Retain for five years after the final audit then dispose of.
Confidential destruction is required. Paper must be shredded, pulped, or incinerated; electronic records must be overwritten or the storage media physically destroyed. Deletion of information in computer files or on electronic storage media is not sufficient.
Last Updated: December 31, 2008