Annex A.2: Annex A.2: Records controls
The organization has to put in place the controls that make the records processes consistent across the organization.
What annex A.2 asks
The organization has to put in place the controls that make the records processes consistent across the organization. The annex names four: metadata schemas for records, business classification schemes, access and permissions rules, and disposition authorities. Each control is a rule set with an owner and a maintenance route. Without them, capture depends on individual habit, search depends on file names, access depends on folder structure and disposal depends on who remembers the retention period.
The controls make the processes consistent. Each is a rule set with an owner and a maintenance route. Without them, capture depends on habit, search on file names and disposal on memory.
Reading it in practice
The four controls are only real when they are enforced. A metadata schema that the system does not require is a suggestion. A classification scheme that does not cover a business process will not classify that process's records. An access matrix that no one reviews will drift. A disposition authority that the system cannot execute will be applied by hand, if at all.
The third edition is at stage 50.00 and its clause text is not public. Annex A.2 is normative and names four controls: metadata schemas, business classification schemes, access and permissions rules, and disposition authorities. The third edition is not public.
Status: not shown in the public record. The 2019 requirement above is the one a certificate is issued against. No draft requirement is asserted.
Evidence for annex A.2
Expect an approved metadata schema, a classification scheme, an access matrix and a signed disposition authority, each with a version and an owner.
- Metadata Approved metadata schema and classification scheme with version and owner
- Metadata Access and permission matrix with review dates
- Metadata Disposition authority signed by the accountable role and applied in the system
Where annex A.2 commonly fails
- Metadata fields left empty because no one made them mandatory
- A disposition authority that exists on paper but cannot be executed in the system
What to do about annex A.2 before the revision
Check that the metadata fields are mandatory in the system, the classification scheme covers every process, the access matrix was reviewed in the last year and the disposition authority can be executed.
Read across from annex A.2
Open the full index. The revision record shows the public stage record and the proven 2011 to 2019 changes.
Source for annex A.2: ISO 30301:2019, ISO 30301:2019, Annex A.2 (normative), retrieved 22 October 2026. The requirement, evidence and gaps are written from our clause record; the draft status rests on the ISO/PRF 30301 page 89772. Every source.