The ISO auditor sat across from me, tablet open, waiting.
"I need to see your documented approval process for your Health and Safety Policy," she said. "Show me the audit trail—who reviewed it, who approved it, and when it was published."
I opened SharePoint. Found the policy document. Clicked through the version history.
"Here's the current version," I said, pulling up Safety_Policy_v4_Final.docx. "It was uploaded in March."
"Who approved it?" she asked.
"Our legal team and the safety officer. I can forward you the email thread if you—"
She stopped me. "Email isn't sufficient for ISO 9001 compliance. I need documented evidence within your document control system showing approval authority, approval date, and change history."
I didn't have it.
The audit finding: Major non-conformance for inadequate document control.
Our ISO 9001 certification was delayed by six months. Our largest client—who required ISO certification—put our contract renewal on hold. Estimated cost: $180,000 in delayed revenue and $15,000 in re-audit fees.
All because we couldn't prove a Word document was approved.
The Illusion of Compliance
Here's what makes this story common: We thought we were compliant.
Our policies existed. They were reviewed. They were approved. Legal signed off. Everything was legitimate.
But ISO auditors don't care what happened—they care what you can prove happened.
And SharePoint, Google Drive, and shared network folders are fundamentally incapable of proving it.
Why File Storage ≠ Document Control
SharePoint is a file cabinet. It stores documents. That's what it's designed to do.
But ISO 9001, ISO 27001, ISO 13485, and other quality management standards don't require file storage—they require documented control processes:
- Who created the document
- Who reviewed it (and when)
- Who approved it (with authority to do so)
- What changed between versions
- When it was published
- Who has accessed it
SharePoint can show you:
- Who uploaded the file (not who approved it)
- When it was uploaded (not when it was approved)
- Version numbers (not what changed or why)
The gap between these two lists is why audits fail.
The Email Approval Theater
After the audit failure, I asked our legal team: "Didn't you approve the safety policy?"
They forwarded me the email chain. It was there:
Subject: RE: RE: Draft Safety Policy Review From: Legal Director Date: March 8, 2025 Message: "Reviewed. Looks good. Approved."
Perfect. Clear approval from the right person.
But the auditor rejected it. Here's why:
Email Isn't a Document Control System
Email chains are:
- Unstructured: Approvals buried in reply threads, scattered across inboxes
- Not traceable: Forwarded emails don't prove the recipient was authorized to approve
- Easily lost: Deleted emails, full mailboxes, employee departures
- Not integrated: No link between the email approval and the published document
The auditor asked: "How do I know this email refers to version 4 of the policy? How do I know version 4 is what's currently published? How do I know employees are accessing version 4 and not version 3?"
I didn't have answers.
Email approval feels like compliance. It isn't.
The Version Control Nightmare
Let me show you our SharePoint folder for the Health and Safety Policy:
📁 Policies > Health and Safety
📄 Safety_Policy_Draft.docx
📄 Safety_Policy_v2.docx
📄 Safety_Policy_v2_final.docx
📄 Safety_Policy_v3_Legal_Review.docx
📄 Safety_Policy_v3_FINAL.docx
📄 Safety_Policy_v4_Final.docx
📄 Safety_Policy_v4_Final_REVISED.docx
Which one is current? Who knows.
Employees download whichever one appears first. Some have version 3 saved locally. Some are using version 4. The intranet links to version 2.
The auditor's question: "How do you ensure employees are accessing the current, approved version?"
My answer: "We... send an email when there's a new version?"
Her response: "That's not controlled distribution. That's hope."
What Actually Happens with File Versioning
SharePoint's "version history" shows:
- Version 1.0 uploaded by John Smith on Jan 15
- Version 2.0 uploaded by Jane Doe on Feb 3
- Version 3.0 uploaded by John Smith on Feb 28
- Version 4.0 uploaded by Sarah Johnson on March 10
But it doesn't show:
- Why version 2 was created (what changed?)
- Who approved version 3 (or if it was approved at all)
- Whether version 4 is a draft or final
- What the review process was
From a compliance perspective, this is useless.
The Hidden Compliance Costs
Our failed audit cost $180,000 in delayed revenue. But the real costs started before the audit:
Time Wasted on Manual Document Control
Before the audit, our quality manager spent 8 hours per week maintaining a spreadsheet tracking:
- Policy names and document IDs
- Current version numbers
- Review dates and reviewers
- Approval dates and approvers
- Next scheduled review dates
- Document owners
This spreadsheet had 47 rows (one for each policy and procedure). It was updated manually. It was frequently wrong.
