ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
A business classification scheme is a structured map of what an organisation does, used to place every record in the business activity it documents. ISO 15489-1:2016 treats it as one of four records controls in clause 8, alongside metadata schemas, access and permissions rules, and disposition authorities. Clause 8.3 covers the scheme itself and clause 9.4 covers the act of classifying records against it.
Classification does more than help people find things. Once a record sits in the right class, the class rules decide who can see it, how long it is kept, and where it goes when the work moves. This guide covers how to build, structure and maintain one.
Clause 8.3 positions the scheme as the link between records and the context that produced them. It names three things classification makes possible:
That is why a business classification scheme is not just a folder structure. A folder holds files; a class carries rules. If two classes would have identical retention, identical access and be searched the same way, you probably do not need both.
The key design choice in clause 8.3 is the basis of the scheme. The standard wants it drawn from functional and work process analysis (clause 7.3), reflecting what the organisation does rather than how it is organised. The reason is resilience. Departments merge, split and rename; the work of paying suppliers carries on regardless.
Take a supplier invoice. Filed under “Finance Department / AP Team”, it is in the wrong place once accounts payable moves to a shared service centre, and every rule built on that path needs rework. In a function-based business classification scheme it sits under “Financial management / Accounts payable / Supplier invoices”, and the restructure changes nothing except who holds the access rights.
A useful test before approving a draft: take two or three plausible restructures and check whether any class would need renaming, moving or splitting. If one would, it is probably named after a unit rather than a function.
ISO 15489-1 lets the scheme have as many levels as best represent the business. A three-level structure is a practical default, and clause 9.4 refers to classifying at the level of function, activity or work process:
The lowest level used for classifying records is the terminal class. That is where retention and access rules are mapped. Add a level below an activity only where records within it differ in retention, access or how people search for them.
The table shows one branch of a function-based scheme. Codes use three letters for the function and two digits for each lower level. RC and AR codes are illustrative references to a retention schedule and an access rule set, not periods.
| Code | Level | Title | Scope note | Mapped rules |
|---|---|---|---|---|
| FIN | Function | Financial management | Planning, recording and controlling the organisation’s money | None at this level |
| FIN-03 | Activity | Accounts payable | Setting up, approving and paying suppliers | None at this level |
| FIN-03-01 | Transaction | Supplier set-up and master data | Set-up forms and supplier detail changes; excludes bank-detail changes (FIN-03-05) | RC-FIN-015; access rule AR-03 |
| FIN-03-02 | Transaction | Supplier invoices | Invoices received, matched and approved for payment | RC-FIN-012; access rule AR-03 |
| FIN-03-03 | Transaction | Payment runs and remittances | Payment proposals, approvals, files and remittance advices | RC-FIN-012; access rule AR-03 |
Each scope note says what belongs in the class and, where confusion is likely, what does not. Avoid “general” or “miscellaneous” classes: a catch-all collects records that nobody can retain or restrict properly. Codes should never be reused, even after a class closes.
A business classification scheme is only as good as the analysis behind it. The functional and sequential analysis that clause 7.3 describes for appraisal also feeds the scheme. Our guide to records appraisal covers that work in detail. In outline:
Clause 8.3 allows a scheme to be hierarchical or relational, with whatever levels best reflect the business. It adds that the degree of classification control should follow the records requirements and the nature of the records systems in use.
A hierarchy is the simpler choice and maps directly onto folders. It suits stable, repeating activities where each group of records has one retention outcome. A relational or faceted approach places a record by combining independent facets, such as function plus case number or project. It suits casework, contracts and capital projects, where the same activity repeats for many parties. A scheme can mix the two: a hierarchy down to activity, then a case facet underneath.
Degree of control varies by system. An electronic records system might enforce the terminal class on capture; a finance platform might map transaction types to classes automatically; a legacy system might only manage activity level through a crosswalk. Record the level and method per system so gaps are visible.
Every terminal class in a business classification scheme should carry, at minimum, its code and title, a scope note, a retention class, an access rule, and the systems that hold its records. A class without a retention class or access rule is not ready for approval. Where retention is still being researched, map it to a provisional “retain pending decision” class and list it for completion.
This is where the scheme meets the other controls. The records retention schedule can be organised by the same functions, so each disposition class lines up with one or more terminal classes. Access rules work the same way: clause 8.4 associates them with agents, business activities and records, and the business activity is exactly what the class describes.
The business classification scheme is the organisation-wide, system-neutral map of functions, activities and transactions. A file plan is its implementation in a particular system or area: the folder structure, often with extra levels below the terminal class for a year, a case or a supplier. A file plan inherits its rules from the class above it; folders that trace to no class hold records without rules.
Clause 8.3 notes that a scheme can be supported by vocabulary controls, such as a thesaurus, used for titling records to aid retrieval. In practice that means a short list of preferred terms with pointers from the words people actually use: “creditor” and “vendor” both lead to “supplier”, which leads to FIN-03. Consistent titles also make misclassification easier to spot.
Clause 9.4 adds that indexing metadata, such as subjects, places or personal names, can be attached at capture or later to help authorised users find records. Indexing complements classification; it does not replace it.
A business classification scheme needs maintenance like any other control. Triggers for change include a new function or activity, a function ceasing, an outsourcing, a merger, a new appraisal and repeated misclassification found in spot-checks.
When an activity stops, close its class rather than deleting it. A closed class accepts no new records but keeps its mappings for as long as records sit in it. When classes split or merge, keep a mapping from old to new. Clause 9.4 accepts that a record can be reclassified during its life and asks that the old classification metadata be kept, so its history stays visible. Keep each superseded version of the scheme as a record too, and review the whole scheme at a stated interval.
The US National Archives publishes records management guidance for federal agencies. Your records management policy should commit to classification and name the scheme’s owner.
Not quite. A taxonomy can organise anything by subject. A business classification scheme organises records by the business function and activity that produced them, and its classes carry retention and access rules.
ISO 15489-1 does not fix a number. Three levels (function, activity, transaction) is a sensible default; add a level only where records differ in retention, access or retrieval.
A workable split: the records manager maintains it, business managers confirm their classes, and a senior manager approves each version.
If it is function-based, very little. Classes stay put; only agents and access groups change.
Our ISO 15489 Toolkit provides 92 editable templates aligned with ISO 15489-1:2016, with each of the standard’s 180 recommendation items mapped to the document that answers it. For classification it includes the Business Classification Scheme, seeded with 74 transaction classes under 40 activities, the Business Classification Scheme Procedure, the Titling Conventions and Controlled Vocabulary, the Classification and Indexing Procedure, the Functional Analysis Worksheet, the Work Process Analysis Worksheet and the Records Controls Version Register. It is $99.
October 12, 2026
October 12, 2026
October 12, 2026
October 12, 2026
October 12, 2026