Who should own the records retention schedule and who has authority to approve changes to it?

Two distinct roles: ownership and approval

A records retention schedule needs clear accountability split between the people who maintain it day to day and the people who authorize it. Confusing the two is a common governance weakness.

Ownership is the operational responsibility for keeping the schedule accurate, current, and usable. In most organizations this belongs to the records or information governance function — often a Records Officer, Records Manager, or RIM/IG program lead. The owner drafts retention periods, maps records series to business processes, monitors legal and regulatory changes, and coordinates the periodic review cycle. Ownership is centralized so the schedule stays consistent across the enterprise.

Approval authority is the power to formally adopt the schedule and authorize changes to it. This sits higher and broader than ownership, because a retention schedule carries legal and financial consequences. Approval typically requires sign-off from a defined governance body rather than a single person.

Who approves changes

Changes should pass through a documented review involving the stakeholders who bear the risk:

• Legal / general counsel — confirms retention meets statutory, regulatory, and litigation-hold obligations.
• Compliance and privacy — validates against data-protection and recordkeeping rules.
• Information security / IT — confirms the schedule is technically enforceable in systems.
• Business unit owners — verify operational and historical value of their records.
• Senior management or a records governance committee — grants final, authoritative approval.

In government, retention schedules generally require approval by the designated records authority (in the U.S. federal context, the National Archives) before agency records may be destroyed. Private organizations mirror this through an internal authorization chain.

Why the separation matters

Keeping ownership and approval distinct preserves accountability and creates an audit trail. The records function proposes; an empowered, multidisciplinary body disposes. No individual unilaterally shortens or extends retention — a safeguard against both premature destruction and indefinite over-retention.

A sound practice is to require documented approval for every change, version the schedule, and review it on a fixed cycle (commonly annually) or whenever laws, systems, or business functions change materially.

For related guidance on policies, roles, and program governance, see the information governance topic hub.