Introduction

This document has been developed to assist users to apply the management system for records requirements of ISO 30301. ISO 30301 specifies the requirements for a management system for records (MSR) where an organization needs to demonstrate its ability to create and control information created, received and maintained as evidence and as an asset by an organization, in pursuit of legal obligations or in the course of conducting business.

The purpose of this document is to provide practical guidance on how to implement a management system for records (MSR) within an organization in accordance with ISO 30301. This document covers what is needed to establish and maintain an MSR. This document does not modify and/or reduce the requirements specified in ISO 30301. An activity or documenting an activity is considered mandatory only when it is required in ISO 30301.

The implementation of an MSR is generally executed as a project. An MSR can be implemented in organizations with existing records systems or programmes to review and improve the management of those systems or programmes or in organizations planning to implement a systematic and verifiable approach to records creation and control for the first time. Guidance described in this document can be used in both situations. An MSR can be an advisable option for addressing legal or technological uncertainty in some cases.

It is assumed that organizations that decide to implement an MSR have made a preliminary assessment of their existing records and records systems and have identified risks to be addressed and opportunities for major improvements. For example, the decision to implement an MSR can be taken as a risk-reduction measure for undertaking a major information technology platform change or outsourcing business processes identified as high risk. Alternatively, the MSR can provide a standardized management framework for major improvements such as integrating records processes with specific business processes or improving control and management of records of online transactions or business use of social media.

The use of this document is necessarily flexible. It depends on the size, nature and complexity of the organization and the level of maturity of the MSR, if one is already in place. Each organization's context and complexity are unique and its specific contextual requirements will drive the MSR implementation. Smaller organizations will find that the activities described in this document can be simplified. Large or complex organizations can find that a layered management system is needed to implement and manage the activities in this document effectively.

Guidance in this document follows the same structure as ISO 30301, describing the activities to be undertaken to meet the requirements of ISO 30301 and how to document those activities.

Clause 4 deals with how to perform the context analysis needed to implement an MSR. From this analysis, the scope of the MSR is defined and the relationship between implementing an MSR and other management systems is identified.

Clause 5 explains leadership and how to gain the commitment of top management. The commitment is expressed in a records policy and the assignment of responsibilities and authorities.

Clause 6 deals with planning the implementation of the MSR and adopting records objectives, which is informed by high-level risk analysis, the contextual analysis (see Clause 4), and the resources available (see Clause 7).

Clause 7 outlines the support needed for the MSR, such as resources, competence, awareness, communication, and documented information.

Clause 8 deals with defining or reviewing and planning the operational level. It includes the analysis to determine records to be created (see 8.2) and the design and implementation of records processes, controls and systems. It draws on the contextual requirements and scope (see Clause 4) and is based on the records policy (see 5.2), the risk analysis (see 6.1) and resources needed (see 7.1) to meet the records objectives (see 6.2) in the planned implementation. Clause 8 explains how to implement requirements in ISO 30301:2019, Annex A.

Clauses 9 and 10 deal with performance evaluation and improvement against planning, objectives and requirements defined in ISO 30301.

For each of the Clauses 4 to 10 of ISO 30301:2019, this document provides the following:

a) the activities necessary to meet the requirements of ISO 30301 – activities can be done sequentially, while some will need to be done simultaneously;
b) inputs to the activities – these are the starting points and can be outputs from previous activities;
c) outputs of the activities – these are the results or deliverables, with special mention to mandatory documented information, on completion of the activities.

The concepts of how to design the operational records processes are based on the principles established by ISO 15489‑1. Other documents developed by ISO/TC 46/SC 11 are the principal tools for designing, implementing, monitoring and improving records processes, controls and systems, and can be used in conjunction with this document for implementing the detailed operational elements of the MSR.

Organizations that have already implemented ISO 15489‑1 can use this document to develop an organizational infrastructure for managing records under the systematic and verifiable approach of the MSR.

BS ISO 30302:2022

Information and documentation. Management systems for records. Guidelines for implementation

Current, Under Review

Published:

31 Jul 2022