Thought Leadership: What Makes a Competent Records Auditor?

Both hold recognised audit qualifications. Both follow an audit plan. Both produce reports that look professional and thorough.

One identifies a critical governance risk - an exposure that, if unaddressed, could result in regulatory scrutiny, a privacy breach or evidential failure in litigation. The other concludes the system is operating effectively and closes the audit with a clean report.

Same organisation. Same records. Same standards. Completely different findings.

The difference is not the audit process. It is the auditor.

In the first article in this series, we examined why records auditing is a specialist discipline - why general audit credentials do not automatically transfer to records management and why the stakes of getting it wrong are higher than most organisations realise.

This article examines the other side of that question: what does genuine competence in records auditing actually look like? What knowledge, skills and judgement distinguish an auditor who can be relied upon from one whose findings, however professionally presented, may not withstand scrutiny?

The question is not whether an auditor can conduct an audit. The question is whether they possess the specialist knowledge to identify records-specific risks, evaluate records evidence and form reliable conclusions about the effectiveness of a management system for records.

An audit report is not simply a collection of observations. It is a professional opinion - one that boards rely on for assurance, regulators may accept as evidence of compliance and organisations use to prioritise investment and demonstrate accountability.

The value of those decisions depends entirely on the quality of the audit that informed them.

This is where records auditing presents a distinctive challenge. An auditor who lacks sufficient records management knowledge may successfully confirm that a process exists yet fail to assess whether that process actually produces authentic, reliable and useable records. They may verify that a retention schedule has been approved without recognising that it no longer reflects the organisation's legal obligations or operational requirements. They may review a records management policy without asking whether it is being followed in practice or whether the system designed to implement it is actually capable of doing so.

The result is not always a poor-quality audit in any obvious sense. More insidiously, it may be a technically competent audit that provides incomplete - or misleading - assurance.

THE COMPETENCE QUESTION

The most concerning audit outcome is not a qualified report that identifies significant risks. It is a clean report that misses them. An organisation operating under false assurance may actively defer corrective action it urgently needs because the audit told it everything was fine.

Understanding the Standards

Competent records auditing begins with a thorough understanding of the standards against which an organisation is being assessed. This is not optional background knowledge. It is the technical foundation on which every audit finding rests.

Three standards are central to this discipline.

ISO 15489 – Records Management

ISO 15489 establishes the concepts and principles that underpin modern records management. It defines what records are, what characteristics they must possess - authenticity, reliability, integrity and useability - and what organisational controls are required to create, capture and manage them effectively.

For an auditor, this standard is not background reading. It is the lens through which every aspect of a records management system must be examined. Without a thorough understanding of ISO 15489, an auditor cannot reliably assess whether records are being created at the right point in business processes, whether disposal decisions are properly authorised, whether metadata standards are supporting evidential integrity or whether the organisation's records governance is fit for purpose.

ISO 15489 tells the auditor what good looks like. An auditor who doesn't know the standard cannot recognise when an organisation falls short of it.

ISO 30301 - Management Systems for Records

If ISO 15489 defines the principles, ISO 30301 provides the architecture. It applies a management systems approach to records management - requiring organisations to establish governance structures, define responsibilities, assess and manage risk, monitor performance and drive continual improvement.

Auditing against ISO 30301 is not the same as reviewing individual recordkeeping activities. It requires the ability to assess whether those activities operate as an integrated, self-correcting system - one capable of delivering consistent outcomes across the organisation's full range of business processes.

That means evaluating leadership commitment, not just policy documentation. It means assessing whether the organisation's risk processes identify records risks not just financial or operational ones. It means examining whether performance monitoring generates insight and drives action, rather than simply producing metrics that satisfy a compliance obligation.

This is management systems auditing, applied to a specialist discipline. It requires both.

An auditor who approaches a records management system audit with only a general management systems background will not know what questions to ask, will not recognise the significance of what they observe and will not be able to form reliable conclusions.