Cost: 8 hours/week × 52 weeks × $45/hour = $18,720 per year just tracking what should be automated.
Time Wasted Searching for Policies
Employees spent an average of 12 minutes per day searching for policy documents:
- Which SharePoint folder is it in?
- Is this the current version?
- Who approved this?
- When was it last updated?
For a 50-person organization: 50 employees × 12 minutes/day × 250 work days × $30/hour (average) = $75,000 per year in wasted search time.
Compliance Risk from Outdated Policies
Three employees were still following the old Travel & Expense Policy (version 2) which allowed higher per-diem rates.
Finance didn't catch it for four months. $8,400 in over-reimbursed expenses that we couldn't reclaim because employees followed "official policy" (just not the current one).
Total Hidden Cost: $102,120 Annually
And that's before the failed audit and delayed certification.
What ISO Auditors Actually Want to See
After the failed audit, we hired a compliance consultant to help us understand what "document control" actually means.
Here's what ISO standards require:
1. Documented Approval Authority
For every controlled document, you must prove:
- Who has authority to approve it (defined roles, not just names)
- Who actually approved this version
- When it was approved
- Evidence of that approval (within the document control system, not email)
Example: "The Health and Safety Policy was approved by Legal Director (Sarah Johnson) and Safety Officer (Mark Davis) on March 10, 2025 at 2:34pm."
2. Version Control with Change Tracking
You must demonstrate:
- What changed between versions
- Why it changed (reason for revision)
- Who made the changes
- When each version was created and superseded
Example: "Version 4 updated Section 3.2 (PPE requirements) to align with new OSHA regulations. Changed by: John Smith. Approved by: Legal + Safety. Published: March 12, 2025. Supersedes: Version 3 (published Feb 28, 2025)."
3. Controlled Distribution
You must prove:
- Who has access to the document
- How you ensure they're accessing the current version
- When they last accessed it (for critical documents)
Example: "Safety Policy is published to the company intranet. All employees have access. Version 3 was automatically obsoleted when Version 4 was published. Employees cannot access superseded versions."
4. Review Schedules and Reminders
You must demonstrate:
- Policies are reviewed on a defined schedule (annually, every 2 years, etc.)
- Responsible parties are notified when reviews are due
- Overdue reviews are escalated
Example: "Safety Policy is reviewed annually. Owner: Safety Officer. Next review: March 2026. Automated reminder sent 30 days before due date."
5. Audit Trail for Everything
You must provide a complete history:
- All versions ever published
- All approvals granted
- All changes made
- All review cycles completed
This audit trail must be immutable (can't be edited retroactively) and comprehensive (includes all document lifecycle events).
Why SharePoint and Google Drive Fail
Both platforms are excellent at file storage. Neither is designed for compliance.
SharePoint Gaps
Missing:
- Approval workflows with documented sign-off
- Change tracking with reasons for revision
- Automated review reminders
- Audit trail proving compliance
- Controlled distribution (employees can download old versions)
What it does well:
- Stores files
- Tracks upload dates
- Shows who uploaded (not who approved)
Google Drive Gaps
Missing:
- Approval authority definition
- Workflow automation
- Review scheduling
- Audit-ready reports
- Version control with change explanations
What it does well:
- Stores files
- Real-time collaboration
- Suggests edits (but no formal approval process)
Shared Network Drives
Even worse. No version control. No access tracking. No audit trail. Just files in folders.
The Centralized Compliance Solution
After the failed audit, we implemented a purpose-built compliance management system. Here's what changed:
Approval Workflows (Draft → Review → Approval → Published)
Creating a new policy now follows a defined process:
- Draft: Author creates the policy in a web-based editor (no more Word docs)
- Review: System routes to designated reviewers (legal, subject matter experts)
- Approval: Approvers formally sign off (within the system, with timestamp)
- Published: Once approved, policy is automatically published and previous version is obsoleted
Every step is logged. Every approval is documented. The audit trail is automatic.
Example: When I create a new Travel Policy:
- I draft it and click "Submit for Review"
- System emails Legal Director and CFO (designated reviewers)
- They review and click "Approve" (logged with their user ID and timestamp)
- System automatically publishes the policy and notifies all staff
- Previous version is marked "Superseded" and removed from general access
Version Control with Change Explanations
Every version includes:
- Change summary: "Updated per-diem rates for domestic travel (Section 4.2)"
- Reason for change: "Align with updated IRS guidelines effective June 2025"
- Diff view: Side-by-side comparison showing exactly what changed
- Approval record: Who approved, when, with timestamps
Auditors can see the complete evolution of any policy, with context for every change.
