Records Management for Singapore Companies
An ACRA query lands in the inbox. An IRAS review gets scheduled for next quarter. A prospective investor's due diligence team asks for five years of board minutes by Friday afternoon. Each scenario tests the same thing: can someone find the record when it matters?
Company secretaries, finance leads, and directors live with this risk constantly, though records management reaches beyond these roles and operates at the enterprise level, often without a system built to survive it.
Handling it well comes down to three questions: what records must be kept, for how long, and how to run a records management system that holds together under scrutiny.
What Is Records Management?
Records management is the controlled handling of a record from creation to disposal. It covers how a record gets classified, stored, accessed, retained, and eventually destroyed.
A record differs from a working document in one respect: It captures evidence of a decision, transaction, or event the company may need to prove later, whereas a draft or a reference copy carries no such weight.
The Records Lifecycle
Every record moves through the same stages regardless of format.
Creation: The record comes into existence, whether a signed contract or a system-generated invoice.
Classification: It gets assigned to a category and a retention rule.
Storage: A decision gets made on where it lives and how safely.
Access: Rules determine who can view or amend it.
Retention: It stays intact for as long as the law or the business requires.
Disposal: The loop closes when the record is removed securely, once it no longer needs to exist.
Document Management vs Records Management
Businesses often treat document management and records management as the same discipline under two different names. They are not, and the distinction matters most the moment a regulator, auditor, or court asks for something specific.
| Document Management | Records Management |
Purpose | Supports active work in progress | Preserves evidence for compliance and accountability |
What it involves | Drafts, working files, reference material | Finalised records with fixed content |
Who controls it | The individual or team using the document | A records policy, with defined ownership and access rules |
End of life | Superseded, archived, or deleted at the user's discretion | Disposed of only once the organisation's own retention policy allows it |
Where a System of Record Fits
A system of record is the authoritative source for a given category of information, the version everyone defers to when copies disagree.
It differs from a source of truth, which is a broader idea concerned with the accuracy of the underlying data itself rather than which system holds the official copy.
The concept applies beyond the boardroom. For instance, an HR system can be the authoritative source for employee records, a finance system for the general ledger, and a company secretary's registers and signed board minutes for governance records.
Whichever category is involved, one system should play that authoritative role, not several competing copies.
What Singapore Companies Must Keep, and For How Long
The positions below reflect Singapore law as at September 2026, with the instrument named in each case.
Requirements shift, so check the current position with ACRA, IRAS, MOM, or the PDPC before relying on the information below for your own filings.
Statutory Registers and Company Records
ACRA sets no fixed retention period for statutory registers, such as the register of members, directors, and registrable controllers.
The Companies Act requires them to be kept current for as long as the company exists, at the registered office or an address notified to ACRA, in electronic or physical form provided they stay legible and accessible.
Accounting and Tax Records
Section 199(2A) of the Companies Act requires accounting records to be kept for at least five years from the end of the relevant financial year.
IRAS applies the same five-year rule under section 67 of the Income Tax Act, as does the GST Act for GST-registered businesses, and directors of a struck-off company remain responsible for five years from the date of striking off.
Employment Records
According to MOM's Employment (Employment Records, Key Employment Terms and Pay Slips) Regulations 2016, employee records must be kept for the duration of employment plus one year after an employee leaves. Records include attendance and payment entries kept for two years from the date recorded.
Many companies fold this into their HR payroll services arrangements, since payroll and employment records share the same clock.
Personal Data Under the PDPA
The PDPA's retention limitation obligation is not a fixed number of years.
However, an organisation must stop retaining personal data, or remove anything that identifies the individual, once it is reasonable to assume the original purpose no longer applies and no legal or business need remains.
Secure disposal is part of that obligation, once the decision to delete has been made.
Board and Meeting Records
Section 188 of the Companies Act requires minutes of board and general meetings to be recorded, and once signed, they stand as evidence of what was decided.
There is no fixed retention period attached to minutes themselves, so most companies keep them for the life of the company alongside the registers and resolutions they support.
This is often done through the same corporate secretarial services that track other filing deadlines.
How to Build an Effective Records Management System
Building an effective records management system comes down to seven practical steps.
1. Take Inventory of What You Already Hold
List every record type currently in circulation, where it sits, and who is responsible for it.
Treat shared drives, email inboxes, and physical files as one combined inventory rather than separate systems, since a record only counts as under control once it appears on that list, wherever it happens to live.
2. Classify Records and Agree On a File Plan
Group records into categories that mirror how the business uses them, rather than how a filing cabinet happens to be arranged. A shared file plan means everyone applies the same categories the same way.
3. Set a Retention Schedule
Attach the legal minimum retention period to each category, drawing on the requirements set out above, then decide whether any category needs to be held longer for business reasons.
4. Assign Ownership and Access Rights
Name one owner for each record type, who will be the person accountable if it goes missing or turns out to be wrong.
Then, grant access by role, to the people who use that record day to day. Avoid opening it to the wider team by default.
5. Decide Storage and Format
Choose a storage format that keeps each record legible, searchable, and tied to an audit trail showing who created or changed it.
If a digital copy cannot prove it has not been altered since, treat it as unreliable evidence, regardless of how convenient it is to store.
