Document control for SharePoint

Xoralia manages controlled documents through their whole lifecycle in SharePoint, from draft to approval, publication, review and withdrawal. Each document has one current version, a named owner and a full record of previous versions. Everyone is confident they always work from the right version and the auditors are satisfied.

Book a demo
  • G2 Summer 2026 - Policy Management - Momentum Leader
  • G2 Summer 2026 - Policy Management - Easiest To Use - Mid-market
  • G2 Summer 2026 - Policy Management - High Performer

Who this is for

  • Quality managers and heads of quality

    Accountable for the management system at the next audit, and usually the person everyone messages to ask where the latest copy is.

  • Document controllers and document control teams

    Issuing, numbering, distributing and withdrawing controlled documents, usually with a register in Excel and a great deal of chasing.

  • HSEQ and integrated management system leads

    Running quality, environmental and safety documentation as one system, often under several certificates at once.

  • Quality and regulatory affairs in medical devices and pharma

    Where a document control finding is a regulatory finding, the inspector reads the revision history, and the history has to last the life of the device.

  • Microsoft 365 and SharePoint owners

    Asked to make SharePoint meet a document control standard without adding another platform to secure and pay for.

  • Engineering and technical document managers

    Controlling the specifications, method statements and procedures that people in the field work from.

  • Compliance and risk teams in financial services

    Where the procedures manual is the control, and the regulator wants to see how it changed and who approved it.

Document version control in SharePoint

SharePoint stores your documents. Xoralia controls them.

Out of the box, SharePoint keeps files but nothing controls which version is in force, who approved it or who has seen it. Here are the five controls Xoralia adds, and the problems each one removes.

01 · One current version

There is one current version, and every link points at it

Each controlled document lives in one place. When a new revision is approved it takes the place of the old one at the same link, so every page, portal and bookmark that pointed at the document now points at the current version.

What this fixes

  • Nobody can be certain which version is the one in force
  • The quality team has become the search engine
  • Controlled documents are spread across several systems
  • Working from the wrong document can have serious consequences

1 in 10

FDA inspection observations against medical device quality systems relate to document control. FDA CDRH, Analysis of Inspection Observations, FY2017: 360 of 3,519 observations

02 · Locked once published

No one can edit a published document. It is set in stone.

Nothing changes without passing through review. Minor edits, such as typos and immaterial changes, can go through a simple workflow if necessary. Controlled templates and forms go out as working copies: staff download a copy to fill in, and the controlled master stays where it is, at the current revision.

What this fixes

  • Anyone with access to the file can change the approved version
  • Sensitive documents end up outside the system because they cannot be locked down inside it

03 · Review and approval

Reviews run on time, and nobody approves their own work

Review and approval cycles can be made mandatory for a document, with named people or groups responsible for each step of the cycle. Owners are reminded when a review is due, so nobody has to chase by hand.

What this fixes

  • Reviews and approvals happen in email and track changes, and the record ends up everywhere
  • Reviews run late because the chasing is manual

3rd

A UK certification body ranks poor document control third among the ISO 9001 nonconformities it raises. ISOQAR (UKAS-accredited), from thousands of audits a year

04 · Audit trail

Every controlled document carries its revision and approval trail

Who approved it, on which date, against which revision. The record is made as the work happens, so nothing has to be reconstructed afterwards. The master sheet maintains itself: owner, revision, status and next review for every controlled document, in one view, with no spreadsheet to update.

What this fixes

  • Producing the version history for an auditor is a scramble
  • A review that changes nothing leaves no evidence that it happened

Top 10

Control of documented information is one of the ten most cited clauses across 17,184 AS9100 nonconformances raised in a single year. IAQG OASIS data, 2019, as reported by simpleQuE

05 · Distribution

Distribution is targeted and provable

The people who need a document are the ones who get it, and there is a permanent record of who received and acknowledged each revision.

What this fixes

  • Old printed and downloaded copies are everywhere
See all features

Case studies

UKAD streamlines policy management with Xoralia

UK Anti-Doping

Review and approval workflows, automated reminders, version history and audit trails used to sustain ISO 9001 and ISO 27001 certification.

Read the story
How LifeArc leveraged Xoralia to get ISO 27001 certified

LifeArc

Version control resolved multiple circulating versions; the audit trail supported ISO 27001 certification.