ISO 30302 - Implementation Guidance

ISO 30302 provides practical guidance for implementing and maintaining a Management System for Records. For auditors, this standard is a crucial reference point when assessing organisational maturity and implementation approach.

The distinction ISO 30302 helps auditors draw is one that separates good records auditing from superficial compliance checking: the difference between an organisation that has policies, procedures and systems in place and one whose controls are actually operating effectively and supporting organisational objectives.

An organisation may have an impressive suite of records management documentation. ISO 30302 helps the auditor ask the harder question: is any of it working?

WHAT STANDARDS-BASED AUDITING LOOKS LIKE IN PRACTICE

Consider a disposal audit. A general management systems auditor might confirm that a disposal process exists and is documented. A records auditor will ask different questions: Is disposal authorised by an approved retention schedule? Does that schedule reflect current legal obligations? Is disposal evidence retained? Can disposal decisions be reconstructed if challenged years later? Both auditors may review the same process. Only one is examining the records risk.

Technical standards knowledge is necessary. It is not sufficient.

An individual may possess deep records management expertise yet still lack the structured skills required to conduct an effective audit. Auditing is itself a discipline - one with its own methodology, principles and professional obligations.

Competent auditors understand how to scope an audit appropriately, plan evidence-gathering activities, test controls, identify non-conformities and formulate findings that are objective, repeatable and traceable back to the standards being applied. This is why ISO/IEC 17021-14 establishes competence requirements specifically for auditing and certification of Management Systems for Records - because records auditing has requirements that go beyond general management systems auditing.

A records audit should not depend on intuition or personal experience of what good practice looks like. It should follow a structured methodology that produces findings any competent auditor reviewing the same evidence would reach. That reproducibility is what transforms an observation into assurance.

A finding without evidence is an opinion. A finding supported by objective evidence, traceable to a recognised standard, becomes assurance. That distinction is fundamental to audit credibility - and to the decisions that flow from it.

Of all the competencies a records auditor must possess, the ability to gather and evaluate evidence is perhaps the most consequential and the most frequently underestimated.

Records management systems often appear effective on paper. Policies exist. Procedures are documented. Roles are assigned. Training has been delivered. The challenge the auditor faces is not assessing the documentation. It is determining whether the controls those documents describe are operating in practice.

Competent auditors do not simply review what organisations have written about themselves. They verify what organisations are actually doing.

This requires a different set of skills than document review. It involves:

• Examining records directly - not just records management policy - to assess whether the properties ISO 15489 requires are actually present
• Reviewing metadata to determine whether records are being captured with sufficient context to ensure their authenticity and usability over time
• Observing business processes to assess whether records are being created at the right point and captured in systems designed to maintain their integrity
• Conducting interviews that go beyond confirming awareness of policy to probing whether staff understand and apply records management requirements in practice
• Tracing the lifecycle of specific transactions or decisions to assess whether the records that should exist do exist - and whether they could support the organisation's obligations if called upon

The gap between documented intent and operational reality is often where the most significant records risks sit. An auditor who cannot navigate that gap - who accepts documentation as evidence of implementation - is not providing assurance. They are providing false comfort.

THE EVIDENCE STANDARD

Records management environments are documentation-rich. The risk for auditors is mistaking documentation for evidence. A policy says records will be created. A procedure says they will be captured. A system says it can manage them. The audit question is whether any of this is happening as described - and what the records themselves reveal.

Every competent auditor uses checklists. No competent auditor relies on them alone.

Standards provide requirements. Evidence provides facts. Professional judgement connects the two and it is the quality of that judgement that ultimately determines whether an audit report can be trusted.

Records management environments are rarely identical. Organisations operate within different regulatory frameworks, business models, technologies and risk profiles. A retail organisation's records obligations are different from a government agency's. A highly regulated financial institution faces different records risks than a professional services firm. What constitutes a material non-conformity in one context may be an observation in another.

