Records Management Documentation Pack – ISO 15489-1 Templates

The document most organisations need first is a retention schedule, and a schedule copied from a template carries someone else’s law. This records management documentation starts from the other end: the appraisal that justifies what you keep, the four controls that apply it, and a register of the mandates behind every retention period, all on the clause structure of ISO 15489-1:2016.

On this page:

• Why records management documentation should start with appraisal
• What is inside the records management documentation pack
• A retention and disposition schedule example you can actually start from
• Records management documentation that cites current editions
• Who the records management documentation pack is written for
• What the records management documentation pack does not do
• Frequently asked questions
• Related toolkits

Why records management documentation should start with appraisal

Clause 7 of ISO 15489-1 is appraisal: understanding the business, identifying records requirements from business needs, law and stakeholder expectations, and using risk to decide what to create, what to keep and for how long. It is the reasoning every other control rests on, and the part generic packs leave out.

The records appraisal method here is step by step: a scoping statement, business context analysis, functional and work process worksheets, a stakeholder register, a sources and interview log, a records risk assessment, a requirements register, and the decision record a senior manager signs. Clauses 4 to 9 are broken into 180 recommendation items, and each is mapped to the document that answers it.

What is inside the records management documentation pack

The records management documentation pack is 92 editable templates in ten sections that read in the same order as the standard.

• Start here (7) – guide and roadmap, recommendation register, gap assessment, programme plan, project plan, standards crosswalk and maturity self-assessment.
• Principles and framework (4) – framework, strategy, glossary and a guide to what counts as a record.
• Authoritative records and metadata (7) – the standard for authenticity, reliability, integrity and usability, with annotation and amendment controls.
• Records systems (9) – systems register, requirements specification and capability assessments for business systems.
• Policies and responsibilities (11) – policy, roles and the accountability that sits behind them.
• Monitoring and evaluation (7) and competence and training (5) – how the programme shows it is working.
• Appraisal (12) – the method, worksheets and decision record.
• Records controls (12) – metadata schema, business classification scheme, access rules and the disposition authority.
• Records processes (18) – creation, capture, storage, digital continuity, migration, legal holds and destruction.

A retention and disposition schedule example you can actually start from

The schedule arrives with 44 function-based record classes across ten business functions, each with a class identifier, description, records covered, trigger event, example retention period and disposition action: the fields clause 8.5 says a records disposal authority should hold.

Every period is marked as illustrative. The schedule links each class to a mandates register where you record the law, regulation or business need behind each period, for each jurisdiction you operate in, before anyone approves it. That is what turns template records management documentation into a defensible decision.

The business classification scheme workbook links to the metadata schema, the access rules and the disposition authority, so a record captured with its metadata picks up its access and retention rules from the classification it is given. One worked example runs from an accounts payable class through to a destruction batch and a legal hold.

Records management documentation that cites current editions

ISO 15489-1:2016 is the current edition, confirmed by ISO in 2021, but its references have aged. The bibliography still cites ISO 23081-1:2006 (now 2017), ISO 23081-2:2009 (now 2021), ISO 30300:2011 (now 2020) and the Technical Report that has become ISO 18128:2024. Its foreword names ISO/TR 15489-2, which ISO has withdrawn.

The crosswalk maps each of the 9 cited standards to its current edition, checked against ISO’s catalogue in October 2026, so your contracts and system specifications cite what is current rather than what was current in 2016.

Who the records management documentation pack is written for

• Records managers and information governance leads building or rebuilding a programme.
• Privacy teams who need retention periods they can justify.
• Quality and security teams whose certifications depend on controlled documented information.
• Organisations migrating systems who need capture, migration and source disposal on record.

What the records management documentation pack does not do

It does not lead to a certificate. ISO 15489-1 recommends and has no requirements an auditor can certify against, so anyone selling an “ISO 15489 certificate” is selling something the standard does not provide. If you need a certifiable management system for records, that is ISO 30301, and this standard is the operational base underneath it.

It does not give legal advice on retention. It does not reproduce ISO’s text either, so you need your own copy of the standard. It is not published by or affiliated with ISO.

Frequently asked questions

Is ISO 15489-1:2016 still current?

Yes. ISO reviewed and confirmed it in 2021.

Are the retention periods safe to use as they are?

No. They show the format and a reasonable starting point. Check each one against the law that applies to you and record the result in the mandates register.

Does it cover the four records controls?

Yes. Each is a working workbook with the procedure that governs it.

What formats are the files in?

Native Microsoft Word and Excel, fully editable, with live summary formulas and example rows shown in grey.

Related toolkits

Records management sits under most other frameworks. The ISO 9001 toolkit and ISO 27001 toolkit depend on controlled documented information, the GDPR toolkit needs retention periods you can justify, and the Data Governance toolkit covers the wider data estate. ISO lists the standard at ISO 15489-1:2016.

Implementing for clients? The Consultant Package licenses all 91 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.

Delivery, format and licence

The records management documentation pack downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is locked, nothing is a PDF you cannot edit, and no add-on or portal login is needed to open them. Every organisation-specific value is marked as a placeholder so you can see what still has to be decided.

One payment, no subscription and no annual renewal. The source files are yours to adapt for your own organisation for as long as you need them, including future revisions of your own documents.