Information and Documentation Compliance Training Course

Participants can establish governance roles, policy structures and decision rights for records compliance.

• Information governance charter defines mandate, scope, authority and reporting lines
• Three-lines model clarifies management, oversight and independent assurance responsibilities
• Policy hierarchy links principles, policies, standards, procedures and work instructions
• RACI matrices assign ownership for classification, retention, access and disposal
• Escalation routes address exceptions, policy breaches and unresolved retention decisions
• Governance forums review risks, metrics, audit findings and improvement priorities

Participants can create an inventory linking information assets to business processes and owners.

• Information asset inventory captures owner, location, purpose, sensitivity and format
• Process decomposition identifies activities, inputs, outputs, controls and record triggers
• Authoritative source analysis resolves duplicate documents and conflicting versions
• Repository mapping covers paper files, email, shared drives and applications
• Data-flow diagrams trace information transfers between teams, suppliers and systems
• Risk ratings prioritise high-value, sensitive and poorly controlled information assets

Participants can design a business classification scheme that supports filing, retention and retrieval.

• Functional classification groups records by enduring business activities and accountabilities
• File plans connect functions, activities, transactions and record series
• Classification decisions distinguish business context from departmental organisational structures
• Naming conventions apply controlled titles, dates, identifiers and version markers
• Controlled vocabularies improve retrieval through preferred terms and authorised synonyms
• Crosswalks map legacy folder structures into an approved classification scheme

Participants can specify metadata and document-control rules for reliable retrieval and evidence.

• Metadata schema defines mandatory fields, optional fields, formats and validation rules
• Dublin Core elements support consistent description of digital information resources
• Document control assigns unique identifiers, versions, approvals and publication status
• Version histories preserve changes, authorship, review dates and superseded copies
• Controlled templates standardise headings, classifications, approvals and retention references
• Quality checks detect missing metadata, duplicate files and invalid field values

Participants can appraise records and construct retention rules with documented rationale.

• Retention appraisal weighs legal, operational, financial, historical and evidential value
• Trigger events define retention starts, including closure, expiry, termination and completion
• Retention schedules assign record series, periods, triggers, owners and disposition actions
• Legal requirements register records applicable statutes, regulations, contracts and limitations
• Risk-based appraisal addresses uncertain obligations, disputes and high-consequence information
• Rationale statements document why each retention period and action was selected

Participants can manage disposition approvals and create evidence of defensible destruction.

• Disposition workflows require eligibility checks, owner approval and documented authorisation
• Destruction certificates record series, volume, method, date and approving authority
• Secure destruction methods cover shredding, pulping, overwriting and cryptographic erasure
• Sampling checks confirm disposed records matched approved retention schedule criteria
• Permanent preservation criteria identify archives, vital records and historical evidence
• Disposition freezes prevent destruction during investigations, audits and legal holds

Participants can apply privacy and confidentiality requirements to records handling decisions.

• Personal data inventories identify data subjects, purposes, recipients and retention periods
• Data minimisation tests challenge unnecessary collection, duplication and prolonged storage
• Privacy notices align stated purposes with actual documentation and retention practices
• Confidentiality classifications distinguish public, internal, confidential and restricted information
• Data subject requests require search plans, redaction checks and response records
• Processor agreements define documentation duties, deletion obligations and audit rights

Participants can define access and security controls proportionate to information sensitivity.

• Role-based access control grants permissions according to approved job responsibilities
• Least-privilege reviews remove unnecessary access after role or assignment changes
• ISO/IEC 27001 control mapping links information risks with documented safeguards
• Access logs provide evidence of viewing, editing, exporting and deletion activity
• Segregation of duties protects approval, payment, procurement and personnel records
• Security incident procedures preserve records, logs and chain-of-custody evidence

Participants can assess whether electronic repositories meet key records-control requirements.

• Electronic records requirements cover capture, classification, retrieval, retention and disposition
• System configuration applies mandatory metadata, retention labels and access permissions
• Audit trails record administrative changes, user actions and disposition approvals
• Search testing measures retrieval accuracy, completeness, speed and reproducibility
• Migration plans preserve metadata, relationships, format integrity and audit evidence
• Acceptance criteria test repository controls before production deployment and handover

Participants can control business records created in email, collaboration and mobile platforms.

