We have a third party conduct our internal audits for us on an annual basis. How many years do most people retain their audit workpapers and reports? We have them stored from the early 2000's.

I would say it is a combination of issues. First I assume the reports are permanent records of either the BOD or Audit Committee depending on how they were presented. Therefore, you would always have a copy of the reports. For our audit workpapers, our retention period is 7 years. Since you outsource your audit function, you might not have a complete set of the workpapers. I would check your bank's retention schedule but also look for regulatory guidance, I would assume 7 years would be the max you would need to retain the workpapers.

Our retention policy states "permanently" so that I why I started to dig a bit.

You might want to also check with your state banking association for their retention guidance.