What is the RMAT?
The Records Management Assessment Tool (RMAT) is a self-assessment tool designed to allow:
- public offices to self-assess and report their alignment with the Regulatory Framework (the State Records Act 1998 and the standards issued under the Act.)
- public offices to identify areas for improvement, and support associated business cases
- State Records NSW to have an overview of regulatory alignment across the sector, and
- State Records NSW to identify trends or key issues requiring targeted support.
The questions in the self-assessment tool are focused on the management of records, information and data in NSW public offices and show how these practices align with requirements in the State Records Act, the State Records Regulation 2024, and the mandatory standards (Standard on records management, Standard on the physical storage of State records). They highlight the links between records management and requirements for cyber security, privacy, data sharing, open data and information access under the Government Information (Public Access) Act 2009 (GIPA Act).
Using the RMAT
The Records Management Assessment Tool consists of:
You can use either the Word document or the spreadsheet to do your assessment. The spreadsheet format includes support for automated scoring and results graphs. The document format can be more easily printed if required.
Resources for completing the RMAT
The RMAT Guide (PDF 1.87MB) (updated August 2025) has been developed to provide you with further guidance in using the RMAT and preparing your submission to the biennial Recordkeeping Monitoring Exercise (RME). It includes a detailed explanation of each question and a template for developing an inventory of evidence.
The RMAT Webinar is an introduction to using the RMAT and the 2026 Recordkeeping Monitoring Exercise (RME).
Records Management Assessment Tool (RMAT) Webinar
Read transcript
Using the results of the assessment
The results of an assessment can be used for:
- reporting on the current status of records and information governance programs
- planning for improvement in a particular business unit or information system
- justifying investment and measuring progress.
The results can also support planning and reporting for cyber security, privacy, data sharing, open data and information access under the GIPA Act.
Public offices are also encouraged to use the RMAT results for:
- internal or external audit exercises
- annual or quarterly management reporting
- work planning and budgeting
- workforce capability planning
- training needs analysis
- staff development plans
- organisational restructure or machinery of government (MOG) changes
- digital initiatives to buy, decommission, or upgrade systems
- measuring and reporting the impact of an IT or information management project
- formal requests from State Records NSW for information on the organisation’s records and information management practices and conformity with requirements.
Do I send the results of my assessment to State Records NSW?
We encourage all public offices to use the RMAT routinely as part of your own internal monitoring.
You are required to submit your most recent RMAT assessment to State Records NSW when requested as part of the Recordkeeping Monitoring Exercise (RME).
The next RME will be held in 2-27 March 2026.
RMAT FAQ
This is a list of frequently asked questions about the Records Management Assessment Tool. View the RMAT Guide (PDF 1.87MB) for more information.
We recommend the person or team responsible for records and information management should answer the RMAT questions – or complete the questions collaboratively with key staff, such as a system owner, data custodian, business manager, or right to know officer.
This is important because:
- The assessment includes some technical terms that may require explanation from a records professional. These may not be the same terms that you routinely use in your organisation. You can also refer to the Glossary of recordkeeping terms for definitions.
- Some questions may be more applicable at the organisation-level (for example, if there is a central policy or executive leadership). You could consider pre-filling the answers to these questions before asking a system owner, data custodian, business manager or right to know officer to complete other questions.
- It builds awareness and communication between the business and the person or team responsible for overseeing records and information management. For example: the senior responsible officer (SRO) must have visibility of records and information management in all parts of the business in order to fulfil their responsibilities, and business managers should be aware of corporate-wide policies.
- It enables the person or team responsible for overseeing records and information management to better appreciate the ecosystem of records, information and data; and how well it is supporting business needs.
- It enables the person or team responsible for overseeing records and information management to fully understand the level of maturity in their public office, plan for improvements and justify requests for resourcing.
Yes, the RMAT is based on all obligations and requirements from the State Records Act, the State Records Regulation 2024, and the standards issued under the Act.
When you are using the RMAT, look at the Requirements column in the spreadsheet or the Word document; this section of the RMAT will tell you which regulatory requirements are linked to a question.
When you are looking at the Results of your assessment (in the Excel version of the RMAT), have a look at the Baseline Compliance Table. This table links regulatory requirements with the RMAT questions and indicates whether compliance is demonstrated for each requirement. This table has traffic light reporting; green indicates compliance and red indicates non-compliance.
