Certified Records Manager (CRM) Exam — Questions and Answers

Question 1: What is a benefit of automating retention schedules?

Increases manual errors.
Enhances compliance and reduces oversight. (Correct answer)
Reduces data integrity.
Slows down audits.

Correct answer: Enhances compliance and reduces oversight.

Automating retention schedules streamlines the entire records lifecycle management process. It ensures that records are consistently retained for the correct periods and disposed of promptly when due, significantly enhancing compliance with legal and regulatory requirements. Automation reduces the need for manual tracking and human error, thereby minimizing oversight risks and improving efficiency.

Question 2: What does the term 'trustworthy digital repository' (TDR) refer to in records management?

Any cloud storage service with a financially guaranteed uptime SLA
Any records system certified for use by a government agency
A digital archive that reliably and sustainably provides long-term access to managed digital resources to its designated community (Correct answer)
A firewall-protected on-premise records server

Correct answer: A digital archive that reliably and sustainably provides long-term access to managed digital resources to its designated community

A trustworthy digital repository is a system that reliably and sustainably provides access to managed digital resources to a designated community, meeting established criteria for long-term preservation such as those in ISO 16363.

Question 3: What is conflict resolution in CRM leadership?

Ignoring problems
Addressing disagreements constructively to find acceptable solutions (Correct answer)
Making all decisions unilaterally
Avoiding all conflicts

Correct answer: Addressing disagreements constructively to find acceptable solutions

Conflict resolution addresses disagreements promptly using listening, empathy, and collaborative problem-solving.

Question 4: Which metadata element is MOST critical for enabling retrieval of records in a records management system?

Font type used in the document
Classification or subject descriptor (Correct answer)
Creator's email address
File size

Correct answer: Classification or subject descriptor

Classification or subject descriptor metadata is most critical because it enables users to locate and retrieve records based on their content and context.

Question 5: Which of the following best describes 'records appraisal'?

Evaluating the physical condition of aging paper records
Determining the monetary value of historical records
Assessing the value of records to determine retention periods and disposition (Correct answer)
Reviewing records for compliance with privacy regulations

Correct answer: Assessing the value of records to determine retention periods and disposition

Records appraisal is the process of determining how long records should be kept based on their administrative, legal, fiscal, and historical value.

Question 6: What role does feedback play in CRM professional development?

Given only during annual reviews
Identifying strengths and improvement areas to guide growth (Correct answer)
Only from supervisors
Only useful when positive

Correct answer: Identifying strengths and improvement areas to guide growth

Constructive feedback identifies strengths and development areas, providing actionable information for professional growth.

Question 7: In records management, what does 'format migration' address?

Converting records from obsolete file formats to current ones to ensure long-term accessibility (Correct answer)
Reclassifying records under a new file plan structure
Moving physical records from one storage facility to another
Transferring records from paper to microfilm

Correct answer: Converting records from obsolete file formats to current ones to ensure long-term accessibility

Format migration converts electronic records from outdated or obsolete formats to current ones to prevent data loss due to technological obsolescence.

Question 8: A records retention schedule primarily serves what purpose?

To document who created each record
To define how long records must be kept and when they should be disposed of (Correct answer)
To classify records by their security level
To identify the physical location of all records

Correct answer: To define how long records must be kept and when they should be disposed of

A retention schedule specifies mandatory retention periods for each records series and authorizes their disposition after those periods expire.

Question 9: What is cash flow management in CRM practice?

Only tracking income
Investing everything in stocks
Optimizing the timing of money coming in and going out (Correct answer)
Managing coins and currency

Correct answer: Optimizing the timing of money coming in and going out

Cash flow management tracks and optimizes the timing of inflows and outflows to ensure sufficient funds.

Question 10: Which disposition method involves permanently removing records from active use by either destruction or transfer to an archives?

Appraisal
Migration
Final disposition (Correct answer)
Conversion

Correct answer: Final disposition

Final disposition is the action taken at the end of a record's retention period, either destroying it or transferring it to permanent archives.

Question 11: Which concept describes the legally recognized principle that organizations must not destroy records once they are aware that litigation or investigation is reasonably anticipated?

Appraisal
Cutoff
Accession
Spoliation (Correct answer)

Correct answer: Spoliation

Spoliation refers to the destruction or alteration of evidence once litigation is reasonably anticipated; it can result in severe legal sanctions including adverse inference instructions.

Question 12: What is the purpose of a 'records inventory'?

To classify records under Freedom of Information exemptions
To identify and document all records held by an organization (Correct answer)
To assign retention periods without reviewing content
To rank records by their monetary value

Correct answer: To identify and document all records held by an organization

A records inventory systematically identifies, describes, and locates all records within an organization, forming the foundation for developing a retention schedule.

Question 13: A company receives a litigation hold notice after its general retention schedule calls for destroying certain emails next week. What is the correct action?

Suspend destruction of all potentially relevant records immediately (Correct answer)
Request a court order before suspending destruction
Destroy only the emails unrelated to the litigation
Proceed with destruction because the schedule predates the notice

Correct answer: Suspend destruction of all potentially relevant records immediately

A litigation hold supersedes any existing retention schedule, requiring immediate suspension of destruction for potentially relevant records.

Question 14: What is the triple constraint in CRM project management?

