This International Standard intends to assist organizations in assessing records risks so they can ensure records continue to meet identified business needs as long as required. The International Standard a) provides methods for identifying and documenting risks related to records, records processes, controls and systems; b) provides techniques for analysing records risks; c) provides guidelines for conducting an evaluation of records risks. This International Standard can be used by all organizations regardless of size, nature of their activities, or complexity of their functions and structure. These factors, and the regulatory regime in which the organization operates, which prescribes the creation and control of its records, are taken into account when identifying and assessing records risk. Defining an organization or identifying its boundaries should take into account the complex structures and partnerships and contractual arrangements for outsourcing services and supply chains which are a common feature of contemporary government and corporate entities. Identifying the boundaries of the organization is the initial step in defining the scope of the project of records risk assessment. This International Standard does not address directly the mitigation of risks, as methods for these will vary from organization to organization. It can be used by records professionals or people who have responsibility for records in their organizations, and by auditors or managers who have responsibility for risk management programs in their organizations.