Clause 5.2: Policy
Top management must establish a records policy and keep it as documented information.
What clause 5.2 asks
Top management must establish a records policy and keep it as documented information. The policy has to suit the organization's purpose, commit it to meeting applicable requirements and to continual improvement, and provide a framework for setting records objectives. It also has to be communicated inside the organization and be available to interested parties where that is appropriate. A policy that could be pasted into any organization proves nothing; the test is whether it changes decisions about capture, access, retention and disposal.
A records policy is useful when it changes decisions about capture, access, retention and disposal. A policy that could be pasted into any organization is a certificate artefact, not a control.
Reading it in practice
Read the policy against the retention schedule and the access rules. If the policy promises protection and the access matrix is unreviewed, the policy is not being applied. The clause asks for a framework for objectives, so at least one objective should be traceable to a sentence in the policy.
The third edition is at stage 50.00 and its clause text is not public. The public record does not publish a draft policy clause. The 2019 text requires a documented policy with commitments to applicable requirements and continual improvement, and a framework for objectives.
Status: not shown in the public record. The 2019 requirement above is the one a certificate is issued against. No draft requirement is asserted.
Evidence for clause 5.2
Expect the approved policy, its owner, its approval and review dates, and evidence that it reached staff and relevant external parties. The auditor will compare its commitments with the objectives.
- Records policy Approved records policy with an owner, an approval date and a review date
- Records policy Communication record showing the policy reached staff and relevant external parties
- Records policy Objectives that can be traced to the commitments in the policy
Where clause 5.2 commonly fails
- Policy text with no commitment to applicable requirements
- Policy available on request in theory but never communicated in practice
What to do about clause 5.2 before the revision
Test each sentence of the policy against a real decision. Remove what cannot be acted on. Add the commitments to applicable requirements and continual improvement if missing. Communicate it with the change.
Read across from clause 5.2
Open the full index. The revision record shows the public stage record and the proven 2011 to 2019 changes.
Source for clause 5.2: ISO 30301:2019, ISO 30301:2019, Clause 5.2, retrieved 22 October 2026. The requirement, evidence and gaps are written from our clause record; the draft status rests on the ISO/PRF 30301 page 89772. Every source.