6. Dispose of Records on Schedule
Delete or destroy each record once its retention period ends, rather than keeping it on hand just in case.
Records held past that point add legal exposure without adding any value, and they slow down every future search for the ones that still matter.
7. Audit and Review
Revisit the file plan and retention schedule at least once a year, since regulations change and so does the business.
Assign this review to a specific person and date on the calendar, rather than leaving it to whoever happens to notice something is out of date.
What to Look for in a Records Management System
When buying a records management system, keep the following criteria in mind:
Access control: Fine-grained permissions that restrict each record to the people who need it.
Audit trail: A log of who created, viewed, or changed a record and when.
Retention and disposal automation: Rules that flag records for review or disposal automatically.
Search and retrieval: The ability to find a specific record in minutes.
Multi-entity handling: Separate, clearly partitioned records for each entity in a group structure.
Data residency: Confirmation of where data physically sits, which matters for companies bound by Singapore-specific storage requirements.
Security certification: Independent verification of how the system protects data.
Integration: The ability to connect with the accounting, HR, or corporate secretarial systems already in use, so records do not need to be re-entered by hand.
Support model: Clarity on who resolves an issue at short notice, especially when a regulator's request comes with a tight deadline.
How Records Management Strengthens Compliance and Governance
Boards tend to care about three things when records come up: whether the company can survive an audit, whether decisions can be defended after the fact, and how exposed directors are personally if something goes missing.
Records management touches all three at once:
Audit readiness: Comes from being able to produce what a regulator asks for without a scramble.
Defensible decision making: Comes from signed minutes and resolutions that show a board actually considered what it was deciding, not merely that it voted.
Director liability: Narrows considerably when a company can prove a decision was made properly, since much of that exposure comes from gaps in the record rather than from the decision itself.
For groups running multiple entities, a single system of record removes a specific risk. Two entities can no longer hold conflicting versions of the same resolution or register, each looking equally official.
Additionally, data protection and AI governance expectations now fall on the board directly, rather than staying with IT. The same discipline that keeps records defensible carries over naturally here, shaping how boards approach data privacy, security, and AI governance.
Managing Board Records with Board.Vision
Board papers, resolutions, and approval records need the same discipline as any other statutory record, arguably more, since they carry legal weight the moment a decision is signed off.
Trusted Services' board management software, Board.Vision, holds these as a system of record across every entity in a group structure. Two capabilities matter most for records specifically.
Approval audit trail. Approvals are logged through an authenticated process with a non-repudiable certificate of completion, giving a clear record of every decision made.
Multi-entity dashboard. A single dashboard lets a company secretary manage multiple entities without the version confusion and audit risk that come from scattered copies.
Paired with corporate secretarial services, this keeps a group's records under one coherent standard.
Frequently Asked Questions About Records Management
Can Singapore companies keep statutory records in electronic form only?
Yes. ACRA accepts electronic registers provided they stay legible, accessible, and reproducible on request.
The registers must still be kept in Singapore, at the registered office or another address notified to ACRA, even when the system itself is cloud-based.
Where must company records be kept, and can they be stored overseas?
Statutory registers must physically be located in Singapore, at the registered office or an address filed with ACRA.
Accounting records have more flexibility under the Companies Act, provided enough remains in Singapore to determine the company's financial position and the rest can be produced on request.
Is the director or the company secretary responsible when records are missing?
Directors carry ultimate statutory responsibility under the Companies Act, regardless of who maintains records day to day. Appointing a company secretary to handle the administrative work does not transfer that accountability, which is why records oversight belongs on the board's agenda.
What happens if a company cannot produce records requested by ACRA or IRAS?
Consequences range from compliance action by ACRA to IRAS disallowing deductions it cannot verify, and in serious cases, assessments raised without the missing documentation. The outcome depends on the request and record involved, so treat any regulator's request as time-sensitive.
Does outsourcing bookkeeping or corporate secretarial work transfer the record keeping obligation?
No. The statutory obligation stays with the company and its directors regardless of who performs the work. An outsourced provider can maintain records to a high standard, but responsibility for compliance, and for producing them when asked, stays with the company.
How should records be destroyed once the retention period ends?
Destruction should be secure and irreversible, whether shredding physical records or certified deletion for electronic ones, and it should be logged to show disposal happened on schedule.
This matters most for personal data, where the PDPA's retention limitation obligation expects deletion, not indefinite storage.
Do emails and chat messages count as company records?
Yes, if they document a decision, transaction, or instruction, emails and chat messages count as company records regardless of the platform.
Treat that content as a record from the outset, rather than waiting for a dispute or an audit to ask for it, since informal messages are far easier to lose through routine deletion, forwarding, or a change of device.
How long should records be kept if there is an ongoing dispute or investigation?
Standard retention periods stop applying once a dispute or investigation is reasonably anticipated. Relevant records should be preserved until the matter is fully resolved, even past their normal disposal date. Companies in this position should seek specific legal advice rather than general retention guidance.
Talk to Us About Records and Governance
Audit readiness and director exposure both come down to the same thing: whether a company's records can be found, trusted, and produced the moment someone asks.
If that still depends on memory and goodwill rather than a system, Trusted Services can help close the gap before a regulator or an investor finds it first.
Comments