Three required team members
Three mandatory approvals
The interdependent relationship between scope, time, and cost (Correct answer)
Three completion phases

Correct answer: The interdependent relationship between scope, time, and cost

Scope, time, and cost are interdependent: changing one affects the others. Managers must balance all three.

Question 15: What type of records might be exempt from destruction?

Records under legal hold or with historical significance. (Correct answer)
Duplicates of memos.
Draft documents.
Unopened emails.

Correct answer: Records under legal hold or with historical significance.

While most records are eventually disposed of, certain types are exempt from routine destruction. Records subject to a legal hold must be preserved indefinitely until the hold is lifted, regardless of their standard retention period, to prevent spoliation of evidence. Additionally, records deemed to have historical, archival, or enduring business significance are often permanently retained.

Question 16: Which standard provides guidance on metadata for records management systems?

ANSI/AIIM MS50
ISO 23081 (Correct answer)
ISO 27001
ISO 15489

Correct answer: ISO 23081

ISO 23081 provides guidance specifically on metadata for records management, complementing the broader records management framework in ISO 15489.

Question 17: What does 'version control' in a records management system prevent?

Records from being printed without authorization
Confusion caused by multiple versions of the same document by tracking and managing revisions systematically (Correct answer)
Automatic deletion of records past their retention date
Users from accessing records after business hours

Correct answer: Confusion caused by multiple versions of the same document by tracking and managing revisions systematically

Version control prevents confusion by tracking and managing document revisions systematically, ensuring users access the correct and current version.

Question 18: Which approach BEST supports long-term digital preservation of records?

Storing records on the fastest available storage media only
Keeping records in proprietary software formats to maintain quality
Printing all digital records to paper as the primary copy
Converting records to open, non-proprietary formats and regularly migrating them (Correct answer)

Correct answer: Converting records to open, non-proprietary formats and regularly migrating them

Converting records to open, non-proprietary formats and regularly migrating them supports long-term digital preservation by reducing format obsolescence risk.

Question 19: What are consequences of non-compliance in CRM practice?

A verbal warning only
Automatic renewal
Fines, license revocation, legal liability, and reputation damage (Correct answer)
No consequences if not caught

Correct answer: Fines, license revocation, legal liability, and reputation damage

Non-compliance can result in fines, license issues, legal liability, and lasting reputational damage.

Question 20: Under the GDPR, a data subject's 'right to erasure' is also known as the:

Right to access
Right to rectification
Right to be forgotten (Correct answer)
Right to portability

Correct answer: Right to be forgotten

The GDPR's right to erasure (Article 17) is commonly called the 'right to be forgotten,' allowing individuals to request deletion of their personal data.

Question 21: Why is authorized approval required before destroying records?

To keep employees busy.
To ensure proper documentation and legality. (Correct answer)
To confuse auditors.
To make room on desks.

Correct answer: To ensure proper documentation and legality.

Requiring authorized approval before destroying records ensures that the disposition process is compliant with legal, regulatory, and organizational policies. This step verifies that the records have met their full retention period, are not subject to any legal holds, and that their destruction is properly documented. It provides an audit trail and prevents the premature or unauthorized destruction of valuable information.

Question 22: In the context of records security, 'chain of custody' refers to:

The hierarchy of employees authorized to approve records destruction
A process for encrypting records during transit
The documented history of who has accessed, transferred, or handled a record (Correct answer)
The legal retention period for evidence records

Correct answer: The documented history of who has accessed, transferred, or handled a record

Chain of custody tracks every person who has accessed or handled a record, ensuring its integrity and admissibility as evidence.

Question 23: Which of the following is NOT a primary value category used in records appraisal?

Legal value
Administrative value
Fiscal value
Aesthetic value (Correct answer)

Correct answer: Aesthetic value

The four primary values used in records appraisal are administrative, fiscal, legal, and historical/archival value; aesthetic value is not a recognized appraisal category.

Question 24: What is budget variance analysis in CRM financial management?

Creating next year's budget
Counting cash
Reviewing expense reports
Comparing actual spending against budgeted amounts to explain differences (Correct answer)

Correct answer: Comparing actual spending against budgeted amounts to explain differences

Variance analysis compares actual results against budget, calculating differences and investigating causes.

Question 25: What is 'media migration' and why is it relevant to records retention?

Encrypting electronic records for secure archival storage
Moving physical records to off-site storage facilities
Scanning paper records and immediately destroying the originals
Converting records to new formats or storage media to ensure long-term accessibility (Correct answer)

Correct answer: Converting records to new formats or storage media to ensure long-term accessibility

Media migration converts records to current formats or storage technology to prevent obsolescence, ensuring records remain accessible throughout their full retention period.

Question 26: What are 'emergency operating records' in a vital records program?

Records needed to continue or resume essential operations immediately following a disaster (Correct answer)
Records required for annual regulatory audits
Records documenting past emergency incidents and their outcomes
Personnel files for designated emergency response staff

Correct answer: Records needed to continue or resume essential operations immediately following a disaster

Emergency operating records include those needed to immediately resume essential business functions after a disaster, such as contact lists, system documentation, and operational procedures.

Question 27: When selecting a records management software system, which factor is MOST important from a records management perspective?