Public offices should use the RMAT regularly; the assessment is not restricted as a one-time or biennial activity. We do not mandate how many times a year you should use the RMAT.
We would like to see public offices using the RMAT as it helps your business and assists your organisation to understand how recordkeeping is working or not working in your organisation.
The RMAT uses a 5 level maturity scale to determine the level of compliance with a requirement. You will need to select the maturity level that reflects your organisation’s current situation.
| Level | Description |
|---|---|
| 1. Ad hoc | The desirable processes are non-existent or ad hoc, with no organisational oversight. The organisation or senior responsible officer is unaware of whether a requirement is met. |
| 2. Developing | Processes are becoming refined and repeatable, but only within the scope of individual teams or projects. There are no organisational standards. |
| 3. Defined | Processes are standardised within the organisation based on best practices identified internally or from external sources. Knowledge and best practices start to be shared internally. Level 3 is considered Baseline Compliance meeting requirements in the State Records Act 1998, State Records Regulation 2024, or in the mandatory standards (Standard on records management, Standard on the physical storage of State records). |
| 4. Managed | The organisation has widely adopted the standard processes and begins monitoring them using defined metrics. |
| 5. Optimising | The organisation is optimising, refining and using innovation to increase efficiency within the organisation and, more widely, within its business sector. |
The RMAT seeks confirmation that an organisation has formally identified high risk/high value areas of the business and the records of these business operations. This area of recordkeeping should have the highest priority for investment and management.
Identifying and managing records of high risk/high value areas of business means that it is likely that appropriate controls have been implemented for the organisation’s most critical information. This approach to prioritising records of high risk/high value also matches up with the approaches taken by Cyber Security to protect the most critical information assets of the organisation.
In undertaking the RMAT assessment, your organisation will need an agreed list of high risk/high value activities or systems for the organisation or business unit being assessed. The organisation’s Information Asset Register can be used to document controls and strategies for high risk/high value records.
Get more information on identifying and managing high risk and high value records, information and data.
If the records and information management team does not have relevant documentation, check with colleagues in your ICT, security, governance, corporate, risk or legal teams to find out if this analysis has been carried out for another purpose. High risk/high value areas of business and systems may be identified during:
- cyber security attestation or information security planning
- business continuity and disaster recovery planning
- corporate risk management (risk registers and plans)
- responses to audits, inquiries or litigation
- systems audit or IT asset inventory
- information lifecycle management planning
- open data planning and reporting
- development of a retention and disposal authority.
Once you have an agreed list of criteria, it will be possible to identify records and information relating to those activities – and plan to manage them appropriately.
It will depend on the scope of the assessment (such as business unit, business system, whole of organisation) and the process you’ve decided to use (for example, whether one person completes the assessment, or a small team of information professionals from across the organisation, or the records and information management team with other key staff).
It may take a few hours or a few days to complete the assessment depending on the scope and process used.
Tip: Take some time before you start the assessment to read through the questions and responses to familiarise yourself with the content.
Tip: Allow an hour to factor in the evidence and additional guidance to make preliminary responses.
Tip: If doing the assessment as a team or in collaboration with others, allocate time for everyone to complete their assessments and then have a workshop to discuss individual responses to each question and settle on an overall score.
We suggest that large and complex organisations should consider undertaking individual assessments of divisions, lines of business, or groups of business units.
These assessments can then be brought together, and a consolidated view of the organisation’s records and information management is developed. Importantly, the consolidated view should be negotiated and agreed upon by those who have undertaken the assessments.
The individual assessments of divisions, lines of business, or business units will be useful in understanding the current state of recordkeeping within these areas of the organisation and will identify gaps or issues. This information can then be incorporated into the plans for corrective actions.
This will also enable the organisation to track progress over time and ensure that recordkeeping issues are managed.
If you have queries about the assessment process or the results, please feel free to contact us.
Email: govrec@staterecords.nsw.gov.au.
Even if you don’t have records that are 20 years old, we ask you to consider access arrangements. More information about making access directions is available from Museums of History NSW.
Please note that the maturity levels for question 19 in the RMAT have been amended to reflect the changes to the State Records Act (which came into effect on 1 January 2024) and the mandatory standards (that were issued on 14 February 2025).