Records Management and Retention Training Course

Duration 10 days 16 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Records Managers, Information Governance Managers and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-KRM-033

Before you join: Participants should have experience working with business documents, digital content, operational procedures or compliance requirements.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Poorly controlled records create operational delay, legal exposure and avoidable cost. Staff cannot locate authoritative information, retention rules are applied inconsistently, and confidential material remains accessible or is destroyed without evidence. These failures affect public authorities responding to information requests, banks retaining customer and transaction evidence, NGOs managing beneficiary records, and multinationals handling records across jurisdictions. Effective records management establishes which information must be kept, who owns it, where it is held, how long it remains available and how disposal is authorised.

This course provides a practical method for designing, operating and improving records management and retention controls. Participants examine the records lifecycle, ISO 15489 principles, classification schemes, metadata, file plans, retention schedules, legal holds, secure disposal, access controls and audit evidence. They learn to distinguish records from working documents, map recordkeeping obligations, assess information risks and set controls for paper, email, collaboration platforms, line-of-business systems and digital repositories. The course also addresses governance roles, policy design, implementation planning, monitoring and remediation.

Teaching combines focused instructor briefings with realistic cases, records inventories, retention-rule analysis, classification design, group reviews and implementation planning. Participants work progressively on a records management package based on their own organisation or a supplied case. They leave with a usable records inventory, file-plan structure, retention schedule, disposal workflow, governance model and phased implementation plan. The programme is delivered over 10 instructor-led days, either in a classroom in 50+ cities or live online, and includes approximately 6.5 contact hours each day from 08:30 to 16:30. Participants receive a certificate of completion.

The course suits managers and specialists responsible for records, information governance, compliance, archives, legal operations, digital transformation or business administration. It is particularly relevant where retention obligations, audit requirements, privacy duties or information-access requests demand defensible recordkeeping.

What you will be able to do

  • Design a records classification scheme and file plan for business functions and activities
  • Build a retention schedule using legal, regulatory, operational and archival retention requirements
  • Apply ISO 15489 principles to records creation, capture, access, storage and disposal
  • Conduct a records inventory and information-risk assessment across physical and digital repositories
  • Define metadata requirements, naming conventions and recordkeeping controls for digital content
  • Establish legal hold, disposal authorisation and defensible destruction procedures
  • Develop records governance roles, policies, performance measures and audit evidence
  • Present a phased records management implementation plan with priorities, owners and controls

Benefits of attending

For you

  • Produce defensible retention decisions rather than relying on informal file-cleaning practices
  • Identify high-risk records gaps before they become audit, privacy or litigation issues
  • Communicate records requirements clearly to legal, IT, compliance and business stakeholders
  • Create practical file plans and metadata controls for digital and physical records
  • Lead a structured records improvement project with measurable implementation milestones

For your organisation

  • Reduces exposure from unauthorised destruction, excessive retention and inaccessible evidence
  • Improves retrieval of authoritative records for audits, investigations and information requests
  • Creates consistent retention decisions across departments, repositories and record formats
  • Supports privacy, regulatory and legal obligations through documented disposal controls
  • Provides a prioritised implementation plan for improving records governance and accountability

Course modules

16 modules over 10 days

Participants can define the scope, value and control requirements of a records management programme.

  • Records, documents and information assets distinguished through evidential and operational value
  • Business activities linked to records created as reliable evidence
  • ISO 15489 principles for authentic, reliable, usable and integral records
  • Records lifecycle stages from creation through retention, review and disposal
  • Accountability chains for record creators, custodians, owners and authorised approvers
  • Consequences of poor recordkeeping during audits, disputes, incidents and service delivery

Participants can establish governance roles, decision rights and escalation routes for records management.

  • Governance model connecting executive sponsorship, business ownership and records accountability
  • RACI matrices for classification, retention, access, transfer and disposal decisions
  • Records manager responsibilities compared with legal, IT, privacy and compliance roles
  • Policy hierarchy covering records policy, standards, procedures and local work instructions
  • Escalation routes for disputed retention decisions and unmanaged information risks
  • Terms of reference for records steering groups and governance committees

Participants can conduct a structured inventory of records, repositories, owners and risks.

  • Records inventory fields covering series, owner, format, location and retention
  • Repository mapping for paper stores, shared drives, email and business systems
  • Interviews with process owners to identify records created and received
  • Data-flow diagrams tracing records between business units, suppliers and systems
  • Record series boundaries defined by business function, activity and transaction
  • Risk ratings based on sensitivity, regulatory value, volume and retrieval difficulty

Participants can design a functional classification scheme and usable file plan.

  • Functional classification distinguishes enduring business activities from organisational structures
  • Business classification scheme built from functions, activities and transaction series
  • File-plan levels structured for consistent browsing, filing and retention assignment
  • Controlled vocabulary rules for titles, abbreviations, dates and version identifiers
  • Naming conventions applied to folders, files, cases and record containers
  • Cross-references and aliases managed without duplicating authoritative records

Participants can specify metadata and capture controls that preserve record context and integrity.

  • ISO 23081 metadata concepts for identity, context, relationships and management
  • Mandatory metadata fields for creator, date, classification, status and retention
  • Record declaration triggers for approvals, transactions, decisions and commitments
  • Capture rules for email, attachments, messaging and collaborative workspace content
  • Version control distinguishes drafts, superseded documents and final authoritative records
  • Audit trails preserve evidence of creation, access, amendment and disposal

Participants can set controls for records held across paper, digital and hybrid environments.

  • Paper file controls for registration, movement tracking, storage and return
  • Digitisation quality checks for completeness, legibility, indexing and image integrity
  • Scanning decisions based on source value, evidential needs and disposal authority
  • Shared-drive controls using approved folders, permissions and retention labels
  • Email management rules separating transitory messages from business records
  • Hybrid record links maintain relationships between physical files and digital copies

Participants can determine retention periods using defensible triggers and documented rationale.

  • Retention periods derived from legal, regulatory, fiscal and operational requirements
  • Trigger events identify when retention clocks start for each record series
  • Event-based retention applied to contracts, cases, employees and customer relationships
  • Minimum retention distinguished from maximum retention and review requirements
  • Retention rationale documented with source authority, interpretation and accountable owner
  • Conflicting retention obligations resolved through documented risk-based decision criteria

Participants can build and maintain a retention schedule linked to record series and disposal actions.

  • Retention schedule fields specify series, trigger, period, action and authority
  • Record series mapped from inventory entries into retention schedule categories
  • Disposition actions distinguish destruction, transfer, review and permanent preservation
  • Schedule citations record legislation, regulation, contract terms and policy sources
  • Business owners validate retention rules against operational and audit needs
  • Change-control procedures maintain schedule currency after legal or process changes

Participants can manage preservation requirements without disrupting routine records controls.

  • Legal hold process identifies custodians, sources, scope and preservation actions
  • Hold notices communicate suspension requirements, acknowledgements and escalation contacts
  • Retention disposal freezes documented for litigation, investigations and regulatory inquiries
  • Information request searches use defined scope, repositories, keywords and timeframes
  • Chain-of-custody records support defensible collection, review and production processes
  • Hold release authorisation restarts retention processing after preservation obligations end

Participants can align records access controls with security classification and privacy obligations.

  • Access classifications distinguish public, internal, confidential and restricted records
  • Role-based access controls assign permissions using documented business need
  • Privacy retention principles limit personal-data storage to justified periods
  • Sensitive records handling covers redaction, secure transfer and restricted storage
  • Access logs monitored for unusual retrieval, copying and permission changes
  • Third-party access agreements specify custody, return and destruction obligations

Participants can select storage and preservation controls appropriate to record value and risk.

  • Storage assessments examine capacity, environmental conditions, security and retrieval performance
  • Vital records protection identifies essential evidence for service continuity
  • Digital preservation risks include format obsolescence, corruption and platform dependency
  • Fixity checks detect unauthorised changes and digital file degradation
  • Migration planning preserves records through system replacement and format conversion
  • Business continuity plans prioritise recovery of high-value records and indexes

Participants can operate authorised disposal processes with complete evidence and safeguards.

  • Disposal workflows verify retention expiry, holds, approvals and record completeness
  • Destruction methods selected for paper, digital media and confidential information
  • Destruction certificates record series, dates, authority, method and responsible parties
  • Sampling checks confirm approved disposal lists match actual record holdings
  • Transfer procedures prepare archival records with metadata, packaging and custody documentation
  • Disposal exceptions recorded when operational, legal or historical value remains

Participants can draft practical records documentation and targeted staff guidance.

  • Records policy statements define purpose, scope, principles and mandatory responsibilities
  • Procedures translate policy requirements into filing, retrieval and disposal steps
  • Role-based guidance addresses executives, record creators, managers and system administrators
  • Quick-reference guides explain naming, classification, capture and retention actions
  • Training needs analysis identifies capability gaps by role and repository
  • Policy exceptions managed through documented approval, expiry and periodic review

Participants can measure records control performance and plan corrective action from audit findings.

  • Compliance audits test classification, metadata, access, retention and disposal controls
  • Audit sampling plans select record series, locations, dates and transaction types
  • Key performance indicators measure retrieval, classification accuracy and disposal completion
  • Maturity assessments benchmark governance, processes, technology and staff capability
  • Root-cause analysis distinguishes training failures, process defects and system limitations
  • Corrective action registers assign owners, deadlines, evidence and closure criteria

Participants can define records management requirements and prepare a phased implementation plan.

  • Functional requirements cover classification, metadata, retention, holds and audit trails
  • ISO 16175 requirements inform digital records system capability assessments
  • Repository gap analysis compares current controls against target recordkeeping requirements
  • Implementation roadmaps sequence governance, cleanup, configuration, migration and training
  • Change impact assessments identify affected roles, processes, repositories and controls
  • Benefits measures track risk reduction, retrieval improvement and disposal progress

Participants can build, review and present a complete records management and retention programme for a defined business area.

  • Programme scope defines business functions, repositories, stakeholders and priority record series
  • Records inventory synthesises sources, owners, formats, risks and control gaps
  • Classification and file plan demonstrate consistent organisation of selected record series
  • Retention schedule assigns triggers, periods, authorities and disposal actions
  • Governance model allocates accountability, escalation routes, measures and review cycles
  • Implementation plan presents priorities, milestones, dependencies, resources and risk treatments

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Records inventory template
  2. Functional classification and file-plan model
  3. Retention schedule template
  4. Legal hold and disposal workflow
  5. Records governance RACI matrix
  6. Phased records management implementation plan

Who should attend

  • Records Managers — responsible for retention controls, file plans and records service delivery
  • Information Governance Managers — accountable for information policy, ownership and control assurance
  • Compliance and Risk Officers — need defensible evidence of regulatory retention and disposal decisions
  • Legal Operations Professionals — manage legal holds, discovery readiness and litigation-related records
  • Data Protection and Privacy Staff — require retention controls aligned with personal-data obligations
  • Business Operations Managers — oversee teams creating and maintaining high-value operational records

Skills and tools covered

Records classification designRetention schedulingInformation risk assessmentMetadata governanceLegal hold managementRecords programme implementation

Tools and standards

ISO 15489, ISO 16175, ISO 23081, RACI matrix

How the course runs

Training methodology

The programme uses short instructor briefings to introduce standards, methods and control points, followed by case work drawn from regulated, public-sector and corporate recordkeeping situations. Participants analyse sample records inventories, classify information, test retention decisions and review disposal scenarios. Group exercises examine conflicting stakeholder requirements, legal holds and digital repository controls. Simulations test responses to audits, information requests and retrieval failures. Throughout the course, participants apply each method to their own organisational context or a supplied case, building a practical records management package.

Requirements and prerequisites

Participants should have experience working with business documents, digital content, operational procedures or compliance requirements. Familiarity with their organisation's information repositories, such as shared drives, email, enterprise content management systems or paper files, is helpful. Participants will benefit from bringing examples of current retention issues, policies or record categories where permitted. Prior records management training is not required. The course does not require legal qualifications, archival qualifications, technical system administration skills or prior knowledge of ISO standards.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should be familiar with the documents, systems or procedures used by their business area. No prior records management qualification, legal qualification or technical administration experience is required.

Bring examples of retention issues, record categories, policies or repository challenges where organisational rules permit. Participants do not need to bring confidential records, customer data or legally sensitive material.

It is designed for records and information governance staff, compliance professionals, legal operations teams, privacy staff and operational managers. It also suits people assigned to improve shared drives, paper files or enterprise repositories.

Data protection training focuses primarily on personal-data obligations, while document control commonly focuses on controlled documents and versions. This course addresses the full records lifecycle, including classification, retention, legal holds, disposal and governance.

Participants build practical materials throughout the programme, including an inventory, classification structure, retention rules and implementation priorities. These can be adapted for a department, process or record series after the course.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first week establishes records foundations, inventories, classification and retention; the second week develops legal hold, security, disposal, audit and implementation work before the capstone presentation.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.