A scheduling letter arrives from the DOL. The first thing most teams do is panic, either because they don’t know where the records are or if they even exist at all. In most cases, the problem is that OFCCP recordkeeping requirements get treated as an afterthought rather than an ongoing practice.
Here’s what you’re required to keep, and for how long.
Executive Order 11246 was rescinded in early 2025. If you’ve been tracking compliance developments, you already know that means you are no long required to consider diversity groups outside of veterans and individuals with disabilities. What matters now for recordkeeping is what remains: VEVRAA (the Vietnam Era Veterans’ Readjustment Assistance Act) and Section 503 of the Rehabilitation Act are both statutory law and they weren’t affected by executive action and are still fully in force.
VEVRAA applies to federal contracts of $200,000 or more and requires contractors to take affirmative action in hiring, training, and promoting protected veterans, with documentation requirements attached. Section 503 applies to contracts of $20,000 or more and covers outreach and employment of individuals with disabilities.
If your organization holds federal contracts above either of those thresholds, your recordkeeping obligations are active. And if you’re not sure which applies to you, it’s possible both do. Many federal contractors are covered by both statutes simultaneously, which means two overlapping sets of obligations to track.
Federal contractors and subcontractors must maintain employment and personnel records for both applicants and employees. That covers more ground than most teams realize.
The categories include:
Job postings and advertisements: what was posted, where, and when
Applications, resumes, and supporting materials submitted by candidates
Interview notes and selection criteria, including test results and reasons for hire or rejection
Compensation and pay data across employees and positions
Outreach activity: which organizations were contacted, on what dates, and through what methods
Self-identification data: applicant flow information by veteran status and disability status, collected at the application stage, at the point of offer, and through employee surveying every 5 years
Records can be kept in paper or electronic format. During a compliance review, they must be available for inspection and copying on request.
One point worth flagging: documentation of outreach efforts carries its own distinct requirement. You don’t just need to show that jobs were posted. You need to show where they went, who you reached, and that the effort was documented at the time it happened. After-the-fact reconstruction doesn’t satisfy this. It has to be contemporaneous.
Retention periods under OFCCP compliance requirements depend on two variables: your employee count and the size of your federal contract. Here’s how it breaks down.
1 year: Employers with fewer than 150 employees or a federal contract below $150,000. This is the minimum floor. If you’re a smaller contractor, at least one year of records is required from the date of creation or the personnel action, whichever is later.
2 years: Employers with 150 or more employees and a contract of at least $200,000. The two-year requirement applies to employment and personnel records: applications, hiring decisions, pay data, and related documentation.
3 years: Outreach and recruitment activity records fall under a longer retention period under Section 503 and VEVRAA. That includes documentation of where jobs were distributed, outreach to community-based organizations, and related activity logs.
Indefinite extension: If the DOL opens a compliance review, all records must be retained until the agency reaches final disposition, regardless of where you were in your normal retention cycle. That clock stops when the letter arrives.
The three-year window for outreach records is what catches teams most off guard. Most focus on the two-year threshold and don’t account for the longer tail on outreach documentation. If your organization is covered by VEVRAA or Section 503, assume outreach records need to be kept for three years from the date they were created.
Posting a job to a state job bank is a federal requirement for contractors covered by VEVRAA. What’s less discussed — and where compliance reviews surface gaps — is what “proof” actually means.
It’s not enough to say the job was posted. During a compliance review, contractors need to demonstrate that postings went live, reached the required channels, and were maintained for the required duration. Image proofs (screenshots captured at the time of posting) are the documentation standard. Without them, a posting is difficult to substantiate.
Two risky situations show up repeatedly:
Records exist, but proof doesn’t. A contractor knows a job was listed, but there’s no captured evidence.
Postings were routed through a third-party system rather than the contractor’s actual state employment service delivery system (ESDS) account, raising questions about whether the posting obligation was genuinely satisfied.
When posting is handled job-by-job, across multiple state accounts, by different team members, documentation becomes inconsistent and incomplete. A system that captures proof automatically at the point of posting is a more reliable approach than relying on individuals to track it themselves.
JobTarget’s Compliance Suite automates the documentation side of OFCCP compliance recordkeeping, so the records are there when you need them without requiring your team to build and maintain a manual process around it.
CompliancePost automatically distributes jobs to required state job banks using the contractor’s actual state ESDS accounts (not a third-party proxy), and to sites targeting veterans and people with disabilities. At the point of posting, image proofs are captured and stored. Those proofs are held for three years and are downloadable from the platform at any time, on demand.
Local Outreach automates and documents outreach to community organizations in your geographic area, recording the organizations contacted, the dates, and the methods used. That creates the contemporaneous outreach record that Section 503 and VEVRAA require, without adding manual tracking work to your team’s plate.
The Activities app gives you a centralized place to log compliance-related activity that falls outside the automated workflows: manual outreach efforts, events, or anything else your team needs on the record.
Everything integrates with 80+ ATS and HR systems, so applicants who come in through compliance job sites flow directly into your existing workflow. There’s no separate login, no duplicate data entry, and no parallel system to maintain alongside your regular recruiting process.
When a scheduling letter arrives, the documentation is already there. No reconstruction. No scramble.
Not sure how your current documentation would hold up? Compare compliance solutions or talk to our team about what audit-ready recordkeeping looks like in practice.
OFCCP audit failures rarely happen because records don’t exist. They happen because records are incomplete, inconsistent, or impossible to prove — and because the gaps only become visible when it’s too late to fix them cleanly.
The recordkeeping requirements under VEVRAA and Section 503 are specific: what you keep, how long you keep it, and how you prove it. Meeting those requirements manually is possible, but it’s error-prone and time-consuming. An automated system that handles posting, captures proof, and stores records for the required retention period reduces the margin for error substantially.
If your current process wouldn’t survive a 30-day response window, now is the time to find out.