What is records man­age­ment and what does it entail?

Records man­age­ment (RM) is a field of man­age­ment that oversees the creation, receipt, storage, use, access, main­ten­ance, and disposal of records, whether in paper or digital format. It involves the su­per­vi­sion and ad­min­is­tra­tion of records through­out their lifecycle to ensure proper or­gan­isa­tion, ac­cess­ib­il­ity, and com­pli­ance with reg­u­lat­ory re­quire­ments.

Why is records man­age­ment important?

Records man­age­ment focuses on:

• Reducing lost and misfiled documents
• Helping to organise existing documents better
• Enabling quicker search and retrieval of documents
• Improving the general work processes as well as ef­fi­ciency
• In­creas­ing office space by reducing the amount of space needed for documents e.g. filing cabinets.

As well as improving the daily storing, modifying and sharing of documents, records man­age­ment also es­tab­lishes policies and standards so various types of records can be main­tained:

• Identi­fy­ing what records exist by main­tain­ing a records inventory
• Applying required retention periods to stored items
• Disposing of documents
• Applying legal holds to records when necessary
• Identi­fy­ing the owner of each records series
• De­term­in­ing that a chain of custody and a proper audit trail both exist
• De­vel­op­ing and ad­min­is­ter­ing defined records policy and pro­ced­ures, re­gard­less of whether the records are paper or elec­tron­ic
• Main­tain­ing records through­out their life cycle

As a company grows, it gets more difficult to keep an overview of where documents are stored, whether they’re up-to-date, or if you even still have them.

The aim of records man­age­ment is, therefore, to help a company make documents ac­cess­ible for both business op­er­a­tions and audits. Spread­sheets are a great way to track where records are stored. Many small or medium-sized busi­nesses use this method, but for larger busi­nesses, records man­age­ment software suites are more suitable and often have ac­count­ing software included.

How to comply with legal re­quire­ments

For many companies, it’s not simply a case of deciding whether to organise your documents correctly using records man­age­ment; it’s actually a legal re­quire­ment. These are some of the problems you may face if you don’t comply:

• Be fined
• Risk of being audited by au­thor­it­ies
• Possible damage to repu­ta­tion
• Risk of pro­sec­u­tion and claims for damages

When complying with records man­age­ment reg­u­la­tions, busi­nesses must consider both national and in­ter­na­tion­al re­quire­ments. ISO 15489 is the leading voluntary standard that provides guidance on how to maintain an archive system

ISO 15489 Standard

This in­ter­na­tion­al standard has been im­ple­men­ted in the UK as BS ISO 15489-1:2016. It has been adopted in over 50 countries and trans­lated into more than 15 different languages. It provides or­gan­isa­tions with a the­or­et­ic­al framework for re­cord­keep­ing and high­lights the im­port­ance of records man­age­ment. Topics covered include:

• Metadata for records
• Records systems and controls
• Records mon­it­or­ing
• Training for effective records man­age­ment
• Creating, capturing, and managing records

While ISO 15489 is not mandatory, it serves as a best practice guide. However, certain retention periods must be complied with under UK law. For example, the Lim­it­a­tions Act 1980 states that all business contracts, agree­ments, and other ar­range­ments need to be safely stored for the length of an employee’s contract plus six years after they leave.

Email records man­age­ment

It is important to ensure that both physical and digital records, par­tic­u­larly emails, are properly managed. Emails may be con­sidered business records if they involve trans­ac­tions, agree­ments, or other business-critical com­mu­nic­a­tions. Busi­nesses should establish clear policies on email retention.

For further guidance, you may find the following articles useful:

• Record retention periods
• Archiving business emails

GDPR and the Data Pro­tec­tion Act 2018

As mentioned above, the General Data Pro­tec­tion Reg­u­la­tion (GDPR) came into effect in May 2018 and contains special pro­vi­sions for archiving personal data in the public interest. The Data Pro­tec­tion Act 2018 (DPA 2018) is the UK’s im­ple­ment­a­tion of GDPR and also came into effect in May 2018, replacing the Data Pro­tec­tion Act 1998.

The DPA 2018 applies only to data related to living in­di­vidu­als. It sets out re­quire­ments for:

• Accuracy of stored data
• Keeping data up to date
• Ensuring data is kept only as long as necessary
• Ensuring ap­pro­pri­ate security measures to protect against un­au­thor­ised pro­cessing, access, loss, de­struc­tion, or damage

Fines for non-com­pli­ance

Busi­nesses that fail to comply with the Data Pro­tec­tion Act 2018 can face fines of up to £17.5 million or 4% of annual turnover—whichever is higher. Non-com­pli­ance with GDPR or suffering a data breach could also result in penalties of up to £17.5 million or 4% of global annual turnover.

Retention periods and HMRC re­quire­ments

Busi­nesses must adhere to specific retention periods for certain types of records:

• Financial records: At least 6 years under HMRC rules
• Employee records: Length of em­ploy­ment plus 6 years
• Tax records: 5 years from the latest tax return sub­mis­sion
• Health & safety records: Minimum 40 years in some cases

By following records man­age­ment best practices and legal re­quire­ments, busi­nesses can ensure com­pli­ance, protect sensitive data, and avoid legal penalties.

Please note the legal notice for this article.