Automated Review Reminders
Each policy has a defined owner and review schedule:
- Travel Policy: Reviewed annually by CFO
- Safety Policy: Reviewed annually by Safety Officer
- Data Privacy Policy: Reviewed every 6 months by Legal + IT
30 days before a review is due, the system emails the owner: "Your Travel Policy review is due on July 1, 2025."
If the review isn't completed by the due date, escalation emails go to their manager.
No more spreadsheets tracking review dates. No more missed reviews.
Single Source of Truth
All policies live in one centralized system:
- Employees access via web or mobile (no downloading Word docs)
- Always see the current, approved version
- Previous versions are archived (accessible for audits, but not for general use)
- Search across all policy content (find "expense reimbursement" across all documents)
When a policy is updated, the change is instant and universal. No one is working from outdated versions.
Audit-Ready Reports
When the follow-up ISO audit arrived, the auditor asked for the same proof:
"Show me your Safety Policy approval process."
I logged into the system and pulled up the audit report:
- Policy: Health and Safety Policy v4
- Created by: John Smith (Safety Officer), March 8, 2025
- Reviewed by: Legal Director (Sarah Johnson), March 9, 2025 at 10:23am
- Approved by: Legal Director (Sarah Johnson), March 9, 2025 at 2:15pm
- Approved by: CEO (Mark Anderson), March 10, 2025 at 9:04am
- Published: March 10, 2025 at 9:05am
- Changes from v3: Updated Section 3.2 (PPE requirements) per OSHA update
- Access: 47 of 50 employees have accessed the current version
- Next review: March 10, 2026 (Owner: John Smith)
The auditor nodded. "This meets the requirements."
Audit result: No findings. Full certification granted.
Real-World Use Cases Beyond ISO Audits
Centralized compliance management isn't just about passing audits—it's about operational efficiency.
Use Case 1: HR Policy Updates
Scenario: HR needs to update the Parental Leave Policy to comply with new state regulations.
Old process (SharePoint):
- HR drafts policy in Word
- Emails to Legal for review (wait 3 days)
- Legal replies with comments (back to HR)
- HR makes changes, emails back (wait 2 days)
- Legal approves via email
- HR uploads to SharePoint (which folder?)
- HR sends email to all staff: "New parental leave policy available"
- Some employees miss the email
- Some employees can't find it in SharePoint
- Total time: 7-10 days
New process (Comply):
- HR drafts policy in web editor
- Clicks "Submit for Review" → routes to Legal automatically
- Legal reviews in-system, adds comments
- HR makes changes (all visible in version history)
- Legal clicks "Approve" (documented approval)
- System auto-publishes and notifies all staff
- Policy is instantly accessible via search
- Total time: 2-3 days
Time saved: 5-7 days per policy update
Use Case 2: New Employee Onboarding
Scenario: New hire needs to read and acknowledge 12 company policies.
Old process:
- HR emails list of policy links
- Employee clicks through SharePoint folders
- Downloads 12 Word documents
- Reads them (or doesn't)
- HR has no way to verify they read them
New process:
- System automatically assigns required policies to new hire
- Employee accesses via dashboard (one click per policy)
- Reads each policy (mobile-friendly web view)
- Clicks "I acknowledge" (logged with timestamp)
- HR dashboard shows completion status
Result: 100% acknowledgment tracking, better mobile experience, verifiable compliance
Use Case 3: Quality Management for Manufacturing
Scenario: FDA-regulated medical device manufacturer needs to prove document control for 21 CFR Part 820.
Requirements:
- All quality procedures must be approved before use
- Changes must be reviewed and approved
- Obsolete documents must be removed from use
- Complete history must be maintained
Comply solution:
- Approval workflows ensure no unapproved procedures
- Version control tracks all changes with justification
- Obsolete versions are auto-archived (not accessible)
- Audit trail provides complete history for FDA inspections
Result: Pass FDA inspection with zero document control findings
Use Case 4: Multi-Site Organizations
Scenario: Company has offices in 5 countries, each with local HR policies plus global policies.
Challenge:
- Global policies apply to everyone (Code of Conduct, Data Privacy)
- Local policies vary by country (PTO, local labor laws)
- Employees need to see only relevant policies
Comply solution:
- Tag policies by geography (Global, US, UK, Germany, etc.)
