ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 15489 is the international standard for records management: it describes how an organisation should decide what records to make, how to capture and control them, and when it can let them go. It does not tell you which software to buy or how many years to keep an invoice. It gives you concepts, controls and processes, and leaves the detail to your own business, legal and regulatory setting.
This guide covers what the standard is, how its text is organised clause by clause, why nobody can certify against it, how it relates to ISO 30301, and a practical order for implementing it.
The current text is ISO 15489-1:2016, Information and documentation, Records management, Part 1: Concepts and principles. ISO published this second edition on 15 April 2016, replacing the 2001 first edition. It belongs to ISO/TC 46/SC 11, the subcommittee for archives and records management. ISO reviewed it in 2021 and confirmed it, so it is still current in October 2026 and no revision is under way. The official listing is on the ISO 15489-1:2016 page at iso.org.
The standard applies to records in any format, kept by any kind of organisation. Its starting idea is that a record does two jobs at once: it proves that a piece of business happened, and it is an information asset worth looking after. Without the metadata that says who made it, when and in what process, a file proves very little.
The 2001 edition came with a companion technical report, ISO/TR 15489-2:2001, which has since been withdrawn. The 2016 foreword still lists it, which sends readers looking for a document they cannot buy. Implementation detail now sits in other standards from the same subcommittee, such as ISO 23081 for metadata and ISO 13008 for conversion and migration.
Clauses 1 to 3 hold the scope, the normative references (there are none; the standard is meant to stand alone) and 19 defined terms. The substance is in clauses 4 to 9.
Clause 4 compresses the whole standard into five principles. In short: records work is part of doing business; a record counts as authoritative evidence only when it has four specific qualities; every record is content plus metadata; decisions about what to make and keep rest on analysing the business and its risks; and records systems only work when policies, assigned roles, monitoring and training stand behind them.
Clause 5.2 explains what makes a record authoritative. An authentic record can be shown to be what it claims to be, made by whoever it says, at the time it says. A reliable record is a full and accurate account, made at or near the time by someone who knew the facts. A record with integrity is complete and has not been changed without authorisation. A useable record can be found, retrieved and understood within a reasonable time; the standard spells this quality “useability”.
Clause 5.2.3 covers metadata, and 5.3 gives records systems five characteristics to meet: being reliable, secure, compliant, comprehensive and systematic. A records system here includes the rules, people and responsibilities around the software, so a finance platform or a shared drive can serve as one if it is run as one.
Clause 6 is the governance layer. Clause 6.2 covers the records policy: approved at the right level, clear about scope, and reviewed at a stated interval. Clause 6.3 assigns responsibilities, including leadership by a senior person and records duties in job descriptions. Clause 6.4 deals with monitoring and evaluation, outsourced services included, and 6.5 with competence and training.
Clause 7 uses appraisal for the whole analysis, not only the question of what to keep: scoping (7.2), understanding the business (7.3), assessing risk, and working out records requirements from three sources: business needs, law and regulation, and what the community or wider society expects (7.4). Clause 7.5 asks you to document how each requirement will be met, and a senior manager should sign off any decision not to meet one. Our step-by-step guide to records appraisal covers the method.
Clause 8 names four controls, the tools that turn appraisal results into rules a system can apply:
Clause 9 covers the processes that put those controls to use: making records (9.2); capturing them (9.3), which at minimum means a unique identifier, metadata generated on capture and links to related records, agents or business; classification and indexing (9.4); access control (9.5); storage (9.6); use and reuse (9.7); migration and conversion (9.8); and disposition (9.9).
Disposition can mean destruction, handing control to a successor organisation, or transfer to an archive. Destruction always needs authorisation, has to be complete and documented, and has to stop for anything connected with litigation, legal action or an investigation, whether that matter has started or is only expected.
| Clause | What it covers | What you need to produce |
|---|---|---|
| 4 | Five principles | A records management framework |
| 5.2 | Authoritative records; metadata | An authoritative records standard, a metadata policy |
| 5.3 | Records-system characteristics | A systems register and an assessment of each system |
| 6.1 to 6.3 | Policy, procedures, roles | Records management policy, a RACI, a senior officer appointment |
| 6.4 and 6.5 | Monitoring, competence, training | A monitoring programme, a corrective action register, a training programme |
| 7 | Context, risk, records requirements | An appraisal method, a risk assessment, a requirements register |
| 8.2 to 8.4 | Metadata, classification, access | A metadata schema, a classification scheme, access rules |
| 8.5 | Classes, periods, triggers | A retention and disposition schedule |
| 9.2 to 9.8 | Creation through to migration | Capture, access, storage and migration procedures |
| 9.9 | Disposition and destruction | A destruction procedure, a disposition register, a legal hold procedure |
Every recommendation in the body of the standard uses “should”, never “shall”. That makes it guidance. A certification body audits against requirements, and there are none here, so no certification against ISO 15489 exists.
What you can do is claim alignment: show, recommendation by recommendation, how your programme answers each “should”, and keep the evidence. That serves internal audit, a regulator who asks how your records are governed, and a customer’s due diligence. If you need a certificate, look at ISO 30301.
ISO 30301:2019 sets requirements for a management system for records (MSR), and organisations can be certified against it. It was amended in 2024 with ISO’s climate action changes, and a new edition is in preparation. ISO 30300 supplies the vocabulary and ISO 30302 the implementation guidance.
ISO 30301 asks whether you run records management as a managed system, with policy, objectives, leadership, audits and improvement. The guidance standard describes what good records practice looks like inside that system, and the 2016 introduction itself treats it as a foundation for an MSR. Our comparison of ISO 30301 and ISO 15489 explains when you need which.
No. It is a voluntary guidance standard. A contract, a regulator or a public-sector framework may point to it, and then the obligation comes from that document.
ISO 15489-1:2016, the second edition, confirmed in 2021 and not under revision as of October 2026. ISO/TR 15489-2:2001 has been withdrawn.
No. Clause 8.5 says what a disposition class should contain, but periods come from your own appraisal and differ by jurisdiction and sector. Confirm every period against your own mandates.
Yes. It covers records in any form, including email, databases and data in line-of-business systems. The 2016 edition was written with digital environments in mind, which is why metadata and controls sit at its centre.
Alignment is shown through documents: an approved policy, an appraisal with its sources recorded, dated controls, and procedures people follow.
Our ISO 15489 Toolkit provides 92 editable templates (49 Word, 43 Excel) built on the clause structure of ISO 15489-1:2016, with 180 recommendation items each mapped to the document that answers it. Start with the ISO 15489-1 Recommendation Register and Conformance Matrix and the Records Management Gap Assessment, then work through the Records Management Policy, the Appraisal Methodology, the Business Classification Scheme, the Records Retention and Disposition Schedule and the Metadata Schema for Records. It is $99, and every document is yours to adapt.
October 12, 2026
October 12, 2026
October 12, 2026
October 12, 2026
October 12, 2026