Compliance with recognized records management standards such as DoD 5015.2 or ISO 16175 (Correct answer)
Lowest upfront licensing cost
Compatibility with the CEO's personal device
Attractive user interface design

Correct answer: Compliance with recognized records management standards such as DoD 5015.2 or ISO 16175

Compliance with recognized standards like DoD 5015.2 or ISO 16175 is most important because it ensures the system meets functional requirements for managing records properly.

Question 28: What is 'off-site storage' in the context of vital records protection?

Keeping records in a locked safe within the primary facility
Storing copies of vital records at a geographically separate location to protect against site-specific disasters (Correct answer)
Storing records in a different department within the same building
Archiving records exclusively in a cloud-based system

Correct answer: Storing copies of vital records at a geographically separate location to protect against site-specific disasters

Off-site storage places copies of vital records at a geographically separate facility, protecting them from disasters that could destroy the primary location.

Question 29: What is a 'Recovery Point Objective' (RPO) in disaster recovery planning?

The number of backup copies required for all vital records
The priority ranking assigned to records for recovery sequencing
The geographic location designated as the primary records recovery site
The maximum age of the most recent backup from which data can be recovered after a disaster (Correct answer)

Correct answer: The maximum age of the most recent backup from which data can be recovered after a disaster

RPO defines the maximum acceptable data loss measured in time, determining how frequently backups must be made to meet recovery requirements.

Question 30: What is the hierarchy of controls in CRM risk management?

Assessment, planning, implementation
Elimination, substitution, engineering, administrative, then PPE (Correct answer)
PPE first, then administrative
Insurance, training, documentation

Correct answer: Elimination, substitution, engineering, administrative, then PPE

The hierarchy prioritizes the most effective controls first, from eliminating the hazard to using PPE as last resort.

Question 31: Which US law specifically requires federal agencies to obtain NARA approval before destroying federal records?

Federal Records Act (FRA) (Correct answer)
Privacy Act of 1974
E-Government Act of 2002
Freedom of Information Act (FOIA)

Correct answer: Federal Records Act (FRA)

The Federal Records Act requires federal agencies to obtain disposition authority from the National Archives and Records Administration (NARA) before destroying federal records.

Question 32: Which of the following describes 'deaccession' in archival records management?

The removal of records from an archival collection for transfer or destruction (Correct answer)
The digitization of physical archival records
The cataloging of newly acquired archival materials
The formal intake of new records into an archival repository

Correct answer: The removal of records from an archival collection for transfer or destruction

Deaccession is the formal process of removing records from an archival collection, which may result in transfer to another institution or authorized destruction.

Question 33: Who is responsible for compliance with records policies?

Only IT staff.
Everyone in the organization. (Correct answer)
Just the records manager.
External vendors.

Correct answer: Everyone in the organization.

While a records manager or specific department may oversee the records management program, compliance with records policies is a shared responsibility across the entire organization. Every employee who creates, receives, uses, or disposes of records must adhere to established policies and procedures. This collective responsibility ensures the integrity, security, and legal compliance of all organizational information.

Question 34: Which characteristic distinguishes an official electronic record from a non-record copy?

File size larger than 1 megabyte
Storage on a network drive rather than a local drive
Created using organization-approved software only
Created or received in the transaction of official business and retained for its evidential or informational value (Correct answer)

Correct answer: Created or received in the transaction of official business and retained for its evidential or informational value

An official record is distinguished by being created or received in the conduct of official business and retained because of the evidence it provides of activities or the information it contains.

Question 35: What does 'format obsolescence' pose as a risk to digital records?

Increased storage costs over time
Records becoming inaccessible because software to read the format no longer exists (Correct answer)
Unauthorized access by external parties
Physical deterioration of storage media

Correct answer: Records becoming inaccessible because software to read the format no longer exists

Format obsolescence occurs when software to read a digital format no longer exists, making records inaccessible despite being physically intact.

Question 36: What is the primary purpose of a 'records inventory' in relation to systems management?

To document the names of all records management staff
To list all software licenses used by the records management department
To identify all records held, their format, location, and volume as a foundation for system design (Correct answer)
To count the number of computer workstations in the organization

Correct answer: To identify all records held, their format, location, and volume as a foundation for system design

A records inventory identifies all records held, their format, location, and volume, providing the foundation for designing or migrating to a records management system.

Question 37: What is 'migration' as a digital preservation strategy in electronic records management?

Deleting records that have exceeded their retention period
Converting paper records to electronic format for the first time
Moving physical records between storage facilities
Transferring records from one technology to another to ensure continued access (Correct answer)

Correct answer: Transferring records from one technology to another to ensure continued access

Migration involves transferring electronic records from one technology platform or file format to another to ensure they remain accessible as the original technology becomes obsolete.

Question 38: Which protection method provides the highest level of safeguard for vital records against physical disaster?

Maintaining duplicate copies at a geographically remote off-site location (Correct answer)
Encrypting all digital records with strong encryption
Storing records in fireproof cabinets located on-site
Using acid-free archival storage materials for paper records

Correct answer: Maintaining duplicate copies at a geographically remote off-site location

Geographically remote off-site duplication protects vital records from site-specific disasters—fires, floods, earthquakes—that could destroy on-site storage entirely.

Question 39: Which security control is specifically designed to detect unauthorized changes to records?

Firewall rules
Data loss prevention (DLP) software
Role-based access control (RBAC)
Audit trails and hash verification (Correct answer)

Correct answer: Audit trails and hash verification

Audit trails log all access and modifications, while cryptographic hashing can detect if a record's content has been altered.

