Can You Build an ISO System in SharePoint?

Last Updated: October 30, 2026

Table of Contents

• Why SharePoint Is a Practical Starting Point for an ISO System
• Using SharePoint Document Control for ISO Documents
  • Organising Libraries and Folders by Document Type
  • Publishing the Latest Version to Staff
  • Handling Superseded Versions and Retention
  • Evidence Retrieval for Audits
  • Common Mistakes
• Setting Up a SharePoint Document Approval Workflow
• Presenting Policies, Procedures and Forms on SharePoint Pages
• Building an ISO Document Register and Other Registers
• ISO Management System Forms and Registers Using Microsoft Forms
• Weighing SharePoint Against Dedicated Knowledge Management Tools
  • The Four Tiers
  • Tier 1: Simple File Storage
  • Tier 2: Knowledge Management Portals
  • Tier 3: SharePoint or Teams Sites with Automation
  • Tier 4: Advanced Enterprise Platforms
  • How to Choose
• Your Next Step: Mapping Your Current Documents to a SharePoint Structure
• Frequently Asked Questions

Why SharePoint Is a Practical Starting Point for an ISO System

Yes, you can build a working ISO system SharePoint setup inside Microsoft 365.

SharePoint gives you a central place to store documents, control access and publish the current version to staff.

The real question is whether your staff can always find and open the latest approved version.

Think of SharePoint as a foundation. If you want a structured starting point, the Free ISO Starter Pack can give you a foundation to adapt to your own operations.

Using SharePoint Document Control for ISO Documents

SharePoint's built-in features handle much of the document control work ISO requires: version history, check-in and check-out, metadata, permissions and retention labels. Together they record who changed a document, when, and whether the current version is approved.

Document control in SharePoint typically covers five jobs:

• Storing the controlled copy in one location
• Versioning so every change is recorded
• Publishing the approved version so staff use the right one

Turn on major versioning for your ISO document libraries to keep a history of each approved version. For a practical walkthrough of managing ISO documentation online, including version control and registers, see step-by-step guidance for managing ISO documentation online.

Organising Libraries and Folders by Document Type

How you structure libraries determines how easily you can find and manage documents.

Consider this approach:

• Policies library: Top-level commitments, such as a quality policy
• Procedures library: Documented processes that describe how work is done
• Work instructions library: Detailed task-level guidance

Add metadata columns such as document number, owner, status, next review date and clause reference. Metadata lets you filter views, such as showing only documents due for review this month, and makes your document register easier to build.

A practical metadata set for an ISO library looks like this:

Keep the number of required columns small. Every mandatory column is a field someone must fill in, and incomplete metadata undermines your register.

Publishing the Latest Version to Staff

Storing the current version is not enough. Staff must be able to see that a document is current and approved.

SharePoint pages and filtered document lists help here.

When a document changes, announce it through a news post or Teams message linking to the updated version. Keep the announcement as evidence of communication, a screenshot or the retained post is usually enough.

Handling Superseded Versions and Retention

This is where many home-built SharePoint systems fall short. An auditor will ask how you prevent staff from using an obsolete procedure. The answer needs to be visible in the system, not just described in a procedure.

Use one or more of these controls:

• Status set to Obsolete: Move superseded documents to an Obsolete view that general staff cannot see.
• Permissions: Restrict the Obsolete view to the document controller and auditors.
• Retention labels: Apply a retention label so records are kept for the required period and then disposed of consistently.

Retention labels are part of Microsoft 365 records management. They are not an ISO requirement in themselves, but they can help you demonstrate control over records. Check whether specific retention periods apply to your industry or contracts.

Evidence Retrieval for Audits

An auditor will ask for a specific document, its current version, its approval record and evidence that staff were informed. Your SharePoint structure should let you answer in minutes, not hours.

A practical test is to pick three documents at random and try to retrieve:

1. The current approved version
2. The version history showing who approved it and when
3. The communication record announcing the change
4. The next review date and owner

If any of these takes more than a few minutes to find, tighten your metadata or views. This is the same test a certification auditor will apply, so run it before they do.

Common Mistakes

• Too many libraries: Splitting documents across dozens of libraries makes the register hard to maintain. Start with five or six.
• Metadata left blank: A register built from incomplete metadata is unreliable. Make key columns mandatory.
• No obsolete view: If superseded documents sit alongside current ones, staff will eventually use the wrong version.

Get these basics right and SharePoint will carry the document control load for a small or mid-sized ISO system. The next sections show how to add approval steps, pages and registers.

Setting Up a SharePoint Document Approval Workflow

A document approval workflow is a sequence of steps a document follows before it is published.

SharePoint offers built-in approval and review features, and Power Automate can extend them. A typical workflow runs like this:

1. The author saves the draft in the relevant library and sets the status to Draft.
2. The author requests review, which sends the document to a reviewer.
3. The reviewer comments and either approves or returns the document.
4. The approver signs off, and the status changes to Approved.
5. The approved version is published to the Current Documents view.