- Employees see only policies that apply to their location
- Global policy updates propagate instantly to all sites
- Local HR managers control local policies independently
Result: Centralized management, localized access, consistent compliance
Integration Benefits: The Compliance Ecosystem
Here's where centralized compliance becomes powerful:
Integration with Corporate AI (Atlas)
Employees ask questions:
- "What's the maximum hotel rate for domestic travel?"
- "How many days of parental leave am I eligible for?"
- "What's our policy on remote work?"
Instead of searching SharePoint, they ask Atlas (your corporate AI chatbot).
Atlas searches your Comply policy database and answers instantly:
- "According to the Travel & Expense Policy (Section 4.2), domestic hotel rates are capped at $200/night in major cities."
- Direct link to the full policy for reference
Result: Instant policy answers, zero search time, always current
Integration with Task Management (NextUp)
Policy review workflows create tasks:
- "Review Travel Policy" assigned to CFO, due July 1
- "Approve Data Privacy Policy update" assigned to Legal Director
These tasks appear in NextUp alongside other work:
- See all pending policy reviews in your task dashboard
- Get reminded without separate systems
- Track completion across all compliance tasks
Result: Policy reviews don't fall through cracks, compliance deadlines are met
Integration with Training Systems
When a critical policy is updated:
- Automatically create a training assignment: "Read updated Safety Policy"
- Track employee completion
- Generate compliance reports for audits
Result: Provable policy distribution and acknowledgment
Getting Started: Migrating from SharePoint
If you're currently using SharePoint or shared drives for compliance, here's how to transition:
Step 1: Audit Current Policy Inventory
List all controlled documents:
- Policies (HR, IT, legal, safety, etc.)
- Procedures (SOPs, work instructions)
- Forms and templates
- Quality manuals (ISO, FDA, etc.)
Identify:
- Current version (if you can determine it)
- Owner (who's responsible)
- Review frequency (annual, biennial, etc.)
Step 2: Define Approval Workflows
For each document type, define:
- Who drafts it (original author)
- Who reviews it (subject matter experts)
- Who approves it (final authority)
- What triggers a review (annual schedule, regulatory change, etc.)
Example: HR policies require Legal review + HR Director approval
Step 3: Set Up Centralized System
Modern compliance tools like Comply set up in hours:
- Web-based editor (no Word docs)
- Approval workflow configuration
- User role assignment (authors, reviewers, approvers)
- Review schedule automation
Step 4: Migrate Policies with Version History
For each policy:
- Import current approved version
- Add metadata (owner, approval date, next review)
- Mark as "Published" in the new system
- Optional: Import previous versions for audit trail
Do NOT simply upload Word docs—use the structured editor to ensure future maintainability.
Step 5: Archive Old SharePoint Folders
Once migration is complete:
- Make SharePoint folders read-only
- Add a prominent notice: "Policies have moved to [new system]"
- Keep for reference, but prevent new uploads
This ensures employees don't revert to old habits.
Step 6: Train Staff and Enforce Usage
Communicate the change:
- "All policies now live in [new system]"
- "SharePoint is no longer the source of truth"
- "Policy searches now happen in [new system]"
Provide training:
- How to find policies
- How to acknowledge policies
- How to request policy changes (for authors/owners)
Enforce usage:
- Auditors will only accept proof from the official system
- Policies in SharePoint are not controlled
The Bottom Line
We thought SharePoint was enough for compliance. We were wrong.
File storage isn't document control. Email approvals aren't audit trails. Version numbers aren't change tracking.
ISO auditors don't care that your policies exist—they care that you can prove they were controlled.
And when we couldn't prove it, we lost six months of certification progress and $180,000 in revenue.
Centralized compliance management isn't about fancy tools or automation for its own sake. It's about:
- Proving your processes are followed (audit trails)
- Ensuring employees access current information (controlled distribution)
- Tracking review cycles and approvals (accountability)
- Reducing manual overhead (automated workflows)
Because when the auditor asks, "How do you know this policy was approved?"—the answer can't be "I'm pretty sure there's an email somewhere."
Built for compliance, not file storage. Comply centralizes policies, procedures, and quality documentation with built-in approval workflows, version control, and audit trails—so you can prove compliance, not just claim it.
Try Comply Free • No credit card needed
Tom Foster is the founder of Avoidable Apps, a suite of productivity tools designed to eliminate the busy work that fragments modern knowledge workers' attention.