ISO 30301 vs ISO 15489: Which Records Standard Do You Need?

ISO 30301 is the records management standard you can be certified against: it sets requirements for a management system for records, in the same way ISO 9001 does for quality. ISO 15489, the guidance standard that describes records practice itself, cannot be certified at all. It is easy to treat the two as alternatives. They are not. One describes good records practice; the other asks whether you run that practice as a managed, audited, improving system.

This guide explains the difference, when you need which, and how a programme already aligned with ISO 15489 becomes the working base for an ISO 30301 management system.

What this guide covers

• What ISO 30301 is
• The ISO 30301 family
• ISO 30301 vs ISO 15489: the core difference
• When you need ISO 30301
• When ISO 15489 is enough
• From an ISO 15489 programme to an ISO 30301 MSR
• Steps to ISO 30301 certification
• Frequently asked questions
• Building the operational base

What ISO 30301 is

The current edition is ISO 30301:2019, Information and documentation, Management systems for records, Requirements. It was amended in 2024 to add the climate action changes ISO made across its management system standards that year, and a new edition is in preparation. It is maintained by ISO/TC 46/SC 11, the same subcommittee that owns ISO 15489; you can see the whole set on the ISO/TC 46/SC 11 list of published standards.

The standard calls the system a management system for records, or MSR. As a requirements standard, it is written in “shall” statements that a certification body can audit. It also follows the common structure ISO uses for its management system standards: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. That shared skeleton is what lets a records management system sit alongside an ISO 9001 or ISO/IEC 27001 system and share processes with them.

The ISO 30301 family

The requirements standard is one part of the ISO 30300 series, and it is easier to understand next to its siblings:

• ISO 30300:2020. The vocabulary: core concepts and defined terms for the series. ISO lists it as due for revision.
• ISO 30301:2019. The requirements, and the only standard in this group you can be certified against.
• ISO 30302:2022. Guidance on implementing an MSR, amended in 2025. It explains how to meet the requirements; it adds none of its own.
• ISO 15489-1:2016. Not part of the 30300 series, but the concepts and principles for records practice itself: authoritative records, records systems, appraisal, the four records controls and the eight records processes.

Around them sit narrower standards from the same subcommittee, such as ISO 23081 on metadata, ISO 18128 on records risk assessment and ISO 13008 on conversion and migration.

One trap when reading these standards together: the 2016 bibliography of ISO 15489-1 cites ISO 30300:2011, since replaced by the 2020 edition, and the superseded 2006 and 2009 editions of ISO 23081 parts 1 and 2, now 2017 and 2021. Check every reference against the ISO catalogue before you quote it in a policy or a scope statement.

ISO 30301 vs ISO 15489: the core difference

ISO 15489-1 answers the question “what does good records practice look like?” It explains what makes a record authoritative, what a records system should be capable of, how to appraise business activity to find records requirements, how to build a metadata schema, a classification scheme, access rules and a retention schedule, and how to run creation, capture, storage, migration and disposition. Every recommendation uses “should”. Our full guide to ISO 15489 walks through it clause by clause.

The management system standard answers a different question: “is records management run as a system the organisation directs, measures and improves?” Like any ISO management system standard, it is concerned with scope, policy, objectives, roles, resources, competence, documented information, internal audit, management review and corrective action. It does not try to teach records practice in detail; it expects you to have that practice, to control it, and to prove it is working.

When you need ISO 30301

You need ISO 30301 when somebody outside the records team wants independent proof. Three situations call for it:

• A customer, tender or contract asks for certification. Alignment with a guidance standard cannot be certified, so only ISO 30301 answers that request.
• You already run certified management systems. If quality or information security is certified, bringing records into the same audit, review and improvement cycle avoids running a parallel programme.
• The board wants assurance rather than a report. A third-party audit against requirements carries more weight than an internal self-assessment.

When ISO 15489 is enough

If nobody is asking for a certificate, the practical work comes first. An organisation without a retention schedule, an approved policy or a clear view of where its authoritative records live gains little from a management system wrapped around nothing. Build the practice to ISO 15489-1, run it for a cycle, and decide on certification later. Alignment can still be tested without a certificate: an internal audit against each recommendation, or a review by an external records specialist, gives the board evidence that the programme works. Start with the governance documents: our guide to writing a records management policy covers what clause 6.2 of ISO 15489-1 recommends.

From an ISO 15489 programme to an ISO 30301 MSR

The introduction to ISO 15489-1 makes the link itself: it presents records management done along Part 1 lines as the foundation of an effective MSR, and points anyone building one towards the ISO 30300 series. In practice, much of the operational layer an MSR needs already exists if your programme follows ISO 15489-1. The table below maps each part of the common structure to the ISO 15489-1 work that feeds it. It does not cite clauses from the requirements standard; read the standard itself for those.

What the guidance standard does not give you is the management system wrapper. Expect to add a defined system scope, measurable records objectives with plans to reach them, control of documented information across the system, a planned internal audit programme, management review, and a formal route for nonconformity and corrective action. Those are the things a certification auditor tests, and ISO 30302 explains how to build them.

Steps to ISO 30301 certification

1. Buy and read the current edition. Check the ISO catalogue first: with a new edition in preparation, confirm which edition your certification body will audit against.
2. Gap-assess your existing programme. Compare what you already run against each requirement, and record where your ISO 15489-1 documents are the evidence.
3. Define scope and objectives. Decide which functions and sites the MSR covers, and set objectives you can measure, such as the share of systems assessed or destruction carried out on schedule.
4. Add the management system processes. Document control, internal audit, management review and corrective action, shared with other systems where you already have them.
5. Run a full cycle. Auditors look for evidence that the system has operated, not only that it is written down.
6. Choose an accredited certification body. Ask how it will handle the move to the new edition once it is published.

Records requirements feed the operation stage directly, and the retention schedule is one of the first controls worth getting right. Our guide to the records retention schedule explains what each class should contain.

Frequently asked questions

Can you be certified to ISO 15489?

No. ISO 15489-1 contains recommendations, not requirements, so there is nothing for a certification body to certify against. The certifiable option is the management system standard described above.

Is ISO 30301 being revised?

Yes. A new edition is in preparation. No publication date is confirmed, so check the ISO catalogue for its status before you plan a certification timeline.

Should I start with ISO 15489 or ISO 30301?

If you have no records programme yet, start with the practice in ISO 15489-1, then build the management system around it. The 2016 introduction itself recommends using Part 1 together with the ISO 30300 series.

Can ISO 30301 be integrated with ISO 9001 or ISO 27001?

Yes. Because it shares ISO’s common management system structure, internal audit, management review, document control and corrective action can run as one set of processes across all of them.

Building the operational base

Whichever standard you aim at, the evidence is the same set of working documents: a policy, an appraisal, the controls and the procedures that apply them.

Our ISO 15489 Toolkit provides 92 editable templates (49 Word, 43 Excel) built on the clause structure of ISO 15489-1:2016. It is not mapped to ISO 30301 clauses, but it supplies the operational layer an MSR stands on: the Records Management Policy, the Records Management Programme Plan, the Records Management Roles and Responsibilities RACI, the Monitoring and Evaluation Programme, the Records Compliance Audit Checklist, the Corrective Action Register and the Annual Records Management Report, plus a Records Standards Family Crosswalk that lists current editions across the family. It is $99, and every document is yours to adapt.