Records Management & Document Control Policy

1. Purpose and intent

Ensures records and controlled documents remain identifiable, accurate, protected, retrievable and appropriately retained. This policy is intended to provide a consistent reference for decisions, conduct and controls. It should be read alongside applicable laws, contractual obligations and relevant internal procedures. Where requirements differ, the applicable legal requirement and formally approved internal control take precedence.

2. Scope and application

Applies to records and controlled documents in physical and electronic form, including correspondence, contracts, approvals, reports, policies, operational evidence and personnel records.

Business partners are expected to observe equivalent standards where these are relevant to the services they provide or the activities they undertake on the organisation’s behalf. Application should be proportionate to role, activity, risk and applicable legal requirements.

3. Core principles

• Authenticity: records must accurately reflect the activity or decision.
• Control: controlled documents should have an owner, identifier, version and approval status.
• Access: access must reflect confidentiality and legitimate business need.
• Retention: records must follow approved retention requirements and legal holds.
• Disposition: disposal must be authorised and secure.

4. Minimum standards and controls

The following controls describe the expected minimum approach. Specific procedures, approval limits, forms and technical controls may be established separately and updated through controlled internal documents.

• Create records promptly and ensure they are complete, accurate and attributable.
• Use approved repositories and naming/version conventions.
• Do not delete, alter, conceal or backdate records improperly.
• Restrict confidential records and protect them against loss or unauthorised access.
• Apply retention schedules and suspend disposal where a legal hold applies.
• Ensure obsolete controlled documents are withdrawn from points of use.

5. Roles and accountability

Document owners maintain content and review dates. Records custodians maintain repositories and retention controls. All personnel must use current approved documents and preserve records relevant to their work.

Any person who is uncertain about the application of this policy should seek guidance before taking action. No individual may override a legal obligation or approved control without appropriate authority and documented justification.

6. Reporting and escalation

Concerns, suspected breaches, control weaknesses and incidents should be raised promptly through the relevant management or designated reporting channel. Urgent threats to health, safety, the environment or the security of information must be escalated immediately. Reports should be handled fairly, sensitively and in accordance with applicable privacy and records requirements.

7. Monitoring, assurance and review

Periodic reviews should assess completeness, retrieval, access rights, retention compliance, obsolete versions and secure disposal.

Where improvement actions are identified, they should be assigned to an accountable owner, given a proportionate target date and monitored to closure. Material changes in law, risk, organisational context or operating arrangements should trigger an earlier review.

8. Non-compliance

Failure to follow applicable requirements may result in corrective action, additional training, restricted authority, disciplinary measures, contractual remedies or referral to relevant authorities, depending on the circumstances and applicable law. Any response should be proportionate and follow fair process.

9. Related policies and standards

Corporate Governance; Data Protection; Information Security; Legal Hold; Delegation of Authority.

Additional policy requirements

The following provisions expand the practical expectations set out in this policy. They should be applied in conjunction with applicable law, approved internal procedures, contractual obligations and the circumstances of each activity.

Record creation

Records should be accurate, attributable, complete and created close to the time of the activity. Approvals, decisions, transactions, incidents and contractual commitments should be supported by appropriate evidence.

Classification and ownership

Records should be classified according to sensitivity, business value and legal requirements. Owners should be identified for important record sets and repositories. Access should be limited to authorised persons with a legitimate need.

Version and change control

Controlled documents should carry an identifiable title, owner, version or revision, approval status and effective date where applicable. Superseded versions should be identifiable and protected against accidental use. Unapproved drafts must not be represented as issued requirements.

Retention and legal hold

Retention schedules should reflect applicable law, contracts, limitation periods and operational needs. Records relevant to litigation, investigation, audit or regulatory inquiry must not be destroyed while a preservation requirement applies.

Secure storage and disposal

Records should be protected against loss, unauthorised alteration, disclosure and damage. Disposal should be authorised and secure, including for paper, devices, backups and third-party repositories.

Access and audit trail

Access, amendments, approvals and disposal of sensitive records should be traceable where practicable. Records should be retrievable within reasonable timeframes for legitimate business, audit and legal purposes.

10. Document governance

This web page is a public policy statement. The controlled internal version, where formally approved, is maintained through the organisation’s document-control process. Approval status, document owner, effective date, review cycle and revision history must be confirmed in the controlled document register before this text is represented as a formally issued internal policy.