• Email capture rules identify messages with business, contractual or evidential value
• Teams and chat records require ownership, retention labels and export procedures
• Mobile messaging policies address approved channels, capture methods and prohibited use
• Shared mailbox controls assign custodians, access rights and retention responsibilities
• Automated classification uses content types, metadata rules and retention labels
• User guidance distinguishes informal exchanges from records requiring formal capture

Participants can plan compliant control of physical files and digitised records.

• Physical file inventories record location, owner, series, volume and condition
• Barcoding and tracking logs control file movement, retrieval and return dates
• Scanning specifications define resolution, colour depth, indexing and quality thresholds
• Quality assurance checks legibility, completeness, indexing accuracy and image orientation
• Source-document destruction requires legal assessment, validation and documented approval
• Environmental controls protect vital paper records from fire, water and pests

Participants can implement legal holds and preserve records for investigations or disputes.

• Legal hold notices identify custodians, sources, scope, duration and preservation duties
• Hold acknowledgements document recipient understanding, compliance and follow-up actions
• Preservation plans suspend automated deletion, disposal workflows and data overwriting
• Chain-of-custody logs document collection, transfer, storage and review of evidence
• E-discovery collections apply defensible search terms, date ranges and custodian lists
• Release procedures remove holds only after documented legal authorisation

Participants can prepare documented responses to disclosure and information-access requests.

• Request intake logs record scope, deadlines, requester details and assigned ownership
• Search protocols identify repositories, custodians, date ranges and relevant classifications
• Redaction reviews protect personal data, confidential terms and legally exempt material
• Disclosure logs record withheld material, reasons, approvals and released copies
• Quality assurance checks completeness, consistency, readability and deadline compliance
• Publication schemes identify information suitable for routine proactive release

Participants can assess records risks and specify preventive, detective and corrective controls.

• Risk registers capture causes, events, impacts, controls, owners and treatment actions
• Inherent and residual risk scoring prioritises remediation using defined criteria
• Bow-tie analysis connects threats, preventive controls, consequences and recovery controls
• Control design specifies frequency, performer, evidence, reviewer and escalation route
• Key control indicators measure overdue disposal, missing metadata and access exceptions
• Control self-assessments test ownership, operation and evidence before formal audits

Participants can plan and conduct records compliance reviews using auditable control evidence.

• Audit scopes define objectives, criteria, record populations, locations and reporting boundaries
• Sampling plans select representative records using risk, judgmental and random methods
• Test scripts verify classification, metadata, access, retention and disposition controls
• Evidence packs organise screenshots, logs, policies, interviews and sampled records
• Findings distinguish nonconformities, observations, root causes and risk ratings
• Corrective action plans assign actions, owners, due dates and closure evidence

Participants can prepare adoption measures that make records controls usable and sustained.

• Stakeholder analysis identifies affected roles, influence, concerns and communication needs
• Change impact assessments compare current practices with required future controls
• Role-based learning plans cover record creators, managers, administrators and auditors
• Quick-reference guides explain filing, naming, retention and escalation requirements
• Compliance communications use practical scenarios, deadlines and accountable actions
• Adoption measures track training completion, errors, exceptions and user feedback

Participants can monitor records performance and report management information for decisions.

• Records dashboards report capture rates, retrieval times, disposal volumes and exceptions
• Key performance indicators define formulas, targets, sources, owners and reporting cycles
• Trend analysis identifies recurring control failures, repositories and high-risk record series
• Management review packs link metrics, risks, audit findings and investment decisions
• Maturity assessments benchmark governance, processes, technology, people and assurance
• Improvement backlogs prioritise corrective actions by risk, effort and expected benefit

Participants can create a phased implementation plan for information and documentation compliance.

• Gap analysis compares current arrangements against defined control requirements and priorities
• Target operating model defines roles, processes, technology, governance and assurance
• Implementation roadmaps sequence policy, inventory, classification, retention and system actions
• Resource estimates identify sponsors, specialists, system support and operational contributors
• Dependency mapping addresses legal review, procurement, migration and change approvals
• Programme assurance establishes milestones, decision gates, risks and benefits measures

Participants can build, review and present a complete information and documentation compliance package for a defined business area.

• Compliance package defines scope, obligations, stakeholders, risks and target outcomes
• Business process map identifies record triggers, owners, systems and control points
• Information inventory records series, sensitivity, location, authoritative source and owner
• Classification and metadata model supports filing, retrieval, retention and access decisions
• Retention schedule and legal-hold procedure demonstrate defensible lifecycle control
• Audit plan, implementation roadmap and dashboard support management review and assurance