NVRA CM Certified Master common mistakes
NVRA CM Certified Master · Understand the traps and how to avoid them.
Treating legal hold as a purely legal-department activity and leaving the records manager out of hold issuance, scope definition, and release decisions.
Candidates study retention schedules and disposition mechanics in isolation, so hold arrives as an abstract topic; in practice many organizations route holds through counsel only, reinforcing the assumption that RIM has no role.
What to do instead
Memorize the RIM-owned mechanics of a hold: identifying and freezing the affected record series, suspending the schedule-driven destruction calendar, documenting custodian acknowledgments, tracking hold scope changes, and requiring written legal release before disposition resumes. Frame RIM as the operational executor of counsel's instruction, not the decision-maker.
Applying a single retention period to an entire record series without distinguishing the record's function, the governing jurisdiction, and the trigger event that starts the clock.
Candidates memorize headline retention numbers and forget that the same document type may be a contract record, a tax record, and a personnel record simultaneously, each with a different trigger and period.
What to do instead
Practice classifying a sample record into multiple series and stating, for each, the trigger event (creation, supersession, termination, audit close, employee separation) and the longest applicable period. Always ask which schedule governs when jurisdictions conflict and document the conflict-resolution rule.
Describing disposition as deletion, and omitting the authorization, documentation, and certificate-of-destruction steps that must precede and follow it.
Disposition is often taught as the end of the lifecycle, so candidates compress it into 'destroy when retention expires' and skip the approval chain and audit trail that the exam tests.
What to do instead
Recite disposition as a sequence: confirm retention met, confirm no hold or open matter, obtain documented authorization, execute destruction or transfer, record what was destroyed with volume and method, and retain the destruction documentation itself per its own schedule.
Confusing a records management policy with a records management program, and answering governance questions with 'write a policy' when the question asks about accountability, oversight, or performance measurement.
Policy is the most visible artifact, so candidates equate it with governance and miss the executive sponsor, steering committee, defined roles, training, audit, and metrics that constitute an operating program.
What to do instead
Build a mental checklist of program components: charter and scope, executive sponsorship, roles and responsibilities matrix, policy and standards hierarchy, training and communication, monitoring and audit, corrective action, and reporting to leadership. Answer governance questions by naming the specific component requested.
Treating an electronic document management system or shared drive as the records system of record without verifying that it captures metadata, enforces retention, and supports defensible disposition.
Candidates equate storage location with records control, so they assume any repository with folders and permissions satisfies electronic records requirements.
What to do instead
Evaluate any system against explicit criteria: declared record status, immutable audit trail, retention rules engine, hold capability, metadata schema, migration and export support, and disposition workflow. If a system lacks these, the answer is that records must be managed in or federated to a compliant system, not that the storage location suffices.
Answering privacy questions with confidentiality alone, without addressing lawful basis, notice, minimization, access and correction rights, and cross-border transfer limits.
Confidentiality and privacy feel synonymous, so candidates stop at 'restrict access' and miss the data-subject-facing obligations that privacy frameworks impose on records programs.
What to do instead
Separate the two concepts explicitly: confidentiality is about who may see the record; privacy is about whether collection and use are lawful and limited. For privacy questions, check collection purpose, notice, minimization, retention limitation, subject access and correction, third-party sharing, and transfer restrictions.
Planning a media conversion or digitization project without deciding the fate of the source media, and assuming the scan automatically becomes the official record.
Candidates focus on image quality and throughput, treating conversion as a technical exercise, and overlook legal admissibility, source retention, and disposition of originals.
What to do instead
For every conversion question, address four things: whether the organization's policy and jurisdiction permit the copy to be the official record, the quality and completeness validation performed, the retention and eventual disposition of the source, and the documentation of the conversion process. State that originals are not destroyed until legal and policy conditions are confirmed.
Identifying vital records by asking which records are most important to the business rather than which are irreplaceable and required to resume operations within the recovery time objective.
Importance is intuitive and easy to answer, so candidates list high-value strategic documents instead of the narrow set needed for legal continuity, financial obligations, and core operations during disruption.
What to do instead
Apply the vital-records test: irreplaceable or reconstructible only at unacceptable cost, and needed within the recovery window. Classify into emergency operations, legal and financial rights, and records needed to protect the organization, then tie each to a protection method and an RTO.
Running a records project by listing deliverables on a timeline while omitting stakeholder analysis, resistance planning, pilot scope, and adoption measurement.
Candidates translate project management into scheduling and treat change leadership as soft content that does not need structure, so they miss questions about sponsorship, communication cadence, and readiness.
What to do instead
Structure every project answer around four tracks: scope and milestones, stakeholder and impact analysis, communication and training plan with named owners, and adoption metrics with a feedback loop. Reference a pilot or phased rollout and a defined rollback or remediation path.
Writing audit and compliance answers that stop at 'conduct an audit' without defining the control being tested, the evidence sampled, the finding severity, or the remediation and follow-up cycle.
Candidates know audits exist but not how they are scoped, so answers stay at the level of intent and fail questions that ask how compliance is demonstrated or how a gap is closed.
What to do instead
Describe the audit cycle concretely: select the control, define the test and sample, collect evidence, rate the finding, assign an owner and due date, verify remediation, and report results to the governing body. Tie each control to a policy requirement so the audit is traceable to the program.