What are IT's responsibilities versus the records officer's when applying retention rules in a system?

Applying retention rules in a system is a shared effort, but the two roles are not interchangeable. The records officer owns what the rules should be and why; IT owns how the system enforces them reliably. Confusing the two is a common source of premature deletion, unlawful retention, and failed audits.

The records officer’s responsibilities

The records officer (or records manager) is accountable for the substance of the rules. This role typically:

• Defines retention periods and disposition actions based on an approved records schedule and applicable legal, regulatory, and business requirements.
• Maps records categories to the right schedule items, including trigger events (the cutoff date that starts the retention clock).
• Authorizes disposition, ensuring nothing is destroyed without proper approval and that destruction is suspended under a legal hold.
• Validates that the system’s configured rules match the official schedule, and reviews disposition reports before records are destroyed.
• Maintains documentation and trains staff on classifying and declaring records correctly.

In short, the records officer is the policy and compliance authority. The schedule is their instrument, not IT’s.

IT’s responsibilities

IT translates those approved rules into accurate, durable system behavior. This role typically:

• Configures retention and disposition logic in the system exactly as specified by the records officer, with no independent changes to periods or triggers.
• Ensures the system reliably calculates cutoffs, applies holds, and executes (or queues) disposition.
• Protects integrity, security, and access controls so records and their metadata are not altered or lost.
• Provides audit trails, backups, migration, and disaster recovery so retention survives upgrades and system changes.
• Implements legal holds technically once invoked, and prevents destruction of held records.

IT should not decide retention periods or approve destruction; those are governance decisions.

Where they meet

The two roles intersect at validation and change control. When a schedule changes, the records officer updates the requirement and IT updates the configuration, with both confirming the result through testing and audit review. Clear, documented governance, the kind ISO 16175 describes for digital recordkeeping, keeps the boundary clean and defensible.

For more, see the retention and disposition topic hub.