Read the story
4.6 / 5
on G2
From 40 reviews. 82% five-star, nothing below four.
94% · 96%
ease of use and quality of support
Against G2 category averages of 90% and 92% (Summer 2026 report).
2 months
average time to go live
G2-reported implementation time.
0
G2 badges
Across six consecutive seasons, including High Performer, Easiest to Use and Fastest Implementation.
  • G2

    G2 review

    “Using Xoralia has provided us with a single source of truth for our Integrated Management System documents, which has greatly improved our document governance and control.”

    Mignon B.

    operational excellence manager, enterprise engineering customer, December 2025

  • G2

    G2 review

    “The platform helps [us] address compliance challenges by introducing formal document control, traceability, and accountability. Xoralia enables clearer ownership, review cycles, and evidence for audit purposes, reducing the effort and uncertainty previously involved in demonstrating compliance.”

    Mid-market customer in oil and energy

    April 2026

  • G2

    G2 review

    “Xoralia helps solve document control, compliance, and governance challenges by providing a controlled document lifecycle, automated workflows, and a single source of truth.”

    Enterprise customer in civil engineering

    July 2026

  • G2

    G2 review

    “Before this, documents were scattered across SharePoint, version control was inconsistent, and it was hard to know which policy was current or who was responsible for updates.”

    Derek W.

    head of internal audit, financial services, December 2025

See how Xoralia meets each ISO 9001 document control requirement

A clause-by-clause walk through the document control requirements of ISO 9001 and how each is met inside SharePoint.

Read the guide

Industries

Related use cases

  • Document management for SharePoint

    For every controlled document in the business: policies, procedures, guidelines, templates, forms and certificates, kept current, findable and governed inside your SharePoint and Microsoft 365 estate.

    Learn more

  • Policy management for SharePoint and Microsoft 365

    Single source of truth for policies with clear owners and approvers, tracked attestations, regular reviews and always audit ready

    Learn more

  • SOP and work instruction management

    For authoring, storing and reviewing the step-by-step detail of how operational tasks are done

    Learn more

  • AI content governance

    For making sure AI answers from the system of record with authoritative, trusted content

    Learn more

Related reading

Frequently asked questions

What is document control?
Document control is the set of practices that make sure the documents an organisation works from are identified, approved, current and available, and that old versions cannot be used by mistake. It covers numbering, revision status, review and approval, distribution, change control and retention. Standards such as ISO 9001 make it a requirement of a certified management system.
What is the difference between document control and document management?
Document management is about storing, organising and finding documents. Document control is narrower and stricter: it governs specific documents to a defined standard, so that each has an approved current revision, a record of changes, controlled distribution and a way of withdrawing superseded versions. Every controlled document is managed. Not every managed document is controlled. If you don't need formal control, see our SharePoint document management system.
What does ISO 9001 require for document control?
Clause 7.5 of ISO 9001:2015 requires documented information to be identified and described, reviewed and approved for suitability, available where it is needed, protected from loss and improper use, and controlled for distribution, access, storage, change, retention and disposal. Obsolete documents must not be usable by mistake. The standard does not prescribe a tool.
Can SharePoint be used for ISO 9001 document control?
Partly. SharePoint gives you versioning, permissions, metadata and an audit log, which cover storage, protection and access. It does not give you named ownership, scheduled review, an approval workflow with a record, a published copy separate from the working file, or a way to stop old versions circulating. Xoralia adds those on top of SharePoint.
Do ISO auditors accept document control that runs on SharePoint?
Yes. ISO 9001, ISO 13485 and ISO 27001 specify what document control must achieve, not which software does it. Auditors test the controls: is there one approved current version, a record of review and approval, controlled distribution, and evidence that old versions are withdrawn. Many customers running Xoralia on SharePoint hold ISO 9001, ISO 27001 and medical device certifications.
Our ISO consultant wants us to use their document control tool. Why use yours instead?
Because your documents are already in SharePoint, and a consultant's tool moves them into a repository you do not own. Xoralia leaves them where they are, under your permissions and retention, so the controls stay with you if you change consultant, change certification body, or outgrow the tool. The consultant can still be given read access to audit against it.
Does Xoralia provide document version control?
Yes. Each controlled document has one current published revision. Changes are made to a working copy, go through review and approval, and replace the published revision when approved. Earlier revisions are retained in the SharePoint library's version history, with who changed what and when.
Can auditors see the old versions of a document?
Yes. When a new revision is published it replaces the old one at the same link, so readers only reach the current version. Every previous published version stays in SharePoint version history with its dates and approvers, and can be opened for an auditor who asks for revision three, four and five.

See Xoralia inside Microsoft 365 Book a demo or start a free trial.

Book a demoStart a free trial