Question 40: Why is written communication important in CRM practice?

Eliminated by technology
Only for legal disputes
Less effective than verbal always
It creates permanent records and ensures clarity for future reference (Correct answer)

Correct answer: It creates permanent records and ensures clarity for future reference

Written communication creates documented records, provides clarity, and serves as reference material for decisions and actions.

Question 41: How are 'vital records' defined in records management?

Records essential to resume or continue operations, protect legal rights, or fulfill obligations during or after a disaster (Correct answer)
Any record classified as confidential or sensitive
All records created by senior management
Records older than 25 years that require permanent preservation

Correct answer: Records essential to resume or continue operations, protect legal rights, or fulfill obligations during or after a disaster

Vital records are those essential for an organization to resume operations, protect rights, and meet legal obligations following a disaster or emergency.

Question 42: Which standard provides internationally recognized guidance on records management processes, including retention scheduling and disposition?

ISO 9001
ISO 14001
ISO 27001
ISO 15489 (Correct answer)

Correct answer: ISO 15489

ISO 15489 is the international standard specifically addressing records management, covering principles and requirements for retention, disposition, and the overall records lifecycle.

Question 43: The Sarbanes-Oxley Act (SOX) Section 802 primarily affects records management by doing which of the following?

Requiring all financial records to be stored in the cloud
Requiring 7-year retention for all employee personnel records
Making it a federal crime to alter, destroy, or falsify records related to federal investigations (Correct answer)
Mandating annual records audits for all public companies

Correct answer: Making it a federal crime to alter, destroy, or falsify records related to federal investigations

SOX Section 802 criminalizes the destruction, alteration, or falsification of records in federal investigations and bankruptcy proceedings.

Question 44: Which retention trigger is based on the date an action or event occurs rather than the date a record was created?

Creation date trigger
Fiscal year trigger
Cutoff trigger
Event-based trigger (Correct answer)

Correct answer: Event-based trigger

An event-based trigger starts the retention clock when a specific event happens, such as contract expiration or employee termination.

Question 45: What is a record retention schedule?

An event planning document.
A timeline for keeping and disposing of records. (Correct answer)
A calendar of pay periods.
A list of meeting times.

Correct answer: A timeline for keeping and disposing of records.

A record retention schedule is a systematic plan that specifies how long different types of records must be kept and when they can be legally and safely disposed of. It is a critical tool for managing the lifecycle of information, ensuring compliance with legal and regulatory requirements, and optimizing storage resources. This schedule dictates the minimum and maximum retention periods.

Question 46: Which ARMA International principle addresses the requirement that records be accessible and usable when needed, including during and after a disaster?

The Integrity Principle
The Retention Principle
The Compliance Principle
The Availability Principle (Correct answer)

Correct answer: The Availability Principle

ARMA's Availability Principle within the Generally Accepted Recordkeeping Principles (GARP) requires that records be accessible and usable when needed, which encompasses vital records protection.

Question 47: How frequently should an organization review and update its vital records inventory?

Only when a disaster occurs
Once every five years as part of a full records audit
Whenever a new employee joins the records management team
At least annually, or whenever significant changes occur to business functions or systems (Correct answer)

Correct answer: At least annually, or whenever significant changes occur to business functions or systems

Vital records inventories should be reviewed at least annually or when business functions change to ensure the inventory remains accurate and current.

Question 48: What is the role of a records manager in an organization's disaster recovery plan?

To identify vital records, oversee their protection, and coordinate records recovery following a disaster (Correct answer)
To select and purchase disaster recovery insurance policies
To train all employees in emergency evacuation and safety procedures
To manage financial recovery and insurance claims after a disaster

Correct answer: To identify vital records, oversee their protection, and coordinate records recovery following a disaster

Records managers identify vital records, ensure protection strategies are in place, and lead records recovery efforts as part of the broader disaster recovery plan.

Question 49: What is the purpose of an audit trail in an electronic records management system?

To track all actions performed on a record, such as creation, access, modification, and deletion (Correct answer)
To assign retention periods automatically
To reduce storage costs
To convert analog records to digital format

Correct answer: To track all actions performed on a record, such as creation, access, modification, and deletion

An audit trail tracks all actions performed on a record, providing accountability and enabling investigation of unauthorized access or changes.

Question 50: The 'appraisal' process in records management is primarily used to determine:

Which records have sufficient value to warrant permanent preservation (Correct answer)
The physical condition of aging paper records
The cost of off-site storage contracts
The monetary value of archival records

Correct answer: Which records have sufficient value to warrant permanent preservation

Appraisal evaluates the long-term value of records—administrative, legal, fiscal, or historical—to determine which warrant permanent archival preservation.

Question 51: Why is multi-factor authentication important?

It eliminates passwords completely.
It enhances account protection with multiple verification methods. (Correct answer)
It increases login errors.
It slows down users.

Correct answer: It enhances account protection with multiple verification methods.

Multi-factor authentication (MFA) significantly enhances security by requiring users to provide two or more verification factors to gain access to an account or system. These factors typically include something the user knows (like a password), something the user has (like a phone or token), and something the user is (like a fingerprint). This layered approach makes it much harder for unauthorized individuals to compromise accounts, even if they steal a password.

Question 52: What is the role of a 'taxonomy' in a records management system?

