Does my organization need a written records management policy to be compliant, or is practice enough?

Most laws and standards require that records be created, kept, and disposed of properly. They rarely dictate the exact form your governance must take. So the short answer is: a written policy is not always legally mandated by name, but in practice it is how organizations demonstrate they are meeting their obligations consistently and defensibly.

Why practice alone falls short

Informal practice can work until it is tested. The problems usually surface at the worst moment:

• No proof of intent. During an audit, litigation, or a public-records request, you may need to show that disposition followed a deliberate, approved process, not ad hoc decisions.
• Knowledge walks out the door. When practices live only in people’s heads, staff turnover erases your program.
• Inconsistency. Two departments handling the same record type differently is a sign of risk, not flexibility.

The legal concept of a defensible program rests on showing your actions were reasonable, documented, and uniformly applied. Undocumented practice is hard to defend.

What a written policy provides

A records management policy turns scattered habits into an accountable system. A useful policy generally:

• States the program’s scope and who is responsible.
• Defines what counts as a record across all formats, including email and other electronic content.
• References the retention schedules that govern how long records are kept.
• Establishes rules for storage, access, legal holds, and authorized disposition.
• Assigns roles so the program survives staff changes.

International guidance such as ISO 15489 treats a documented framework, clear roles, and a retention schedule as core elements of a sound records system. Public-sector guidance points the same direction: policy is the foundation, and procedures and schedules build on it.

A practical takeaway

Check your specific obligations first. Regulated industries, government bodies, and organizations subject to litigation often face explicit or strongly implied documentation requirements. Even where no statute names a policy outright, a written one is the most reliable way to prove compliance and reduce risk.

Think of it this way: good practice is what you do, and policy is how you prove you do it. The two work together. A policy without practice is empty, but practice without policy is fragile.

For foundational concepts behind building a defensible program, see the fundamentals topic hub.