Keeping records for contract compliance and audits

Your paperwork is your first line of defence

Most freelancers and small business owners think about contracts at the moment of signing, then file them away and forget them. That is understandable, but it leaves you exposed. If a client disputes an invoice, if HMRC asks questions about a project, or if an insurer wants proof of what was agreed, the only thing that matters is what you can put on the table. A well-kept record turns a stressful argument into a short email with three attachments.

The good news is that compliance record-keeping is not a bureaucratic monster. It is a routine you can build in an afternoon and maintain in ten minutes a month. What follows is practical guidance on what to keep, how to store it, and how long to hold on to it under UK rules and ordinary commercial common sense.

What counts as a contract record

A contract is rarely just one document. It is a bundle of evidence showing what was agreed, when, by whom, and how it changed. Keep all of the following together in a single project folder:

• The signed contract itself, including any schedule, statement of work, or terms and conditions referenced in it.
• Electronic signature records if you signed digitally. Save the final executed PDF with the audit trail, not just the draft.
• Pre-contract correspondence that shaped the deal, such as emails confirming fees, timescales, or deliverables.
• Purchase orders, statements of work, or booking confirmations from the client.
• Proof of your own credentials where relevant: professional indemnity insurance, certifications, DBS checks, or right-to-work evidence.
• Any client onboarding documents, including ID verification and anti-money-laundering checks for regulated work.

A useful habit is to save the final agreed version and label it clearly, for example ClientName_Contract_Signed_2025-03-14. Undated files called "contract final v3 (really final)" are the enemy of a calm audit.

Variations and changes: the paper trail that saves arguments

Scope creep is where most disputes begin. A client asks for "a small extra" by phone, you deliver it, and six weeks later nobody agrees whether it was included in the fee. Protect yourself by treating every change as a variation, however small.

• Confirm changes in writing the same day, even if it is a two-line email: what is changing, the impact on price, and the impact on the deadline.
• Ask the client to reply with a simple "confirmed" if there is no time for a formal variation document.
• Keep instant messages and texts where they relate to the work. Screenshot them into the project folder while they still exist, because phones get lost and accounts get deleted.
• Log verbal agreements in a running project note, dated, with the names of who was on the call.
• Issue a short variation order for anything above a threshold you set yourself, perhaps £250 or half a day's work.

This is not about being difficult. It is about both sides knowing where they stand, which is exactly what a client wants too.

Invoices, payments and tax records

Invoices are compliance documents, not just requests for money. Each one should show your business name and address, a unique sequential number, the date, the client's details, a clear description of the work, the amount, and the VAT treatment if you are registered. Keep a copy of every invoice you issue, not only the ones that were paid.

Alongside them, retain bank statements showing the money arriving, receipts for expenses you have claimed, and any credit notes or refunds. HMRC expects records supporting your tax return to be kept for at least six years after the end of the accounting period, and VAT-registered businesses must keep VAT records for six years as well. Private limited companies have similar retention expectations under company law. When in doubt, six years is a sensible floor; seven is safer if you are ever slow to file.

If you work through an intermediary or are asked to demonstrate status, keep evidence of how the engagement operated: who controlled the work, whether you used your own equipment, and whether you could send a substitute. Those records are gold in an IR35-style enquiry.

Storing records securely

Security matters because contracts contain personal data and commercially sensitive terms. Under UK GDPR you must keep personal information accurate, protected, and no longer than necessary, which means a hoarding free-for-all is not the answer either.

• Use cloud storage with two-factor authentication and encrypted folders for client contracts and ID documents.
• Follow the 3-2-1 rule: three copies of important files, on two different types of storage, with one stored off-site or in the cloud.
• Keep paper originals in a lockable cabinet if you have any, and scan them so a fire or flood does not wipe out your evidence.
• Restrict access to the people who genuinely need it, and remove access when a contractor or employee leaves.
• Set a destruction date for documents you no longer need, and delete them properly rather than leaving them in a forgotten downloads folder.

A ten-minute monthly tidy

Audit readiness is a habit, not a project. Once a month, set a timer and do four things: file the month's signed contracts and variations into the right client folders, check that every invoice has a matching payment record, back up anything new, and delete drafts you no longer need. Keep a simple index spreadsheet listing client, project, contract date, value, and where the file lives.

If an inspector, insurer, or solicitor ever comes calling, you will be able to answer within minutes rather than days. That calm, organised response is worth far more than the ten minutes it costs each month.