To encrypt sensitive records during transmission
To automate the destruction of expired records
To provide a hierarchical structure for organizing and classifying records consistently (Correct answer)
To measure system performance metrics

Correct answer: To provide a hierarchical structure for organizing and classifying records consistently

A taxonomy provides a hierarchical structure for organizing and classifying records consistently, enabling systematic retrieval and management.

Question 53: What is the first step in establishing a vital records protection program?

Purchasing or contracting for off-site storage facilities
Installing fireproof storage cabinets throughout the facility
Training all employees in emergency response procedures
Conducting an inventory and risk assessment to identify which records are vital and the threats they face (Correct answer)

Correct answer: Conducting an inventory and risk assessment to identify which records are vital and the threats they face

Identifying vital records through inventory and assessing risks is the foundational step, as you must know what to protect and from what threats before implementing protection measures.

Question 54: What is the primary purpose of conducting regular tests of a vital records program?

To verify that protection measures work, recovery procedures are effective, and that the vital records inventory remains accurate (Correct answer)
To generate documentation that justifies the budget for off-site storage
To provide hands-on training for newly hired records management staff
To satisfy annual regulatory audit requirements only

Correct answer: To verify that protection measures work, recovery procedures are effective, and that the vital records inventory remains accurate

Regular testing confirms that vital records can actually be retrieved and used when needed and reveals any gaps in protection or recovery procedures.

Question 55: In an electronic records environment, what does 'disposition' typically involve?

Backing up records to a secondary server
Executing the final action on a record per its retention schedule, such as deletion or transfer to archives (Correct answer)
Scanning paper records into digital format
Assigning security classification levels to records

Correct answer: Executing the final action on a record per its retention schedule, such as deletion or transfer to archives

Disposition involves executing the final action on a record per its retention schedule, which may include deletion, destruction, or transfer to archival storage.

Question 56: What is a Records Management Application (RMA)?

Software that manages the full lifecycle of records according to defined organizational policies (Correct answer)
A database used exclusively for storing employee contact information
A mobile app for photographing physical records
An application for designing record templates and forms

Correct answer: Software that manages the full lifecycle of records according to defined organizational policies

An RMA is specialized software designed to manage records according to organizational policies, including retention scheduling, disposition, and access controls throughout the records lifecycle.

Question 57: Which regulation requires financial institutions to protect the privacy of consumers' nonpublic personal information (NPI)?

FERPA
HIPAA
GLBA (Gramm-Leach-Bliley Act) (Correct answer)
CCPA

Correct answer: GLBA (Gramm-Leach-Bliley Act)

The GLBA mandates that financial institutions safeguard the nonpublic personal information of their customers.

Question 58: What is FERPA concerned with?

Banking transactions.
Employee taxes.
Student academic records. (Correct answer)
Food safety reports.

Correct answer: Student academic records.

FERPA, the Family Educational Rights and Privacy Act, is a U.S. federal law that protects the privacy of student education records. It grants parents and eligible students certain rights with respect to these records, including the right to inspect and review them and to request corrections. Educational institutions must comply with FERPA regarding the disclosure of student information.

Question 59: Which federal law primarily governs the management of records created by U.S. federal agencies?

Paperwork Reduction Act
Privacy Act of 1974
Federal Records Act (FRA) (Correct answer)
Freedom of Information Act (FOIA)

Correct answer: Federal Records Act (FRA)

The Federal Records Act establishes requirements for creating, managing, and disposing of records generated by U.S. federal executive branch agencies.

Question 60: In the OAIS model, what is a 'Submission Information Package' (SIP)?

An encrypted package of highly sensitive records
A management report summarizing current records status
A compressed backup package sent to external auditors
The information package delivered by the producer to the archive for ingest and preservation (Correct answer)

Correct answer: The information package delivered by the producer to the archive for ingest and preservation

In the OAIS model, a Submission Information Package (SIP) is the information package delivered by the producer (record creator) to the archive for ingest and long-term preservation.

Question 61: Which file format is most widely recommended for the long-term preservation of text-based electronic records?

PDF/A (Correct answer)
RTF
HTML
DOCX

Correct answer: PDF/A

PDF/A (PDF for Archiving) is an ISO-standardized version of PDF (ISO 19005) specifically designed for long-term preservation of electronic documents.

Question 62: What is the risk of applying a 'keep everything forever' records management approach?

Increased storage costs and expanded litigation discovery exposure (Correct answer)
Faster obsolescence of record formats
Records become too organized and findable
Reduced compliance with federal retention minimums

Correct answer: Increased storage costs and expanded litigation discovery exposure

Retaining all records indefinitely inflates storage costs and creates broader e-discovery obligations, as all retained records are potentially discoverable in litigation.

Question 63: What is the main goal of records management?

To avoid audits.
To organize, maintain, and dispose of records properly. (Correct answer)
To ensure record destruction only.
To maximize paper use.

Correct answer: To organize, maintain, and dispose of records properly.

The main goal of records management is to ensure that an organization's information assets are systematically controlled throughout their entire lifecycle. This involves organizing records for easy retrieval, maintaining their integrity and accessibility, and disposing of them securely and compliantly when their retention period ends. This comprehensive approach supports operational efficiency, legal compliance, and historical preservation.

Question 64: What is a dashboard in CRM reporting?

