Legal Document Storage Checklist

For each active lease, confirm both the tenant and an authorized signer for the landlord executed the lease, and that all state-required addenda are attached: federal lead-based-paint disclosure for any pre-1978 unit, mold and bedbug disclosures where required (e.g., NYC bedbug, CA Megan's Law), and the move-in inspection signed by the tenant. Missing the lead-paint form is the most common gap and triggers per-violation HUD/EPA penalties.

Re-execute or attach the missing forms — most often the lead-paint disclosure, smoke/CO detector certification, or signed move-in walk-through. Date the addendum to today and route for tenant e-signature through DocuSign or the PMS-native tool. Note the gap and the cure in the tenant file so the audit trail is intact.

Wet-signed originals go in the locked, fireproof cabinet at the property office, organized by property and unit. Originals are still required in some jurisdictions for eviction proceedings — the e-signed PDF alone may not be admissible.

Save the executed PDF to AppFolio, Buildium, or Yardi under the tenant record — not a personal Dropbox or shared drive. Confirm role-based access is set so leasing agents can read but not delete, and that the storage layer is encrypted at rest.

TransUnion SmartMove, RentPrep, and Experian RentBureau reports must be retained per FCRA — typically two years for credit reports and five for adverse action records. Verify reports are stored under the applicant record (approved AND denied) and that the consumer reporting agency name and contact are preserved.

Any application denied based on the credit or background report requires an FCRA adverse action notice naming the reporting agency and informing the applicant of their right to a free report and dispute. Missing notices are the basis for class-action litigation against multifamily operators — file the notice copy with the denied application.

Pull each retained application and confirm SSNs, full account numbers, and routing numbers are redacted on the stored copy. State data-breach laws (CA, NY, MA, TX) impose notification and statutory damages if a leasing file leaks unredacted PII.

Each unit needs the signed move-in walk-through with dated photos AND the matching move-out inspection. Without the signed move-in baseline, security deposit deductions are nearly indefensible in small-claims court. Check HappyCo or zInspector exports against the tenant file.

Most state landlord-tenant acts require a tested, working smoke and CO detector at every move-in. The test log (date, battery replaced, tech signature) is the habitability defense if a fire or CO incident is ever litigated. Confirm the log exists for every turnover in the audit window.

Pull the work order log from AppFolio or Buildium and match each closed ticket to the vendor invoice and the tenant's original maintenance request. Gaps signal either uninvoiced work (owner over-charge risk) or unresolved tickets (habitability risk). Flag any ticket open more than 30 days for the maintenance supervisor.

For each tenant, the file should show the deposit received, the trust-account where it sits, any interest accrued (required in MA, NJ, NY, CT, IL and others), and at move-out the itemized statement plus refund timestamp. State windows for the itemized statement run 14-60 days; missing the window can forfeit deductions and trigger 2-3x statutory damages.

IRS retention is generally seven years for income records. Confirm year-end 1099-MISC filings for owners and vendors are stored with supporting workpapers, and that monthly owner statements are archived per owner. Form 8300 cash-receipt filings (over $10,000) must be retained five years.

Monthly rent roll, trust account reconciliation, and operating account reconciliation are the three documents most state real estate commissions audit on a broker exam. File the signed reconciliations with the bank statement and PMS export — Yardi, AppFolio, or Rent Manager — together for each property.

Pull the COI binder for every active vendor — plumbers, electricians, HVAC techs, painters, cleaners, landscapers. Each needs a current general liability and workers comp certificate naming the management company AND each managed property as additional insured. Lapsed COIs leave the manager personally exposed for vendor accidents on premises.

Email each vendor with a lapsed certificate and pause new dispatches until the renewed COI lands in the file. Standard turn time is 48-72 hours from the vendor's broker. Track in the vendor record so the same gap doesn't recur next quarter.

Each managed property needs the current declarations page on file: hazard, liability, and where applicable flood, earthquake, or umbrella. Note expiration dates in the property record so renewals don't lapse silently — a covered loss on an expired policy is uninsured.

For every open claim, the file should include the loss notice, claim number, adjuster name and phone, contractor estimates, and any payments received. Owners ask about these on every owner call; missing adjuster contact info is the most common reason for a delayed claim.

Three-day non-payment notices, lease-violation notices, and 30/60-day no-cause terminations must be filed with the proof of service — personal, posting, or certified mail return receipt. Without the proof of service in the file, the eviction filing gets dismissed and the cure clock restarts.

Complaint, summons, judgment, and writ of possession go in the tenant file with the docket number. These records also drive the screening database — a future application from this tenant should surface the prior eviction history.

Communications with outside counsel — eviction, fair-housing complaints, slip-and-fall — sit in a separate folder with access limited to the broker, regional manager, and counsel. Wide access can waive privilege if the matter goes to litigation. Confirm the folder permissions in your document system.

Most states set retention at 3-7 years post-tenancy for lease and screening files; FCRA sets 2 years for credit reports and 5 for adverse action; IRS sets 7 for income records. Pull the state retention chart, identify expired records, and shred or securely delete on a documented schedule. Holding records past retention is itself a privacy risk.

The broker of record or designated compliance officer reviews the audit, captures the overall result, notes any open remediation items for the next quarter, and signs. The signed audit is the artifact a state real estate commission asks for during a broker examination.