Competent auditors must evaluate evidence within its organisational context. They must assess materiality - distinguishing between minor process gaps and systemic failures that expose the organisation to significant governance risk. They must recognise when a single observation is an isolated incident and when it is a symptom of a deeper problem in the records management system's design or operation.

They must also know when the evidence they have gathered is sufficient - and when they need to dig further before forming a conclusion.

The most significant governance risks are often identified not because a checklist asks the right question, but because a competent auditor recognises what the evidence is revealing - and understands its implications for the organisation's records governance.

his kind of professional judgement is not a soft skill. It is the product of genuine records management expertise combined with structured audit experience and the discipline to apply both consistently across varied environments. It is what separates an auditor who identifies risks from one who misses them.

JUDGEMENT IN PRACTICE

An auditor reviewing an organisation's disposal arrangements identifies that the retention schedule has not been updated in four years. A checklist might note this as an observation. A competent auditor asks different questions: What legislative changes occurred in the past four years? What new business activities have been undertaken? What records may now be retained longer than required - or disposed of before obligations have been met? The observation becomes a governance risk. The difference is judgement.

Historically, records auditing has lacked a widely recognised mechanism for independently verifying auditor competence. Organisations commissioning audits have had to rely on self-reported experience, qualifications from adjacent disciplines or professional reputation - none of which reliably indicates whether an auditor understands records management standards in sufficient depth.

This is not a sustainable position. As audit findings are increasingly relied upon for board assurance, regulatory submissions, procurement decisions and legal proceedings, the absence of an independent competence standard creates risk for everyone who depends on those outcomes.

Standards-based competence frameworks address this in a way that self-declaration cannot. They establish clear expectations across the full range of competencies records auditing requires - standards knowledge, audit methodology, evidence gathering, professional judgement and ongoing professional development. Crucially, they require those competencies to be independently assessed rather than assumed.

The benefits flow in both directions. Organisations gain a defensible basis for selecting auditors - one that goes beyond CV review and personal referrals. Practitioners gain a recognised pathway for demonstrating expertise that distinguishes their capability from that of generalist auditors claiming records competence. The profession gains the consistency, credibility and trust that formal competence verification produces.

INDUSTRY RESPONSE  

Recognising the growing reliance on records audit outcomes, RIMPA Global is currently piloting the -Management Systems for Records Scheme (MSRS) - the first industry-led auditor accreditation and certification framework developed specifically for Management Systems for Records. Developed in close alignment with ISO 15489, ISO 30301 and ISO 30302, the scheme is being tested against real-world audit environments and refined through practitioner feedback ahead of its planned 2027 launch.

Competent records auditors are not simply auditors who have spent time in records management environments. Nor are they records practitioners who have begun conducting audits.

They are professionals who combine deep knowledge of ISO 15489, ISO 30301 and ISO 30302 with structured audit methodology, rigorous evidence-gathering capability and the professional judgement to evaluate what they find within its governance context. Each element is necessary. None is sufficient alone. The combination is what enables organisations to rely on audit outcomes with genuine confidence.

The two auditors we described at the beginning of this article reviewed the same organisation. One identified a critical governance risk. The other missed it entirely. The organisation that received the clean report did not know what it was missing. That is the fundamental problem a competence framework is designed to solve.

As the records management profession continues to mature and as reliance on audit outcomes continues to grow - independently verified competence will become an increasingly important part of the assurance landscape. The question is no longer whether auditor competence matters. It is how organisations and the profession will ensure it can be demonstrated consistently, transparently and against internationally recognised standards.

The quality of an audit depends not only on the standard being audited. It depends on the competence of the person conducting it - and on whether that competence can be independently verified.

The next article in this series examines the MSRS pilot programme in practice - what was tested, what was observed and what the findings reveal about what competent records auditing looks like when assessed against a formal framework.

Assurance is only as strong as the competence behind it.