A written monthly report
A visual display of key metrics for at-a-glance performance monitoring (Correct answer)
An IT-only tool
A physical control panel

Correct answer: A visual display of key metrics for at-a-glance performance monitoring

A dashboard consolidates important metrics and trends visually for quick assessment of performance status.

Question 65: When records are transferred to a third-party vendor for storage or processing, which document BEST protects the organization's privacy obligations?

An internal retention schedule
A data processing agreement (DPA) specifying security and privacy requirements (Correct answer)
A service level agreement (SLA) for uptime
A records destruction certificate

Correct answer: A data processing agreement (DPA) specifying security and privacy requirements

A DPA contractually obligates third-party vendors to uphold the organization's data protection standards when handling personal information.

Question 66: What is the purpose of legal compliance in records management?

To avoid digitization.
To reduce staffing needs.
To comply with legal and regulatory obligations. (Correct answer)
To store all documents indefinitely.

Correct answer: To comply with legal and regulatory obligations.

Legal compliance in records management is fundamentally about adhering to the laws, regulations, and industry standards that govern how an organization creates, maintains, and disposes of its records. This ensures the organization avoids penalties, legal disputes, and reputational damage by meeting its statutory duties. It's not about indefinite storage or avoiding digitization, but rather about systematic adherence to legal frameworks.

Question 67: A Certified Records Manager discovers that legacy paper records containing SSNs were improperly disposed of in a recycling bin. The MOST immediate response should be:

Shred the records and file an internal report next quarter
Update the retention schedule
Retrieve the records and initiate the organization's incident response process (Correct answer)
Transfer all physical records to a secure offsite facility

Correct answer: Retrieve the records and initiate the organization's incident response process

Improper disposal of records with SSNs constitutes a potential data breach, requiring immediate retrieval and activation of the incident response plan.

Question 68: What is emotional intelligence in CRM leadership?

Recognizing and managing one's own emotions and those of others (Correct answer)
High IQ scores
Being emotional always
Avoiding emotions entirely

Correct answer: Recognizing and managing one's own emotions and those of others

Emotional intelligence includes self-awareness, self-regulation, motivation, empathy, and social skills for effective leadership.

Question 69: What is the primary purpose of a vital records protection program?

To ensure critical records are protected and accessible to maintain operations during and after a disaster (Correct answer)
To comply with copyright and intellectual property laws
To reduce storage costs for all organizational records
To standardize the format of all organizational records

Correct answer: To ensure critical records are protected and accessible to maintain operations during and after a disaster

A vital records protection program ensures that records essential for business continuity, legal rights, and obligations are protected and recoverable in a disaster.

Question 70: Under California's CCPA, which of the following rights is granted to California consumers regarding their personal information?

The right to approve all marketing uses of their data in advance
The right to know what personal data is collected and to opt out of its sale (Correct answer)
The right to demand a paper copy of all records
The right to unlimited data portability at no cost

Correct answer: The right to know what personal data is collected and to opt out of its sale

The CCPA gives California consumers the right to know what personal information is collected, the right to delete it, and the right to opt out of its sale.

Question 71: What is a 'hybrid records environment'?

A network that connects two separate office buildings
An environment where both physical paper records and electronic records coexist and must be managed together (Correct answer)
A system that uses two different brands of servers
A records program managed by two different departments jointly

Correct answer: An environment where both physical paper records and electronic records coexist and must be managed together

A hybrid records environment is one where both physical paper records and electronic records coexist and must be managed together under a unified program.

Question 72: What is 'least privilege' in access control?

Allowing full access to all users.
Revoking admin rights for IT staff.
Giving access based on age.
Limiting access to only necessary data. (Correct answer)

Correct answer: Limiting access to only necessary data.

The principle of 'least privilege' in access control dictates that users, programs, or processes should be granted only the minimum level of access permissions necessary to perform their specific tasks. This minimizes the potential damage from accidental errors, misuse, or malicious activity, as it restricts what an unauthorized individual or compromised account can access or alter.

Question 73: What is a 'Recovery Time Objective' (RTO) in business continuity planning?

The time required to complete the annual vital records review
The maximum amount of data loss an organization can tolerate measured in time
The maximum acceptable time to restore a business function after a disruption (Correct answer)
The scheduled date for the next disaster recovery drill or test

Correct answer: The maximum acceptable time to restore a business function after a disruption

RTO defines the maximum tolerable downtime before a business function must be restored, guiding recovery planning and resource allocation.

Question 74: What does data integrity mean in CRM practice?

Data processing speed
Physical security of hardware
Accuracy, consistency, and reliability of data throughout its lifecycle (Correct answer)
Visualization quality

Correct answer: Accuracy, consistency, and reliability of data throughout its lifecycle

Data integrity means maintaining accuracy, consistency, and reliability from collection through use.

Question 75: How does records management support a 'business continuity plan' (BCP)?

By creating financial plans for operating during economic downturns
By developing marketing strategies for business growth after a disaster
By creating succession plans for leadership transitions during emergencies
By ensuring vital records are identified, protected, and accessible so essential functions can be maintained during disruptions (Correct answer)

Correct answer: By ensuring vital records are identified, protected, and accessible so essential functions can be maintained during disruptions

Records management supports the BCP by ensuring vital records are protected and accessible, providing the information foundation needed to maintain essential operations during disruptions.

