated I-9s live in a sub-folder labeled with the destruction date, and an annual sweep purges anything past it.

#7. Separation and Termination Records

The six prior buckets cover an active employee. The separation bucket pulls retention rules from every other category and freezes them at the termination date. Federal final-paycheck rules are silent, but state laws drive timing: California Labor Code §201 (same day for involuntary terminations), New York §191 (next regular payday), Massachusetts (same day). EEOC recordkeeping requires personnel-action records for 1 year, or 2 for federal contractors.

Use it when:

• An employee resigns, is terminated, or is laid off
• COBRA notice must be issued (within 14 days of qualifying event)
• The state workforce agency requests a separation reason
• An EEOC charge arrives within 300 days of the action

Carla's separation file for the technician who separated February 28, 2026:

California's §203 waiting-time penalty (up to 30 days of wages at the employee's regular rate) is the most expensive separation-timing rule in the country. Carla cuts the final check from the next regular payroll only when an employee resigns with at least 72 hours of notice. Involuntary terminations get a manual same-day check from the operating account, with the register true-up at the next run.

#Retention Timelines by Authority

The consolidated schedule below lists every federal authority by minimum retention. The seven buckets in the Document-by-Document spine above absorb each row: buckets 1-3 hold FLSA records and wage computation, bucket 4 holds federal/state tax records (including SUTA and EEOC personnel records that contain payroll data), bucket 5 holds ERISA plan records (FMLA records sit here too because FMLA leave is tied to plan eligibility), bucket 6 holds I-9s as a standalone root folder, and bucket 7 absorbs separation-triggered records including OSHA injury logs surviving past termination. The longest applicable rule on any single record always wins, which is why a seven-year default works in practice.

When in doubt, retain at least 7 years. That window swallows every federal rule above and most state statutes of limitations on wage claims and tax audits.

#The Four That Drive Multi-State Policy

Carla operates in three states, and the strictest of the three — California — sets the floor for her wage-statement template everywhere. The same logic applies to any multi-state employer.

Pennsylvania has a separate trap. The PA Department of Revenue requires every employee to contribute 0.07% (2024-2026 rate) of gross wages to State Unemployment Insurance, with no wage cap and no employer-only treatment. The line item has to appear as its own deduction on the stub, separately from federal/state income tax and FICA. Multi-state employers who copy a non-PA template into a Pennsylvania payroll routinely drop this withholding.

Carla's portfolio includes one PA-located subcontractor relationship (the irrigation crew foreman, who is currently a 1099 but is being evaluated for conversion to W-2). If converted at the same $2,088 biweekly gross, Carla's PA paystub would carry: PA flat 3.07% income tax = $64.10, PA employee SUI 0.07% × $2,088 = $1.46 (no wage cap, no annual ceiling), Local Services Tax pro-rated to $52 ÷ 26 = $2.00 per check, plus the employee's local Act 32 Earned Income Tax at the resident municipality's rate. The PA SUI line is the smallest of the four but the most often dropped, because non-PA states don't have an analog and a non-PA-trained template won't include it.

If you operate in more than one state, build to the strictest standard (almost always California) and use that template everywhere. A Massachusetts employee isn't harmed by seeing piece-rate columns that don't apply. A California employee is protected by them.

#Common Mistakes That Trigger Wage-and-Hour Penalties

Payroll-recordkeeping compliance fails an investigator catches in the first 30 minutes of a DOL or state-labor-commissioner visit:

• Workweek-start memo missing or unsigned. Without the workweek anchor, daily/weekly overtime computation can't be audited, and DOL Fact Sheet #21 lists this as one of the required records investigators expect to see
• Time cards stored beyond the 2-year FLSA §516.6 floor but no method to reconstruct hours-by-day after archive
• §226 wage statements missing one of the nine items (employer legal name + address, employee + last 4 of SSN, pay-period dates, payday, hours at each rate, gross, itemized deductions, net). Each missing item is a separate per-period violation
• Pennsylvania 0.07% employee SUI line missing from a PA paystub (no wage cap means the gap compounds)
• 401(k) deferral records sitting in the general deduction folder instead of the ERISA bucket with its 6-year-post-5500 clock
• I-9s mixed into the personnel folder, expanding any I-9 audit into a personnel-file review the auditor wasn't entitled to
• Annual I-9 destruction sweep skipped, accumulating expired files past the longer-of date
• Exempt classification asserted by job title alone without a signed duties-test memo
• Contractor classification treated as a year-end decision instead of a pre-engagement memo signed before work begins
• EFTPS deposit confirmations not downloaded on the day of deposit, no annual restore test of payroll PDF cold backup
• Final-check timing in CA missed by issuing on the next regular payroll instead of same-day for involuntary termination. The §203 waiting-time penalty is up to 30 days of wages
• Accrued PTO not paid out under CA §227.3 on the final check
• §226 fabrication (issuing wage statements that misrepresent hours, rates, or deductions). A §226 violation paired with §2699 PAGA exposure produces civil penalties that depend on notice date, employer cure rights, and the post-2024 PAGA reform framework, on top of the §226 statutory-damages line
• Calendar-week overtime computation when the formal workweek runs Sunday-Saturday, producing under- or over-payment that an FLSA investigator immediately catches
• Two rates of pay for one nonexempt employee (cooking + serving) computed on a single regular rate instead of the weighted-average regular rate

The fix for every item is the same: build one nationally-compliant template anchored to the strictest state in your portfolio (almost always California §226), document the workweek with a signed memo, run an annual classification sweep before the year-end 1099 deadline, and back every electronic record with an annual restore test.

#Wage-Statement Method Comparison

Five common payroll-template strategies, the formula or rule each follows, and the small-employer profile each fits best.

Carla picked the second method: a national template built to California §226 with Pennsylvania-style add-ons, used across all three work states. The cost of the extra fields is trivial. The legal exposure of omitting them is not.

Use this template for every close contractor engagement, dated and signed before the engagement begins. The memo lives in the contractor folder alongside the W-9 and signed agreement.

Carla files this memo for every 1099 engagement of $5,000 or more and for any engagement that looks remotely employee-like. Misclassification exposure stacks across IRC §3509, both halves of FICA, FUTA, state SUTA and income tax, DOL minimum-wage and overtime liability, workers' comp back-premium, and — in California under PAGA — representative civil penalties.

#Example Audit File by Inspecting Agency

The packet the auditor actually asks for depends on which agency knocked.

The point of the matrix is structure, not memorization: each agency's request maps to a discrete folder set, preventing an auditor from seeing more than their authority permits.

Run this list every January, with a mid-year sanity check in July.

#Inside Carla's March 14, 2026 Pay Run — Records by Bucket

Every artifact from a single pay run maps to one bucket and one clock. Mismapping is where retention drift starts.

The longest applicable clock on this run is six years (401(k) election and §125 enrollment). Carla's default seven-year sweep handles every artifact above with one year of safety buffer. For the line-item detail of what should appear on each paystub, see the companion guide on what should appear on a paystub; for the withholding mechanics behind the deduction lines, see payroll tax vs income tax.

#Official External Sources