ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Records appraisal is the analysis that tells an organisation which records each part of its business has to produce, how those records should be handled, and how long they need to survive. In ISO 15489-1:2016 it has its own clause, clause 7, and the standard deliberately gives the word a wider meaning than archivists traditionally did.
This guide walks through records appraisal as ISO 15489-1 frames it: the scope, the business analysis, the two risk lenses, the three sources of records requirements, the decisions and who signs them, and the cycle that brings the work back round.
In archival practice, appraisal has long meant one narrow question: which records have enough lasting value to go to an archive, and which can be destroyed. ISO 15489-1 asks much more of the term. A note in clause 7.1 explains that the standard stretches appraisal to cover analysis of the business context, the business activities themselves and the risks around them.
The result is that records appraisal in the ISO sense starts before a single record exists. It decides what evidence a process should create in the first place, what metadata that evidence needs, who may see it, and when it can go. Retention is one output among several, not the whole point.
ISO 15489-1 is a guidance standard. It recommends practice with “should” and never “shall”, and nobody can be certified against it. So clause 7 describes what good records appraisal looks like rather than setting audit criteria.
A retention schedule written without analysis is a list of guesses. Clause 7.1 says the results of appraisal should feed the design of records systems, policy and procedure, metadata requirements, access and permissions rules and disposition authorities.
Records appraisal is the evidence base for every records control in clause 8. A records retention schedule whose classes cannot be traced back to an appraisal is hard to defend when someone asks why a class is kept for the period it is.
Clause 7 is organised as general principles (7.1), scope (7.2), understanding the business (7.3), determining requirements (7.4) and implementing them (7.5). The table below is how our toolkit’s Appraisal Methodology lays them out.
| Step | What you do | ISO 15489-1 clause | Output |
|---|---|---|---|
| 1. Scope | Record the trigger and the functions or processes it touches | 7.2 | Scoping statement |
| 2. Understand the business | Describe the organisation, its mandates, technology, stakeholders and setting | 7.3 | Business context analysis |
| 3. Analyse | Break functions into activities; map key processes step by step; list the agents | 7.3 | Functional and work process worksheets |
| 4. Assess risk | Rate business risk and records risk as separate lenses | 7.1 | Records risk assessment |
| 5. Identify requirements | State the evidence each process must leave, and why | 7.4 | Requirements register |
| 6. Decide implementation | Choose systems, controls or procedures, scaled to risk | 7.5 | Implementation plan |
| 7. Document and authorise | Keep sources, risk results and decisions; obtain sign-off | 7.1, 7.5 | Appraisal report and decision record |
| 8. Repeat | Re-run when the business or its risks change | 7.1, 7.5 | Updated register |
Clause 7.2 ties scope to the reason for doing the work. Something has usually happened: a new organisation is being set up, a function has been added or removed, the way work is done has changed, the regulatory position has moved, a system is being introduced or upgraded, or the organisation now sees risk differently.
Write the trigger down, then list the functions, activities or work processes it affects. A system upgrade in accounts payable does not justify re-appraising the whole organisation, and a merger probably does.
Clause 7.3 asks for a rounded picture of the organisation before any decision is made. That covers the pressures shaping its operations and direction, its operational and legal obligations, its resources and technology, what internal and external stakeholders need, and the risks it already manages.
The standard also asks whether the business is really several organisations working together, or one organisation working across several sectors, jurisdictions or regions. A shared service centre in a second country can bring a second set of mandates into scope.
Clause 7.3 names two analysis techniques, and you can use either or both.
Alongside both, list every agent involved, inside and outside the organisation. ISO/TR 26122 gives detailed guidance on work process analysis if you want more depth.
Clause 7.1 splits risk into two questions. Keep them apart.
Rate both on your existing risk scale. ISO 18128:2024 covers records risk assessment in depth.
Clause 7.4 treats a records requirement as a need for evidence of business activity, and says requirements come from three sources:
A requirement can concern any records process, from creation through to disposition, and can specify content, metadata, links to other records, or form and structure. The standard also stresses context: two near-identical processes in different parts of the business may need different evidence. Link every requirement to the function, activity or process it applies to, so it can be traced later.
Clause 7.5 lets you meet a requirement through a records system, a records control, a policy or procedure, or a mix. Choose with your resources, skills and systems in mind.
The proportionality rule is the important part. Requirements carrying bigger risks justify more investment and closer monitoring; low-risk ones can usually be met by procedure. Monitoring under clause 6.4 then checks whether each requirement is actually met, and a failure becomes a corrective action.
Clause 7.1 asks for the appraisal itself to be documented, and names three things to keep as records: the sources consulted (documents and stakeholder interviews), the risk assessment results, and the decisions reached. Where required, a senior manager authorises those decisions.
Clause 7.5 adds a sharper rule. If the organisation decides not to meet a requirement it has identified, that choice needs authorisation from a senior manager. This is a useful discipline: it turns a quiet gap into a recorded, owned risk acceptance. The same records become audit evidence if you later build a certifiable management system under ISO 30301.
Appraisal is never finished. Clause 7.1 says it should be repeated when the business activity or its risk factors change, and clause 7.5 says requirements should be reviewed as part of that recurring cycle. The triggers in step 1 double as re-appraisal triggers. It also helps to set a scheduled cycle for each function, with a shorter interval for high-risk areas, so nothing drifts for years unchecked.
Superseded versions of the controls that appraisal produces should themselves be kept as records under clause 8.1, so you can show which rule applied when.
ISO 15489-1 sets out the concepts; two related documents go deeper. ISO/TR 21946:2018 gives guidance on appraisal for managing records, and ISO 18128:2024 covers records risk assessment. For a public-sector view of how appraisal results become disposition authority, see the US National Archives’ federal records management pages, which apply to US federal agencies.
Appraisal also sets the shape of your metadata. The business-specific facts it uncovers, such as a supplier number or a case reference, become elements in your schema, as our guide to records management metadata explains.
No. In the ISO 15489-1 sense, it also decides which records to create and capture, what metadata they need, who can access them and how they are managed. Retention and disposition are outputs of it, not its definition.
The records manager leads, but clause 7.1 expects internal stakeholders to take part and, where needed, external ones such as auditors or partners. Business managers, system owners and legal advisers usually supply the facts.
It depends on scope. A targeted appraisal of one process can be short; a baseline of every function is a project. Scoping by trigger keeps each round proportionate.
It records them as requirements once identified, but it does not create them. Retention periods that come from law depend on your jurisdiction, so confirm each one with legal advice before you approve it.
Our ISO 15489 Toolkit provides 92 editable templates aligned with ISO 15489-1:2016. For records appraisal it includes the Appraisal Methodology, the Appraisal Scoping Statement, the Business Context Analysis, the Functional Analysis Worksheet, the Work Process Analysis Worksheet, the Agents and Stakeholders Register, the Appraisal Sources and Interview Log, the Records Risk Assessment, the Records Requirements Register, the Records Requirements Implementation Plan, the Appraisal Report and Decision Record and the Requirement Non-Compliance Authorisation. It is $99.
October 12, 2026
October 12, 2026
October 12, 2026
October 12, 2026
October 12, 2026