Question 76: Which ARMA International principle addresses the need for an organization to maintain complete and accurate records?

Availability
Integrity (Correct answer)
Retention
Disposition

Correct answer: Integrity

The Integrity principle in GARP® ensures records are complete, accurate, and protected from unauthorized modification throughout their lifecycle.

Question 77: What differentiates fixed from variable costs in CRM?

No difference
Fixed are always higher
Variable are optional
Fixed costs stay constant; variable costs change with volume (Correct answer)

Correct answer: Fixed costs stay constant; variable costs change with volume

Fixed costs (rent, salaries) remain constant; variable costs (materials, commissions) fluctuate with activity volume.

Question 78: A records manager receives a legal hold notice. What action regarding information security should be taken IMMEDIATELY?

Apply the standard retention schedule and document the decision
Encrypt all organizational records enterprise-wide
Transfer all records to legal counsel's office
Suspend normal disposition and ensure all potentially relevant records are preserved and protected from alteration (Correct answer)

Correct answer: Suspend normal disposition and ensure all potentially relevant records are preserved and protected from alteration

A legal hold supersedes normal retention schedules, requiring immediate preservation and protection of relevant records from any deletion or modification.

Question 79: Which category of vital records primarily protects the rights and interests of employees and individuals?

Emergency operating records
Regulatory compliance records
Historical records
Rights and interests records (Correct answer)

Correct answer: Rights and interests records

Rights and interests records—such as payroll, pension, and benefits records—protect employee entitlements and legal rights.

Question 80: A records manager is developing a security policy for email records containing PII. The FIRST step should be to:

Immediately encrypt all email archives
Delete emails older than one year
Identify and classify the PII contained in email records (Correct answer)
Migrate all email records to cloud storage

Correct answer: Identify and classify the PII contained in email records

Before applying controls, the manager must identify and classify what PII exists in email records to determine the appropriate protection level.

Question 81: What is the primary function of an audit trail in electronic records management?

To automatically flag records for disposition
To provide a chronological log of all system activities, accesses, and modifications (Correct answer)
To reduce electronic storage costs
To speed up record retrieval times

Correct answer: To provide a chronological log of all system activities, accesses, and modifications

An audit trail provides a chronological log of all activities, accesses, and changes made to electronic records, supporting accountability and legal admissibility.

Question 82: What role does HIPAA play in records compliance?

Protects patient health information. (Correct answer)
Controls banking disclosures.
Restricts military records.
Regulates tax records.

Correct answer: Protects patient health information.

HIPAA, the Health Insurance Portability and Accountability Act, is a U.S. federal law that establishes national standards to protect sensitive patient health information. It governs how healthcare providers, health plans, and healthcare clearinghouses handle and secure Protected Health Information (PHI). Compliance with HIPAA is crucial for organizations dealing with medical records to avoid significant penalties.

Question 83: What is effective delegation in CRM management?

Giving unpleasant tasks to newcomers
Doing everything yourself
Passing off all responsibility
Assigning authority and tasks while maintaining accountability (Correct answer)

Correct answer: Assigning authority and tasks while maintaining accountability

Delegation assigns tasks and authority based on skills while the leader maintains ultimate accountability.

Question 84: Which records management function involves evaluating records to ensure they meet organizational and regulatory requirements?

Migration
Compliance auditing (Correct answer)
Indexing
Disposition

Correct answer: Compliance auditing

Compliance auditing reviews records management practices to verify adherence to legal, regulatory, and organizational policies.

Question 85: What is 'vital records dispersal' as a protection strategy?

Distributing records among multiple internal departments
Sending records to different storage vendors for competitive pricing
Distributing access rights to vital records among multiple system administrators
Spreading copies of vital records across multiple geographically separate locations to reduce the risk of total loss (Correct answer)

Correct answer: Spreading copies of vital records across multiple geographically separate locations to reduce the risk of total loss

Vital records dispersal reduces the risk of total loss by maintaining copies at multiple locations, ensuring at least one copy survives any single disaster.

Question 86: Which of the following BEST describes the concept of 'least privilege' in records security?

Users receive access only to the information they need to perform their job functions (Correct answer)
Senior managers have unrestricted access to all records
Access rights are granted based on seniority alone
All employees share equal access to organizational records

Correct answer: Users receive access only to the information they need to perform their job functions

Least privilege limits user access rights to only what is necessary for their specific role, minimizing unauthorized exposure.

Question 87: What is the purpose of 'redaction' in records management?

To apply a retention hold to a record
To permanently delete a record from all systems
To remove or obscure sensitive information before releasing a record (Correct answer)
To convert paper records into digital format

Correct answer: To remove or obscure sensitive information before releasing a record

Redaction removes or blacks out sensitive portions of a document before it is shared or released, protecting private or privileged information.

Question 88: A records retention schedule assigns a 6-year retention period to accounts payable invoices with a calendar-year cutoff. If the last invoice in a file is dated March 2020, when can the file be destroyed?

January 1, 2027
December 31, 2026 (Correct answer)
March 2026
December 31, 2025

Correct answer: December 31, 2026

With a calendar-year cutoff, the retention clock starts at year-end (December 31, 2020), and 6 years later the file is eligible for destruction after December 31, 2026.

Question 89: Which of the following is an example of 'data minimization' in records management?

