# DOCUMENT RETENTION AND DESTRUCTION POLICY

**BAU Farm Foundation** — A North Carolina Nonprofit Corporation

*Draft — starter template. Review and adopt by the Board of Directors. Consult NC nonprofit counsel before execution.*

**Adopted:** __________, 20__
**Last reviewed:** __________, 20__

---

## ARTICLE I — PURPOSE

**Section 1.1 Purpose.** This Document Retention and Destruction Policy (the "Policy") governs the retention, storage, and disposition of records of BAU Farm Foundation (the "Foundation"). The Policy is intended to:

1. ensure that the Foundation retains records required by federal and North Carolina law, funder agreements, and sound governance;
2. dispose of records that are no longer needed in a systematic and secure manner;
3. protect confidential and personally identifiable information;
4. comply with the anti-destruction provisions of the **Sarbanes-Oxley Act** (18 U.S.C. § 1519), which apply to all organizations including tax-exempt entities and make it a federal crime to knowingly alter, destroy, mutilate, conceal, or falsify records with the intent to obstruct any federal investigation or proceeding; and
5. respond appropriately to the IRS Form 990 governance question regarding a written document retention and destruction policy (Form 990, Part VI, Line 14).

**Section 1.2 Scope.** This Policy applies to all records — paper and electronic, including email, cloud storage, backups, text messages, and social media — created or received by directors, officers, employees, volunteers, and contractors in the course of Foundation business.

---

## ARTICLE II — ROLES AND RESPONSIBILITIES

**Section 2.1 Records Officer.** The Board designates the **Secretary** as the Records Officer, responsible for administering this Policy in coordination with the Executive Director and Treasurer.

**Section 2.2 Responsibilities.** The Records Officer shall:

1. maintain the retention schedule in Appendix A and update it as legal requirements change;
2. oversee the systematic destruction of records that have satisfied their retention period;
3. ensure secure storage of records containing confidential or personally identifiable information;
4. issue and lift legal holds under Article V; and
5. train directors, officers, employees, and volunteers on the Policy at onboarding and annually.

**Section 2.3 Individual Duties.** Each director, officer, employee, volunteer, and contractor shall:

1. retain records within their control for at least the periods specified in Appendix A;
2. not destroy any record subject to a legal hold under Article V;
3. use Foundation-approved storage and email systems for Foundation records;
4. transfer Foundation records to the Records Officer or a successor upon departure or role change; and
5. report suspected loss, theft, or unauthorized destruction of records to the Records Officer.

---

## ARTICLE III — RETENTION PERIODS

**Section 3.1 Retention Schedule.** Records shall be retained for the periods set forth in Appendix A. Where multiple periods could apply, the **longest** period governs.

**Section 3.2 Basis for Periods.** Retention periods are set based on:

- the IRS record retention rules (generally 3 years for records supporting a return, 6 years for substantial omissions of income, indefinite where fraud or no return is filed; see IRC § 6501 and IRS Publication 583);
- the North Carolina statute of limitations (generally 3 years for contract and most claims under N.C. Gen. Stat. § 1-52, up to 10 years for sealed instruments under § 1-47);
- federal and state employment law, including FLSA (3 years for payroll; 2 years for supporting records), Title VII/ADA/ADEA (1 year, 4 years for EEOC-reporting employers), ERISA (6 years);
- OSHA record retention (5 years for injury logs; 30 years for exposure and medical records);
- funder and grant agreement requirements (frequently 3–7 years post-close-out; federal awards under 2 CFR 200.334 generally 3 years from final financial report);
- North Carolina charitable solicitation licensing under N.C. Gen. Stat. Chapter 131F; and
- North Carolina Department of Revenue and sales-and-use tax records (generally 3 years).

**Section 3.3 Permanent Records.** The following records shall be retained **permanently**:

- Articles of Incorporation and amendments;
- Bylaws and amendments;
- IRS Form 1023 (or 1023-EZ) and determination letter;
- IRS Form 990 series (all years filed);
- Board and committee minutes;
- corporate seal, stock ledger (if any), and membership records;
- annual audited financial statements;
- major contracts and legal files of ongoing significance;
- real property deeds, easements, and title insurance;
- intellectual property registrations;
- policies of the Foundation (including this Policy);
- retirement plan documents; and
- records demonstrating restricted-fund donor intent.

---

## ARTICLE IV — DESTRUCTION PROCEDURES

**Section 4.1 Systematic Destruction.** At least annually, the Records Officer shall identify records that have satisfied their retention period and are not subject to a legal hold, and shall arrange for their destruction.

**Section 4.2 Method of Destruction.**

1. **Paper records** containing confidential or personally identifiable information shall be **cross-cut shredded** or destroyed by a bonded, certified shredding vendor providing a certificate of destruction. Other paper records may be recycled.
2. **Electronic records** shall be deleted from all systems, including backups where feasible, using methods that render the data unrecoverable. Storage media (hard drives, USB drives, phones) shall be **wiped to DoD 5220.22-M or equivalent standard** or **physically destroyed** prior to disposal or transfer.
3. **Cloud records** shall be deleted from the primary system, and the vendor shall be requested to purge from backups on the vendor's stated schedule.

**Section 4.3 Documentation of Destruction.** The Records Officer shall maintain a destruction log identifying the record series, date range, method, date of destruction, and person or vendor performing the destruction. Certificates of destruction from vendors shall be filed with the log.

**Section 4.4 Prohibition.** No person shall destroy, alter, mutilate, conceal, cover up, or falsify any record with intent to obstruct or influence an actual or anticipated federal, state, or regulatory investigation or proceeding, or the administration of any tax matter. Violation of this Section is grounds for termination or removal and may constitute a federal crime under 18 U.S.C. § 1519.

---

## ARTICLE V — LEGAL HOLDS

**Section 5.1 Trigger.** A legal hold shall be issued whenever the Foundation reasonably anticipates litigation, government investigation, audit, subpoena, or administrative proceeding.

**Section 5.2 Issuance.** The Records Officer, in consultation with the Executive Director, Chair, and legal counsel, shall:

1. identify the scope of records subject to the hold (topics, custodians, date ranges);
2. issue a written **Litigation Hold Notice** to all custodians and IT personnel;
3. instruct custodians to preserve all responsive records — paper, electronic, email, text, cloud, backup — and to cease any automatic deletion applicable to those records;
4. suspend the retention schedule with respect to the held records; and
5. document the issuance, distribution, and acknowledgments.

**Section 5.3 Ongoing Compliance.** The Records Officer shall periodically (at least every six months) re-issue and re-confirm the hold with custodians until it is lifted.

**Section 5.4 Release.** Legal holds shall be lifted only in writing by the Records Officer after consultation with counsel. Following release, normal retention and destruction resume.

---

## ARTICLE VI — STORAGE AND SECURITY

**Section 6.1 Storage.** Active records shall be stored in Foundation-approved systems providing appropriate access controls, encryption at rest where technically available, and backup. Off-site or archival storage shall provide comparable protection.

**Section 6.2 Personally Identifiable Information.** Records containing personally identifiable information — Social Security numbers, financial account numbers, medical records, driver's license numbers — shall be stored only in encrypted or otherwise access-controlled systems and shall be redacted from working files where not needed.

**Section 6.3 Third-Party Vendors.** Vendors handling Foundation records (cloud storage, payroll, accounting, donor CRM, email, shredding) shall be bound by written agreements requiring reasonable security safeguards, breach notification, and — for records subject to legal holds — cooperation with preservation.

**Section 6.4 Departures.** On departure or role change, custodians shall return or transfer Foundation records to the Records Officer or successor. Personal devices used for Foundation business shall be inspected and Foundation records removed under the Records Officer's supervision.

---

## ARTICLE VII — REVIEW AND AMENDMENT

**Section 7.1 Review.** The Records Officer shall review this Policy and the retention schedule at least every **three (3) years** and recommend changes to the Finance and Audit Committee and Board.

**Section 7.2 Amendment.** This Policy may be amended by the affirmative vote of a majority of directors then in office at any regular or special meeting, provided the proposed amendment has been provided in writing to all directors at least **fourteen (14) days** in advance. Amendments must remain consistent with the Foundation's Bylaws, Articles of Incorporation, IRC § 501(c)(3), and applicable federal and NC law.

---

## CERTIFICATION

I certify that the foregoing Document Retention and Destruction Policy was adopted by the Board of Directors of BAU Farm Foundation on __________, 20__.


____________________________
**Secretary**, BAU Farm Foundation


____________________________
**Chair**, BAU Farm Foundation

---

## APPENDIX A — RETENTION SCHEDULE

*Retain for the longer of the period below and any period required by law, contract, funder agreement, or legal hold. "Permanent" means retain for the life of the Foundation.*

### A.1 Corporate and Governance

| Record | Retention |
|---|---|
| Articles of Incorporation and amendments | Permanent |
| Bylaws and amendments | Permanent |
| IRS Form 1023 / 1023-EZ and determination letter | Permanent |
| Board and committee meeting minutes and packets | Permanent |
| Written consents in lieu of meeting | Permanent |
| Board and officer resolutions | Permanent |
| Annual reports to NC Secretary of State | Permanent |
| Conflict-of-interest disclosure forms | 7 years after individual's departure |
| Corporate policies (this Policy, COI, whistleblower, etc.) | Permanent |
| Directors and officers insurance policies | Permanent (each policy) |
| Corporate seal, stock/membership ledgers | Permanent |

### A.2 Tax and Financial

| Record | Retention |
|---|---|
| IRS Form 990, 990-EZ, 990-N, 990-T, 4720 (as filed) and attachments | Permanent |
| Annual audited or reviewed financial statements | Permanent |
| General ledger and year-end trial balance | Permanent |
| Bank statements, reconciliations, cancelled checks | 7 years |
| Accounts payable and receivable records | 7 years |
| Invoices, expense reports, credit-card statements | 7 years |
| Tax-exempt sales certificates | 7 years after expiration |
| NC sales-and-use tax and NC withholding records | 7 years |
| IRS Form W-2, W-3, W-4, W-9, 1099, 1096 | 7 years |
| Fixed asset ledger and depreciation schedules | Life of asset + 7 years |
| Budgets and forecasts | 7 years |
| Investment statements and correspondence | 7 years after account closure |

### A.3 Contributions, Grants, and Programs

| Record | Retention |
|---|---|
| Donor gift records and acknowledgment letters (IRS §170) | 7 years |
| Donor pledges and pledge cards | 7 years after final payment |
| Restricted gift instruments and donor-intent documentation | Permanent |
| Grant applications submitted (funded and unfunded) | 7 years after decision |
| Grant agreements and amendments (as grantor) | 7 years after final report |
| Grant agreements and amendments (as grantee) | 7 years after final report; longer if funder requires |
| Federal award records (2 CFR 200.334) | 3 years from date of final financial report, longer if audit pending |
| Grantee reports and monitoring files | 7 years after final report |
| Program participant records (scholarship, training, etc.) | 7 years after program end, or age of majority + 7 years for minors |
| Program evaluation and outcomes data | 7 years |
| Fundraising event records | 7 years |
| Charitable Solicitation Licenses (NC Chapter 131F) | Permanent |

### A.4 Employment

| Record | Retention |
|---|---|
| Personnel files (application, offer, evaluations, discipline) | 7 years after separation |
| Form I-9 | Later of 3 years from hire or 1 year from separation |
| Payroll records (FLSA) | 4 years (retain 7 for audit safety) |
| Timesheets and supporting payroll records | 3 years (retain 7) |
| Employee benefits plans and ERISA records | 6 years, or life of plan + 6 |
| Medical records, ADA accommodations, FMLA | 30 years after separation (also HIPAA/ADA rules) |
| Workers' compensation and injury records (OSHA 300 logs) | 5 years |
| Exposure records (hazardous substances) | 30 years |
| Independent contractor agreements and 1099s | 7 years |
| Job postings and applicant records | 3 years |

### A.5 Contracts, Real Property, Insurance

| Record | Retention |
|---|---|
| Contracts, MOUs, engagement letters | 7 years after expiration; permanent if of ongoing significance |
| Real property deeds, easements, title insurance | Permanent |
| Leases | 7 years after termination |
| Insurance policies (property, GL, D&O, cyber, workers' comp) | Permanent (all policies), claims 7 years after resolution |
| Vendor agreements (data processors, cloud) | 7 years after termination |
| Intellectual property registrations (trademarks, copyrights) | Permanent |

### A.6 Legal, Compliance, Risk

| Record | Retention |
|---|---|
| Litigation and settlement files | 10 years after final resolution |
| Subpoenas and government inquiries | Permanent |
| Legal-hold notices and acknowledgments | Permanent |
| Investigation files (including whistleblower) | 7 years after closure; longer under hold |
| Compliance certifications and training records | 4 years |
| Incident reports (safety, security, data) | 7 years |
| Data breach notifications and remediation | Permanent |

### A.7 Technology, Communications, Marketing

| Record | Retention |
|---|---|
| Email — business records (contracts, decisions) | Retain in system per governing schedule (7 years for most) |
| Email — routine / transitory | 1 year (auto-purge acceptable if no hold) |
| Text messages relating to Foundation business | 7 years (export to preserved store) |
| Website content (final published pages) | 7 years |
| Social media posts (Foundation accounts) | 3 years |
| System logs and backups | 1 year unless supporting a business record |
| IT security incident logs | 7 years |

---

## APPENDIX B — LITIGATION HOLD NOTICE (TEMPLATE)

**LITIGATION HOLD NOTICE — CONFIDENTIAL**

**To:** [Custodians and IT] **From:** Secretary, BAU Farm Foundation **Date:** __________

**Subject:** Preservation of records relating to __________

The Foundation reasonably anticipates [litigation / investigation / audit / regulatory proceeding] involving __________. Effective immediately, you must **preserve all records** in your custody or control relating to this matter, in any form — paper, email, texts, chat, cloud, backups, personal devices used for Foundation business, voicemail, and social media.

**You must not** delete, alter, discard, overwrite, or move any responsive record, and you must **suspend any auto-delete or retention rules** that would remove such records. Normal retention under the Document Retention and Destruction Policy is suspended for the records covered by this hold.

**Scope:** [topics, custodians, date range, keywords]

**Systems affected:** [email accounts, drives, applications]

If you are unsure whether a record is covered, err on the side of preservation and contact the Records Officer.

Please acknowledge receipt by replying to this notice. This hold remains in effect until released in writing by the Records Officer.

Records Officer: __________________________

Acknowledged by: __________________________  Date: __________

---

## APPENDIX C — DESTRUCTION LOG (TEMPLATE)

| Date | Record Series | Date Range / Description | Volume | Method (shred / wipe / physical) | Vendor (if any) | Certificate # | Authorized By | Notes |
|---|---|---|---|---|---|---|---|---|
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |