Records Management Compliance Training Course

Duration 10 days 19 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Compliance Officers, Records Managers and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-KRM-024

Before you join: Participants should understand their organisation’s basic document, information or compliance processes and have experience handling business records, policies, audit evidence or regulatory requirements.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Records management failures can expose organisations to regulatory penalties, failed audits, lost evidence, privacy breaches, unnecessary storage cost and weak legal positions. Compliance officers must be able to show what records exist, who owns them, how long they are retained, how they are protected and how disposal decisions are authorised. This requires more than filing rules: it requires defensible controls that work across paper files, email, collaboration platforms, business systems and outsourced services.

This course develops the methods used to design, assess and improve records management controls. Participants examine ISO 15489-1 principles, records lifecycle controls, classification schemes, metadata, retention scheduling, legal holds, disposition, access controls and audit evidence. They learn to translate legal, regulatory, contractual and operational requirements into practical policies, procedures, registers and control tests. Attention is given to high-risk records such as customer files, employee records, procurement documentation, financial records, investigation files and board papers.

Teaching combines short instructor briefings with sector-based case work, group analysis, control-design activities and simulated compliance reviews. Participants progressively build a records management compliance pack during the course, using their own organisational context where appropriate. They leave with a structured set of reusable documents: a records inventory, classification model, retention schedule, compliance risk assessment, control-testing plan and implementation roadmap.

The course suits compliance officers, records managers, information governance staff, internal auditors, privacy professionals and operational managers responsible for regulated information. It is particularly relevant where records are held across multiple systems, jurisdictions, suppliers or business units and where management needs reliable evidence of control.

What you will be able to do

  • Assess records management maturity against ISO 15489-1 principles and compliance obligations
  • Build a records inventory covering repositories, owners, record series, risks and controls
  • Design a business classification scheme and metadata model for controlled retrieval
  • Develop a legally defensible retention schedule using regulatory, operational and risk criteria
  • Apply legal hold procedures to suspend disposition and preserve relevant evidence
  • Test records management controls using audit criteria, sampling methods and evidence logs
  • Prepare a records management compliance risk assessment and treatment plan
  • Present an implementation roadmap for a records management compliance programme

Benefits of attending

For you

  • Ability to identify records compliance gaps before an audit or investigation
  • Practical method for producing defensible retention and disposal decisions
  • Confidence to challenge uncontrolled storage, duplicate records and undocumented destruction
  • Reusable evidence framework for compliance reporting and internal audit responses
  • Stronger capability to lead records remediation projects across business teams

For your organisation

  • Clearer evidence of compliance with retention, privacy and regulatory requirements
  • Reduced exposure from unmanaged records, premature destruction and failed legal holds
  • Lower storage and discovery costs through authorised disposition of redundant records
  • Consistent records controls across paper files, email, shared drives and business systems
  • Improved audit readiness through documented ownership, testing and corrective actions

Course modules

19 modules over 10 days

Participants can explain the compliance purpose, scope and accountability of records management.

  • Records, documents and data distinguished through evidential and accountability characteristics
  • Compliance obligations mapped across laws, regulations, contracts and internal policy
  • ISO 15489-1 principles applied to authoritative business records
  • Records lifecycle stages from creation through retention, disposition and transfer
  • Accountability roles defined using RACI for records governance
  • Business consequences of missing, altered, inaccessible or over-retained records

Participants can translate external and internal obligations into records management requirements.

  • Legal hierarchy assessed from statutes through regulator guidance and contractual clauses
  • Requirements register structured by record series, obligation, trigger and evidence
  • Privacy obligations linked to retention, minimisation and secure disposal
  • Financial, tax and corporate records requirements analysed for retention periods
  • Sector rules compared where customer, health, safety or public records apply
  • Conflicting requirements escalated through documented legal and compliance decisions

Participants can create a governance structure for controlled records management.

  • Governance charter defines mandate, decision rights, escalation and reporting
  • Policy hierarchy separates principles, policy statements, procedures and work instructions
  • Records ownership assigned to accountable business process owners
  • Information governance committee terms of reference establish oversight responsibilities
  • Policy exceptions logged with risk acceptance, approval and review dates
  • Control objectives linked to policies, procedures, evidence and testing

Participants can produce a risk-based inventory of organisational records and repositories.

  • Records inventory captures series, owner, repository, format and sensitivity
  • Business process mapping identifies records created at decision points
  • Repository discovery covers paper stores, email, shared drives and applications
  • Data flow diagrams expose transfers to suppliers and overseas locations
  • High-risk record series prioritised using impact and likelihood criteria
  • Inventory validation reconciles owner statements with system and storage evidence

Participants can design a functional classification scheme aligned with business activity.

  • Functional classification separates functions, activities, transactions and record series
  • File plan structures tested against user retrieval and retention needs
  • Classification codes designed for stable business functions rather than departments
  • Naming conventions standardise titles, dates, versions and case identifiers
  • Crosswalk tables map legacy folder structures to approved classifications
  • Controlled vocabulary reduces inconsistent labels, abbreviations and duplicate categories

Participants can specify metadata and capture controls supporting authentic, reliable records.

  • Metadata schema defines creator, date, classification, status and retention attributes
  • Mandatory metadata fields set according to record value and compliance risk
  • Record declaration rules identify when documents become fixed business evidence
  • Version control distinguishes drafts, approved records and superseded copies
  • Email capture criteria identify transactions requiring preservation as records
  • Audit trails preserve actions, access events, metadata changes and disposition decisions

Participants can assess whether records meet evidential requirements for integrity and reliability.

  • Authenticity assessed through provenance, authorship, timestamps and custody evidence
  • Reliability established by linking records to controlled business processes
  • Integrity controls protect records from unauthorised amendment, deletion and substitution
  • Chain of custody logs document transfers, handlers and repository changes
  • Digital signatures and approvals evaluated for evidential strength and traceability
  • Quality checks identify incomplete files, missing attachments and broken relationships

Participants can design proportionate access controls for sensitive and regulated records.

  • Role-based access control assigns permissions through documented business roles
  • Sensitivity classifications distinguish public, internal, confidential and restricted records
  • Least-privilege reviews remove inappropriate access after role or employment changes
  • Segregation of duties protects approval, amendment and disposition decisions
  • Access logs reviewed for unusual downloads, searches and privilege changes
  • Third-party access clauses define confidentiality, security, monitoring and return requirements

Participants can develop retention rules based on legal, operational and risk evidence.

  • Retention schedule structure identifies record series, trigger, period and disposition action
  • Retention triggers distinguish event-based, calendar-based and closure-based calculations
  • Legal minimums compared with operational needs and litigation risk
  • Research supports retention decisions through cited authorities and documented rationale
  • Superseded schedules reviewed for obsolete categories, conflicts and missing coverage
  • Retention rule owners approve schedules through formal governance checkpoints

Participants can implement authorised disposition processes with auditable evidence.

  • Disposition workflows route records for review, approval, transfer or destruction
  • Destruction authorisations document eligible records, approvals, methods and dates
  • Secure destruction methods selected for paper, digital media and cloud content
  • Disposition logs retain evidence of destruction, transfer and exception decisions
  • Sampling checks confirm destroyed records were eligible under approved schedules
  • Permanent-value records assessed for archival transfer and preservation requirements

Participants can apply legal hold controls that preserve records during disputes and investigations.

  • Legal hold triggers identified from litigation, investigations, audits and regulator requests
  • Hold notices specify custodians, record scope, preservation actions and acknowledgement
  • Suspension rules override automated deletion and routine disposition processes
  • Custodian interviews locate personal stores, devices and informal communication channels
  • Preservation monitoring tracks acknowledgements, exceptions, collection and release decisions
  • Hold release authorisations restore retention schedules after documented legal clearance

Participants can establish records controls for digital workplaces and business applications.

  • System assessment examines capture, metadata, access, retention and audit capabilities
  • Email, chat and collaboration content evaluated against record declaration criteria
  • Shared drive remediation applies classification, ownership and retention controls
  • Business application records linked to transaction data and retention rules
  • Cloud service contracts address export, deletion, audit access and data location
  • Migration plans preserve metadata, links, format integrity and audit trails

Participants can control paper and hybrid records alongside electronic recordkeeping systems.

  • Physical file inventories record location, contents, ownership and retention status
  • Barcode tracking controls movement between registries, offices and offsite storage
  • Hybrid file rules identify authoritative copies and synchronisation responsibilities
  • Scanning quality criteria address completeness, legibility, indexing and certification
  • Offsite storage contracts specify retrieval times, security and destruction authorisation
  • Environmental controls protect vital paper records from fire, water and pests

Participants can assess records risks and select appropriate preventive and detective controls.

  • Risk assessment identifies threats, vulnerabilities, impacts and existing controls
  • Inherent and residual risk ratings support prioritised treatment decisions
  • Control design distinguishes preventive, detective, corrective and compensating controls
  • Risk registers assign owners, actions, due dates and assurance evidence
  • Key risk indicators monitor overdue disposal, missing metadata and access exceptions
  • Treatment plans balance legal exposure, operational effort and available resources

Participants can test records controls and report findings to management.

  • Audit criteria derived from policy requirements, retention schedules and control objectives
  • Sampling plans define populations, sample sizes, selection methods and exceptions
  • Walkthroughs trace record creation, storage, access and disposition evidence
  • Control testing workpapers document procedures, findings, evidence and conclusions
  • Root cause analysis distinguishes training, process, system and governance failures
  • Corrective action registers track owners, deadlines, validation and closure

Participants can manage records-related incidents and recovery actions with defensible documentation.