Record who approved each document and the date of approval as evidence the review step you defined was followed. Some organisations also set a review cycle so a reminder prompts the owner to check the document on a fixed date.

Keep the workflow simple at first. A short, reliable process that people follow is more valuable than a complex one that gets bypassed.

Presenting Policies, Procedures and Forms on SharePoint Pages

Staff rarely want to browse document libraries. They want to find the right document quickly. A SharePoint page with clearly separated sections solves this problem.

Build one page with three blocks:

• Policies block: The quality policy, environmental policy and other top-level commitments
• Procedures block: The documented processes staff follow day to day
• Forms block: The templates staff fill in to record activity

Each block should link to the current approved version only.

Use simple, consistent names. A staff member should be able to tell the difference between a policy, a procedure and a form at a glance.

Building an ISO Document Register and Other Registers

A document register is a list of all controlled documents, showing their number, title, version, owner, status and review date.

In SharePoint, you can build a register from your library metadata. Create a view showing the key columns, then export it or link to it from your intranet page.

Other registers follow the same logic. Common examples include:

• Training register: Who has been trained on which procedures, and when
• Risk and opportunity register: Identified risks, actions and owners
• Corrective action register: Problems found, root causes and follow-up actions

Each register can be a SharePoint list. For the environmental side, the IntegriSURE Environmental Aspects Methodology provides a structured way to identify and assess aspects before recording them.

ISO Management System Forms and Registers Using Microsoft Forms

Microsoft Forms is a simple way to collect information that feeds your registers.

For example, a corrective action form can ask for the problem, the date it occurred, who reported it and the immediate action taken.

Use Forms for simple capture tasks such as incident reports, training sign-offs, suggestions and internal audit findings.

Microsoft Forms has limits, so test how responses flow into your lists before relying on them.

Weighing SharePoint Against Dedicated Knowledge Management Tools

SharePoint is one option on a spectrum, from very simple file storage to sophisticated enterprise platforms. Understanding the trade-offs helps you pick the right level and explain the choice to an auditor.

The critical requirement is the same at every level: staff must be able to confirm they are using the latest approved version of each document. Everything else is a trade-off between cost, control and effort.

The Four Tiers

Tier 1: Simple File Storage

This is the easiest to start with, cheap and familiar. The downside is that it is hard to show document review, version control and approval.

If you stay at this tier, you need a manual register, a naming convention that includes version and date, and a documented review process. An auditor can accept this, but you will spend more time preparing evidence.

Tier 2: Knowledge Management Portals

These portals sit on top of existing storage and often add structured publishing, approval steps and form entry for registers. The trade-off is that your documents may be housed outside your Microsoft 365 environment, which needs review against your data policies. Check where data is stored, who can access it, and whether it meets your contractual and privacy obligations.

Tier 3: SharePoint or Teams Sites with Automation

This is the middle ground and the focus of this article. SharePoint offers version history, permissions, approval workflows and publishing, using a platform many organisations already own. Power Automate can add reminders, approval routing and register updates.

For many small and mid-sized organisations, this tier hits the balance: enough control to satisfy an auditor, without the cost and administration of an enterprise platform.

Tier 4: Advanced Enterprise Platforms

These platforms provide deep workflow, audit trails and integration with other systems. They suit complex or highly regulated environments. They also carry higher cost and more administration, which may not suit a smaller organisation. If you are considering this tier, be clear about which specific requirements drive the decision.

How to Choose

Ask these questions:

1. Where must the documents live? If your contracts or data policies require Microsoft 365, Tier 3 is the natural fit.
2. How complex is your approval process? Simple review and approval suits SharePoint. Multi-stage, cross-system workflows may justify a higher tier.
3. Who will maintain it? A platform you cannot maintain becomes a liability. Match the tier to your internal capability.
4. What evidence will an auditor ask for? If you can retrieve version history, approval records and communication records quickly, the tier is adequate.
5. What is the total cost over three years? Include setup, licensing, administration and training, not just the subscription.

Whichever option you choose, the critical requirement is the same. Your staff must be able to confirm they are using the latest approved version of each document. If your platform does that reliably, it meets the core need.

Your Next Step: Mapping Your Current Documents to a SharePoint Structure

Start by listing the documents you already have, wherever they live. Include policies, procedures, forms, registers and records.

Then sort them into the document types covered above: policies, procedures, work instructions, forms and records.

Next, decide which documents need the full approval workflow and which can use a lighter process.

Finally, build a single test library and a Current Documents page, and check that a staff member can find the right version in under a minute. If you would rather have guided support while you do this, IntegriSURE Guided is designed for organisations that want structure and direction as they build their own system.

If you want a clearer pathway through the full ISO certification process, IntegriSURE's Iso Certification resources explain what comes next.

Add integrisure.com.au as a preferred source on Google →