Agree who can destroy accounting records held by a provider

Ask the provider for a practical description of the records it retains, including source documents, agreed work products, portal copies and backups. Distinguish those from internal working papers. Different categories can have different retention duties and contractual treatment. The company needs a clear inventory before it can assess a deletion clause.

Record where the company keeps its own authoritative copy and whether it is complete and readable. A file accessible through the provider's portal may disappear when the subscription ends. Verify retrieval before approving disposal or assuming that the provider's retention schedule matches the company's needs.

IRS guidance says retention depends on the transaction or event and notes that nontax purposes can require longer retention. Have the appropriate advisers determine the schedule for your records, including applicable legal, contractual and operational needs. Avoid treating one generic number of years as suitable for every document.

Compare that schedule with the provider's policy and professional obligations. Ask how conflicts are resolved and which records it must retain independently. The company may want deletion of unnecessary sensitive copies while the provider has a legitimate duty to preserve particular material. Document the reason and access restrictions for retained information.

Specify whether the provider sends a proposed disposal list, gives advance notice or follows a preapproved schedule. Name the company role that can authorize destruction and an alternate for absence. A message to a former employee should not be the only step before the archive is removed.

Establish a route for legal holds, examinations, disputes and other circumstances that require retention to be reassessed. Counsel or the responsible adviser should define the actual requirement. The provider needs an acknowledged instruction that reaches its records administrators, including any subcontractor holding relevant copies.

Keep destruction of paper originals separate from deletion of extra digital copies. The consequences and replacement conditions differ. If originals are to be destroyed after scanning, confirm that the accepted electronic archive meets the requirements relevant to those records before management authorizes the step.

FTC vendor-security guidance recommends addressing retention and deletion in supplier arrangements. Ask the provider what deletion means across active systems, backups and subcontractors, and what evidence it can supply. A removed portal link may not mean every retained copy has been erased.

Agree a confirmation proportionate to the records and systems involved. It should identify the categories, period and process completed, together with permitted residual copies and their expected treatment. Avoid demanding an absolute technical guarantee the provider cannot support; document the actual method and limitations.

Before departure, obtain the agreed archive and test that the company can retrieve selected records independently. Confirm the provider's remaining retention, contact route and future disposal notices. Include records held in separately billed software or another service provider's system.

If the company asks for earlier deletion, identify the specific copies involved and obtain the provider’s explanation of any retention constraint. Keep that decision separate from destruction under the ordinary schedule.

Retain the schedule, approvals, transfer evidence and destruction confirmations in the company's own record. Revisit the arrangement when obligations or systems change. The useful outcome is a deliberate record lifecycle, with enough evidence preserved and unnecessary sensitive copies removed under an understood process.