Records Management Policy: What It Must Contain (2026 Guide)

A records management policy is the short, approved statement of how an organisation will create, capture and look after the records that prove what it did and decided. ISO 15489-1:2016 covers policies in clause 6.2 and the people behind them in clause 6.3. The standard is guidance, written with “should” throughout, so nobody certifies a policy against it. It still gives a clear checklist of what a credible one covers.

This guide covers each element clause 6.2 expects, the responsibilities that make it work, the procedures beneath it, and how to keep it in use after approval.

What this guide covers

• What a records management policy is for
• What a records management policy should contain (clause 6.2)
• Responsibilities behind a records management policy (clause 6.3)
• Procedures and controls under the records management policy
• Making a records management policy more than a shelf document
• Frequently asked questions

What a records management policy is for

A records management policy is a commitment, not a manual. It states what the organisation promises about its records and who answers for it. The detail of how a record is captured, classified or destroyed lives in procedures and controls. Clause 6.1 makes the split explicit: policies set direction, procedures give instructions, monitoring checks results and training supports all three.

The policy’s objective, as clause 6.2 frames it, is records that are authentic, reliable, complete and unaltered, and useable, and that keep supporting the business for as long as they are needed. Those four qualities come from clause 5.2.2 (the standard spells the last one “useability”). If your policy states its purpose in those terms, every later commitment has something to point back to. Our overview of ISO 15489 explains how clause 5 and clause 6 fit together.

What a records management policy should contain (clause 6.2)

Clause 6.2 gives no template, but its recommendations group into nine things. Paraphrased:

1. Developed, documented and implemented. A draft on a shared drive does not count.
2. Derived from business objectives. Link it to the objectives records actually support, such as regulatory compliance or customer trust, and to the business rules that put it into effect.
3. Grounded in context and requirements. The drafting draws on an analysis of the business (clause 7.3) and on the records requirements identified for the areas in scope (clause 7.4).
4. A scope statement. It names the aspects of records management the policy covers, the standards applied, any audit requirements, and the business activities it applies to.
5. What happens when processes end. When a business process stops, the policy covers retiring the systems involved and setting aside resources to migrate records (clause 9.8) or dispose of them (clause 9.9).
6. Mandates. It identifies where laws, regulations, standards, other mandates and good practice shape how records are created, captured or managed.
7. Approval and communication. It is authorised at a suitable decision-making level and communicated inside the organisation and, where it helps, outside it.
8. Ownership. Someone is named as responsible for the policy and for making sure it is followed (linked to clause 6.3).
9. Review. It states how often it is reviewed and by whom, and old versions are kept as records once replaced.

The table turns those elements into drafting instructions.

The scope statement

Clause 6.2 points to four parts of scope: aspects covered, standards applied, audit requirements, and business activities governed. Writing all four into the records management policy forces useful decisions. If the policy covers retention but your records retention schedule has never been approved, you have found a gap before an auditor does. Describe activities by function, not department, so the scope survives the next restructure.

Mandates belong in a register, not in the prose

The standard asks the policy to say where mandates affect records, not to list every statute in the body text. A better pattern is one sentence in the policy pointing to a mandates register, owned by the records manager and confirmed by legal counsel at each review. The register can change monthly; the policy should not need to.

When a business process ends

This element is easy to skip because nothing is ending on the day the policy is written. It matters when a function is outsourced or a system retired. The records management policy should require that records are identified and protected before the change takes effect, that money and time are allocated for migration, and that anything left is disposed of under authority, not abandoned.

Responsibilities behind a records management policy (clause 6.3)

A policy without named people is an aspiration. Clause 6.3 asks for responsibilities and authorisations to be defined, assigned and made known, and for decisions about creating and keeping records to be treated as business decisions, authorised by the relevant manager and documented. It also recommends that leadership for records management sits with someone who has real authority, such as a senior manager.

In practice, a records management policy assigns roles along these lines:

• Senior responsible officer. Owns the policy, secures resources, and authorises any decision not to meet an identified records requirement (clause 7.5 expects that sign-off to sit with a senior manager).
• Records manager. Maintains the policy and controls, runs monitoring and training.
• Business managers. Make sure the processes they own create and keep the records required.
• System owners and administrators. Keep records systems running reliably and their documentation current.
• All staff, contractors and volunteers. Create complete and accurate records of their work and capture them in the right place.

Clause 6.3 also suggests records duties appear in job descriptions where appropriate. That step turns “all staff are responsible” from a slogan into something a manager can raise at appraisal.

Procedures and controls under the records management policy

Clause 6.1 expects policies to be backed by procedures. A records management policy that ends with a table of the documents it relies on is far easier to audit. The typical set covers capture, classification, metadata, access, storage, disposition and legal hold, plus the four records controls in clause 8: a metadata schema, a business classification scheme, access and permissions rules, and a disposition authority.

Each control should trace back to a commitment in the policy. If a procedure exists with no matching commitment, either the policy is missing a line or the procedure is surplus.

Making a records management policy more than a shelf document

Approval is the start, not the finish. Four habits keep the policy alive.

Monitor against it. Clause 6.4 asks for evaluation criteria, regular monitoring with input from records, IT, legal, audit and business managers, and changes where something proves ineffective. Write measurable commitments so they can be tested: “records are captured into an approved system” can be spot-checked; “records are managed appropriately” cannot.

Train on it. Clause 6.5 expects competence for anyone with records duties and ongoing training that reaches management, staff, contractors and volunteers. Put the records management policy into induction and refresh it at a stated interval.

Report on it. An annual report from the records manager to the senior owner gives the policy a regular executive audience.

Review it on schedule and on trigger. State a fixed interval, for example two years, and the events that bring review forward, such as a change in law or a new core system. Log each review, and keep every superseded version, because clause 6.2 treats an old policy as a record in its own right. When someone asks what rules applied to a record created three years ago, the superseded policy is the answer.

For organisations that want an auditable management system rather than guidance, ISO 30301:2019 sets certifiable requirements for a management system for records, and a new edition is in preparation. A records management policy written against ISO 15489-1 is a sound base for that step. The UK National Archives publishes practical information management guidance that complements the standard.

Frequently asked questions

Who should approve a records management policy?

Clause 6.2 says only that approval should come from an appropriate decision-making level. In practice that is the board or an executive committee, on the recommendation of a named senior owner, so the policy carries authority across every function.

How long should a records management policy be?

Long enough to cover the nine elements, short enough to read in one sitting. Detail belongs in procedures, which the policy points to.

How often should the policy be reviewed?

ISO 15489-1 does not fix an interval. It asks the policy to state its own review interval and reviewer. A two-year cycle with event-driven triggers is a reasonable default.

Does a records management policy make us ISO 15489 certified?

No. ISO 15489-1 is guidance and there is no certification against it. You can describe your programme as aligned with ISO 15489-1. Certification is available against ISO 30301.

Our ISO 15489 Toolkit provides 92 editable templates aligned with ISO 15489-1:2016, with each of the standard’s 180 recommendation items mapped to the document that answers it. For this topic it includes the Records Management Policy, the Policy Review Log and Superseded Policy Register, the Records Mandates Register, the Business Change and System Decommissioning Policy, the Records Management Roles and Responsibilities RACI, the Senior Responsible Officer Appointment Letter, the Job Description Records Clauses and the Records Decisions Authorisation Log. It is $99.