Records management: keeping what matters and disposing of the rest

Records management is the discipline of controlling the information a business creates and receives for as long as it needs it, and disposing of it deliberately afterwards. The word records is doing work there: not every document is a record. A record is something you must be able to produce — evidence of a transaction, a decision, an obligation — as distinct from the drafts, copies and working files that surround it.

Small businesses mostly do this by accident, which shows up in two ways. Something required cannot be found when a customer, auditor or court asks for it. And everything else has been kept forever, in several copies, which costs storage, complicates every search, and quietly increases the damage of any breach.

The parts of a records programme

• A record inventory: what kinds of records exist, where they live, and who owns each kind. Most organisations have never written this down and are surprised by their own list.
• A retention schedule saying how long each class is kept and what triggers the clock — creation, end of contract, end of financial year. This is the core, covered in records retention schedule.
• Disposal that actually happens, with a record of what was destroyed and when. A schedule nobody executes is worse than none, because it documents an intention you did not follow.
• Access rules: who may see, edit and delete each class, which is the ground covered by access control policy.
• Integrity: version control and an audit trail, so the record produced years later is demonstrably the record that was made.
• A legal hold procedure that suspends disposal when litigation or an investigation is foreseeable. This overrides the schedule and needs to be somebody's named responsibility.

Keeping everything is not the safe option, which is the instinct this discipline most often has to correct. Data you no longer need is data that can still be breached, still has to be searched in a dispute, and in several privacy regimes should not be there at all. Deliberate disposal on a documented schedule is a defensible position; hoarding is not, and it is more expensive.

Building one without a records manager

1. List the categories rather than the documents. Ten to twenty classes covers most small businesses — contracts, invoices, payroll, HR files, tax records, customer correspondence.
2. For each, write down the legal minimum where you operate, then whatever business need is longer, and take the longer of the two as the retention period.
3. Name an owner per class. Unowned records are the ones that survive forever because nobody has the authority to delete them.
4. Decide the disposal method by sensitivity: secure deletion, shredding, or a documented anonymisation.
5. Run disposal on a cycle — annually is enough for most — and keep a short log of what went.
6. Write down the legal hold rule before you need it, because the moment you need it you will not have time to invent it.

The standards, briefly

There is a formal literature here, and ISO 15489 is the reference standard for records management. Certification is not the point for a small business; the useful part is the vocabulary and the idea that a record has a lifecycle — creation, use, retention, disposal — with a decision at each stage. If you are in a regulated sector, your regulator very likely prescribes specific retention periods that override any general advice, including this article.

Where it lives

Ettex Records holds the classes as structured entries with owners, dates and the retention position attached, so what is due for disposal can be listed rather than remembered. Documents themselves sit in Ettex Docs with version history, and the surrounding governance in data governance and document control system.

The limits, stated plainly: there is no automated disposal engine that deletes on a schedule, no certified records management platform behaviour, no write-once storage and no legal hold enforcement. Those exist as a product category for organisations under archival or regulatory obligations, and a business in that position should buy one. What we provide is the register, the dates and the trail.