Storing personal data in multiple backup locations
Sharing personal data with all business units by default
Collecting only the personal data necessary for a specified purpose (Correct answer)
Collecting all available customer data for potential future use

Correct answer: Collecting only the personal data necessary for a specified purpose

Data minimization means collecting only the personal data actually needed for a defined purpose, reducing privacy risk.

Question 90: What is the critical path in CRM project scheduling?

The shortest route to complete cheaply
The most expensive phase
The longest sequence of dependent tasks determining minimum duration (Correct answer)
Tasks that can be skipped

Correct answer: The longest sequence of dependent tasks determining minimum duration

The critical path identifies the longest chain of dependent tasks; delays on these directly delay project completion.

Question 91: What is the benefit of classifying records?

To delete old records faster.
To automate backups.
To confuse unauthorized users.
To organize records systematically for easy access. (Correct answer)

Correct answer: To organize records systematically for easy access.

Classifying records involves categorizing them based on their function, content, or importance. This systematic organization is highly beneficial as it allows for efficient storage, retrieval, and management of information. Proper classification ensures that records can be easily located when needed, supports the application of correct retention schedules, and helps maintain the integrity and security of the organization's data.

Question 92: What is the difference between a 'hot site' and a 'cold site' in disaster recovery?

A hot site is in a warm climate; a cold site is in a cold climate
A hot site is on-site backup; a cold site is an off-site backup
A hot site is fully equipped and immediately operational; a cold site provides only basic infrastructure requiring significant setup time (Correct answer)
A hot site stores physical records; a cold site stores only digital records

Correct answer: A hot site is fully equipped and immediately operational; a cold site provides only basic infrastructure requiring significant setup time

A hot site is fully configured and ready for immediate use, while a cold site provides only physical space and basic utilities requiring significant setup before operations can resume.

Question 93: How can organizations ensure legal compliance?

Only follow local policies.
Ignore outdated laws.
Develop clear policies and provide training. (Correct answer)
Wait for violations to occur.

Correct answer: Develop clear policies and provide training.

Ensuring legal compliance requires a proactive and systematic approach within an organization. Developing clear, comprehensive policies and procedures for records management establishes the framework for compliant behavior. Regular training for all employees is crucial to ensure they understand these policies and their individual responsibilities in adhering to legal and regulatory requirements.

Question 94: Under the Generally Accepted Recordkeeping Principles® (GARP®), which principle emphasizes that records must be complete and unaltered?

Compliance
Availability
Integrity (Correct answer)
Protection

Correct answer: Integrity

The Integrity principle under GARP® requires that records be complete, accurate, and protected against unauthorized alteration.

Question 95: Why is regular review important in CRM risk management?

Assessments stay valid forever
Conditions change and new risks emerge requiring updates (Correct answer)
Prohibited more than annually
Only needed after incidents

Correct answer: Conditions change and new risks emerge requiring updates

Regular reviews ensure assessments remain current as conditions change and lessons from incidents are incorporated.

Question 96: How does a 'warm site' differ from both hot and cold sites in disaster recovery?

A warm site stores only paper records while hot and cold sites store digital records
A warm site is shared with other organizations while hot and cold sites are dedicated facilities
A warm site is partially equipped with hardware and communications, requiring less setup time than a cold site but not immediately operational like a hot site (Correct answer)
A warm site is always located in a temperate climate zone

Correct answer: A warm site is partially equipped with hardware and communications, requiring less setup time than a cold site but not immediately operational like a hot site

A warm site provides a middle ground—partial infrastructure reduces recovery time compared to a cold site, but at lower cost than a fully operational hot site.

Question 97: What does residual risk mean in CRM practice?

Budget overrun risk
Risk affecting waste materials
Initial risk before assessment
Risk remaining after all controls are implemented (Correct answer)

Correct answer: Risk remaining after all controls are implemented

Residual risk is the level remaining after practical controls are applied. Some is usually accepted as eliminating all risk is rarely feasible.

Question 98: Which law governs access to public records in the U.S.?

FOIA (Correct answer)
HIPAA
FERPA
GDPR

Correct answer: FOIA

The Freedom of Information Act (FOIA) is a federal law that grants the public the right to request access to records from any federal agency. It promotes transparency by requiring government agencies to disclose information unless it falls under specific exemptions. HIPAA protects health information, FERPA protects educational records, and GDPR is a European data protection law.

Question 99: Which type of attack involves an attacker intercepting communication between two parties to steal or alter records in transit?

Phishing attack
Denial-of-service attack
SQL injection
Man-in-the-middle (MITM) attack (Correct answer)

Correct answer: Man-in-the-middle (MITM) attack

A MITM attack positions the attacker between sender and receiver, enabling interception or manipulation of data in transit.

Question 100: Why is metadata important in records management?

It assists with indexing, searching, and managing records. (Correct answer)
It encrypts data automatically.
It replaces records.
It stores passwords.

Correct answer: It assists with indexing, searching, and managing records.

Metadata, or 'data about data,' is crucial in records management because it provides essential contextual information about each record. This includes details like creation date, author, keywords, and retention period, which greatly enhance a record's discoverability and usability. Metadata enables efficient indexing, precise searching, and automated management of records throughout their lifecycle, ensuring they can be found and understood when needed.

Certified Records Manager (CRM) Exam

The CRM certification validates expertise in managing records and information, from creation to disposition.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds