How long should consulting firms keep engagement files?

What decides how long to keep engagement files?#

Engagement file retention is decided by four drivers: the client contract, the firm's professional liability exposure, the law governing specific record types, and the firm's own business needs. The safe period for a given file is usually the longest of those that apply to it.

Contracts come first because they bind the firm directly. An MSA may require the firm to return or destroy client materials at the end of the engagement, to keep them for a minimum audit period, or both, often with an exception for one archival copy held under continuing confidentiality.

Liability is the second driver. Claims about advice can surface long after an engagement closes, and the firm's defense depends on showing what it was asked to do, what it delivered and what the client decided. Statutes of limitation and repose vary by state and claim type, so counsel should set that tail rather than a template.

Law and business need fill in the rest. Invoices and time records follow tax and accounting rules, staffing records follow employment rules, and engagements for clients in regulated industries can bring sector-specific record duties through the contract. Business value is the only driver that argues for keeping a record after every obligation has ended.

Retention drivers by engagement file type#

Retention drivers differ by file type, so a single folder-level rule rarely works. The table pairs each common engagement file with the driver that usually controls it, any client-return obligation, and a practical archive note.

Where client-return obligations bite#

Client-return obligations bite hardest on files that mix client material with firm work. A working paper that combines the client's raw cost data with the firm's analysis cannot be returned in part without splitting it, and many firms never split it while the engagement is live.

The fix is structural. Store client-provided material in a dedicated folder or library per engagement, keep firm analysis separately, and record the end-of-engagement action taken: returned, destroyed with a certificate, or retained under an archival carve-out. Those three words in a close-out log save hours when a client or insurer asks later.

Destroy, keep or de-identify: the upside question#

The upside question is whether firm-owned records are worth keeping once their defensive period ends. Proposals with win or loss outcomes, staffing plans, project review memos and lessons-learned write-ups show how the firm actually works, and they are the records most useful for internal AI search, proposal drafting and, in some cases, licensing to AI developers.

Destroying them on a fixed schedule is simple but loses that history. Keeping them indefinitely raises discovery and privacy exposure. A middle route is to de-identify records that have passed their defensive period: remove client names and identifying facts, reduce employee details to roles, and keep the workflow. Counsel should confirm that de-identified versions fall outside contract and privacy obligations before originals are destroyed.

• 1Proposals linked to win or loss outcomes and client feedback.
• 2Staffing plans showing planned and actual allocation.
• 3Project review and quality review memos.
• 4Methodology updates and internal training drawn from engagements.
• 5Post-engagement retrospectives and close-out reports.

Making platforms enforce retention#

Retention periods written in a policy document change nothing until the platforms apply them. Most document platforms, including SharePoint, Google Drive and Box, support retention labels or policies, but features differ by plan, so check your subscription tier and the vendor's documentation before designing around a feature.

Apply retention at the engagement level where possible, triggered by the engagement close date in the PSA or CRM rather than by file creation date. That keeps a long engagement's early files from expiring while the work is still active. Email, Slack and Teams need their own settings, because chat and mail retention are configured separately from document libraries.

Two blind spots catch most firms. Backups and archived mailboxes of departed partners often hold copies that the retention policy never touches, and personal cloud folders used during remote work sit outside every policy. Include both in the schedule, or the firm will certify destruction it cannot fully prove.

When a legal hold applies#

A legal hold suspends normal deletion for the engagement files, custodians and systems it names. When a dispute, investigation or claim is reasonably anticipated, deletion stops for the relevant engagement files, including email and chat, until counsel releases the hold.

Holds also freeze any plan to reuse records. Files under hold should not be de-identified, moved or licensed without counsel's approval, because altering them can create spoliation risk.

Keep a hold register that names each hold, the engagements and custodians it covers, the date issued and the date released. Without one, holds linger for years after the matter closes, or are lifted before every system was covered.

Illustrative: an organizational change consultancy cleans up its file share#

Illustrative: a fictional organizational change consultancy keeps engagement files across a legacy file share, a newer SharePoint site and partners' mailboxes. It has never applied a retention schedule, and its insurer's renewal questionnaire asks for one.

The firm sorts files into client-owned, firm-owned and mixed. Client data from closed engagements with return-or-destroy clauses is destroyed and certified. Signed contracts and final deliverables stay under the liability tail counsel set. Proposals, staffing plans and review memos are de-identified and kept as a firm knowledge archive, which later feeds an internal proposal search tool and a metadata-only licensing fit check.

How SourceX views retained engagement records#

SourceX considers only firm-owned or properly cleared records for licensing, and it never asks a firm to keep files it is obliged to return or destroy. The first conversation is a metadata-only fit check covering systems, years of accessible history and known restrictions.

Where records proceed, the Rights step of the SourceX five-step transaction checks client contracts and legal holds before any preparation, and the SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and release authorization.