  • Records incidents classified by loss, unauthorised disclosure, corruption or destruction
  • Incident triage preserves affected evidence before remediation or system restoration
  • Notification decisions align privacy, contractual, regulatory and legal requirements
  • Business continuity priorities identify vital records supporting critical services
  • Recovery procedures restore records, metadata, access controls and audit evidence
  • Post-incident reviews assign corrective actions and update risk treatments

Participants can manage records compliance risks arising from external service providers.

  • Supplier due diligence assesses storage, security, retention and audit arrangements
  • Records clauses define ownership, access, retention, return and destruction obligations
  • Service-level measures monitor retrieval, export, incident reporting and deletion performance
  • Subprocessor controls identify downstream storage, access and transfer arrangements
  • Exit plans secure records return, migration support and certified destruction
  • Supplier assurance evidence reviewed through reports, attestations and audit rights

Participants can plan phased records management improvements with accountable delivery arrangements.

  • Maturity assessment scores governance, processes, technology, people and assurance
  • Gap analysis compares current controls with target compliance requirements
  • Implementation roadmap sequences quick wins, dependencies, resources and milestones
  • Change impact assessment identifies affected roles, systems and business processes
  • Training plans target record creators, custodians, managers and system administrators
  • Management reporting presents risks, progress, decisions and unresolved issues

Participants can build, review and present a complete records management compliance pack for a defined business area.

  • Scope statement defines business area, record series, repositories and obligations
  • Records inventory identifies ownership, sensitivity, retention and control gaps
  • Classification and metadata model supports consistent capture and retrieval
  • Retention schedule specifies triggers, periods, disposition actions and approvals
  • Risk assessment prioritises control weaknesses, treatments, owners and evidence
  • Implementation roadmap presents milestones, governance, testing and management reporting

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Records management compliance requirements register
  2. Risk-based records inventory template
  3. Business classification scheme and file plan model
  4. Retention schedule template with documented rationale
  5. Legal hold and disposition control checklists
  6. Records management implementation roadmap

Who should attend

  • Compliance Officers — need defensible records controls for regulatory monitoring and assurance
  • Records Managers — need structured methods for classification, retention and disposition
  • Information Governance Managers — need controls spanning repositories, owners and information risks
  • Internal Auditors — need criteria and evidence methods for reviewing records controls
  • Data Protection Officers — need retention and disposal controls supporting privacy obligations
  • Operational Managers — need practical accountability for records created by their teams

Skills and tools covered

Records compliance assessmentRetention schedule designClassification scheme developmentLegal hold managementDisposition control testingRecords programme planning

Tools and standards

ISO 15489-1:2016, ISO 16175, RACI matrix, Records retention schedule

How the course runs

Training methodology

The course uses short instructor briefings to introduce standards, legal concepts and control methods, followed by case analysis from regulated and public-service settings. Participants analyse records risks, draft control documents, review sample evidence and conduct simulated compliance assessments. Group work focuses on resolving realistic conflicts between business access, retention, privacy, security and legal preservation. Application planning is woven through both weeks so participants can adapt course materials to their own record series, repositories and governance arrangements.

Requirements and prerequisites

Participants should understand their organisation’s basic document, information or compliance processes and have experience handling business records, policies, audit evidence or regulatory requirements. Familiarity with shared drives, email, enterprise systems or document management platforms is useful. Participants will benefit from bringing examples of their current retention rules, records policies or audit findings where permitted. Prior records management certification, legal qualifications, specialist archive knowledge and technical system-administration skills are not required. The course explains relevant standards and methods before applying them.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should have basic familiarity with business records, compliance processes, information governance or audit work. Specialist records qualifications, legal training and system-administration experience are not required.

Bring examples of records policies, retention schedules, audit findings or recurring records problems if your organisation permits this. You can also work from the course cases if you cannot share organisational materials.

It is designed for compliance officers, records managers, information governance staff, internal auditors, privacy professionals and managers accountable for business records. It suits participants responsible for improving controls rather than only storing documents.

Document control training usually concentrates on approved documents and version management, while data protection training focuses on personal data obligations. This course addresses the full evidential lifecycle of business records, including classification, retention, legal holds, disposition and compliance testing.

Participants build a records compliance pack containing practical templates and analyses that can be adapted to a business unit or record series. The materials support policy review, audit preparation, remediation planning and management reporting.

Training runs from 08:30 to 16:30 each day, providing about 6.5 contact hours daily. The first week establishes governance, classification, retention and control foundations; the second week focuses on testing, incidents, suppliers, implementation and the capstone presentation.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Knowledge & Records Management