SharePoint document control: how to set it up properly

Short answer: SharePoint can do proper document control, but not out of the box. A standard document library stores files and keeps versions. Document control needs more: a clear split between drafts and published documents, approval before release, unique numbering, review dates that trigger action, and a record of who approved what. All of that can be built in SharePoint and Power Automate, inside the Microsoft 365 you already have.

This guide explains what document control means in practice, which SharePoint features help, where they fall short, and how to set it up so it holds up in an audit.

What document control actually means

Document control is the set of rules that makes sure people use the right version of a controlled document, such as a policy, procedure, work instruction, form or template. In practice it means every controlled document:

• has a unique number, title, owner and version
• is reviewed and approved before anyone relies on it
• is available in its current version, and only that version, to the people who need it
• can’t be changed without going back through approval
• is reviewed on a schedule, and withdrawn when it is superseded
• leaves a trail showing what changed, when, why and who signed it off

These are the same controls ISO 9001, ISO 45001, ISO 14001 and most industry accreditations ask for. If you work to ISO 9001, our article Can SharePoint handle ISO 9001 document control? maps each clause 7.5 requirement to SharePoint.

What SharePoint gives you out of the box

SharePoint document libraries include several useful building blocks:

Feature	What it does	Where it falls short
Version history	Keeps previous versions and shows who changed what	Shows changes, not that the right person approved them
Major and minor versions	Separates drafts (0.1, 0.2) from published versions (1.0, 2.0)	Drafts and published documents still sit in the same library
Content approval	Holds a document as pending until an approver accepts it	One approver role per library, with no routing by document type or department
Check-out	Stops two people editing the same file at once	Often switched off because it conflicts with co-authoring
Metadata columns	Captures owner, document type, review date and so on	Nothing enforces a unique number or acts on the review date
Retention labels	Keeps or deletes content for a set period, and can lock records	Some features depend on your Microsoft 365 licence

Switched on together, these get you part of the way. The gaps are numbering, routing approvals to the right person, acting on review dates, and keeping staff away from drafts.

How to set up document control in SharePoint

1. Separate working and published areas. Authors work in a draft library. Staff read from a published library they can’t edit. This one change fixes the most common audit finding: people using a draft or an old version.
2. Define the metadata and make it required. Document number, title, type, department, owner, authoriser, version and review date. If a field is optional, it will be left blank.
3. Automate numbering. Generate numbers from your naming rules (for example POL-HR-012) with Power Automate, so they are unique and never typed by hand.
4. Build an approval workflow. Route each document to the right authoriser by type or department, capture the decision and comments, and publish only when it is approved.
5. Publish a read-only copy. Many organisations publish a PDF so the controlled version can’t be edited or copied as a working file.
6. Withdraw superseded versions automatically. When version 3 is published, version 2 moves to an archive with restricted access.
7. Make review dates act. Send reminders before the due date, return overdue documents to the owner, and show what is due on a dashboard.
8. Record read and acknowledge where it matters. For key policies and procedures, ask staff to confirm they have read the new version and keep the evidence.
9. Apply retention. Use retention labels or archive rules by document type, so records are kept for the right period and disposed of on purpose.

None of this needs custom code. It is SharePoint libraries, permissions, Power Automate and, for a better user experience, a Power Apps front end.

Common mistakes

• Treating SharePoint like a shared drive. Copying the old folder structure across keeps all the old problems.
• Too many people with edit rights. If everyone can edit the published library, nothing is controlled.
• Controlling everything. Only documents people rely on to do work need control. Meeting notes and working files don’t.
• Review dates nobody owns. A date in a column is not a control. Something has to act on it.
• Uncontrolled copies. Staff saving procedures to their desktop or posting them in Teams chats. Link to the published library instead of attaching files, and mark printed copies as uncontrolled.

Build it yourself or start from a ready-made system?

A capable SharePoint administrator can build all of this. For most organisations of 50 to 150 staff, the effort goes into the workflow, numbering, review reminders and dashboard, then keeping them working as staff and processes change.

Applecart DMS is our ready-made document management system that does this in your own Microsoft 365. It has a three-stage lifecycle (Edit, Authorise, Publish), one trusted library of current documents, automatic numbering, review dates that send documents back for update, read and acknowledge, and a full audit trail. It is set up for your document types and approvers rather than built from scratch.

Common questions

Is SharePoint a document control system?
Not on its own. SharePoint is the platform. It becomes a document control system once it is configured with separate draft and published areas, required metadata, an approval workflow and review controls.

Can SharePoint number documents automatically?
SharePoint has a Document ID feature, but it produces generic IDs. Numbers that follow your own scheme, such as POL-HR-012, are usually generated with Power Automate.

Do we need extra licences for document control in SharePoint?
Usually not. SharePoint, Power Automate and Power Apps built on SharePoint data are included in most Microsoft 365 business plans. Some advanced retention and records features depend on your plan.

Can SharePoint document control pass an ISO audit?
Yes, if the controls work and you can show the evidence. Auditors certify your system, not your software. See what ISO 9001 clause 7.5 asks for.

Get your document control sorted

Applecart Digital sets up SharePoint document management for growing organisations across Brisbane, Queensland and Australia, working alongside your IT team. Try the Applecart DMS demo, or talk to us about your document control.