Quality management systems
A SharePoint quality management system can be assembled in more than one way — natively with libraries, lists and Power Automate; on a licensed QMS product that runs inside SharePoint; on a dedicated eQMS outside it; or as a custom build on SharePoint plus Dataverse. Which one is right depends on the modules you actually need, how much regulatory weight you carry, and who maintains it after go-live. We settle that in writing first, then build what you chose: controlled documents, nonconformance, CAPA, internal audit and supplier management, on the Microsoft 365 licenses you already hold. One fixed price agreed before work starts, typical delivery in 2–4 weeks with 30 days of hypercare.
Representative dashboard — sample data
What it is made of
A quality system is not one application. It is a handful of registers that have to reference each other, so a finding can become a corrective action and a corrective action can force a document revision. These are the parts people ask for, in roughly the order they get built.
Procedures, work instructions and forms in a library that enforces a revision scheme, a named approver before issue, one visible published version, and superseded issues retained rather than overwritten. Almost always the first module, because everything else references it.
One record per event with the part or process, quantity, detection point, containment, disposition and the person who decided it. Raised from a phone, a Teams channel or a form on the shop floor, not from a spreadsheet somebody has to remember to open.
Root cause, the action, the owner, the due date, the evidence, and — the field most systems quietly omit — the effectiveness check with a date of its own, so nothing closes because it got old. Linked back to the nonconformance, audit finding or complaint that raised it.
The annual schedule, the checklist per audit, findings graded and assigned, and a route that turns a major finding into a CAPA record automatically. The schedule is a list with dates, so an overdue audit is a view rather than a memory.
An approved-vendor list with qualification status, scope of approval, expiring certificates and insurance, incoming inspection results and supplier corrective action requests — with a flow that warns you before an approval or a certificate lapses rather than after.
Who has been assigned what, who has acknowledged which revision of which procedure, and which qualifications expire when. Cheap to add once document control exists, because the trigger is already there: a new revision was issued.
How it works
A working session against your own quality manual: which modules you need now, which can wait, what volume each will carry, who owns the configuration afterwards, and how much regulatory weight the system has to bear. That decides platform as well as scope — and sometimes the answer is that a licensed product is the better buy, which we will say out loud.
Lists, libraries, content types, the views each role opens, the approval routes, the links between registers, the scheduled flows that chase overdue actions and expiring approvals, and the retention configuration for evidence that must survive. Configured in your own tenant against your numbering, not a demo site.
Open nonconformances and CAPAs, the current document set and the approved-vendor list move in at their current state. Then we rehearse the requests an auditor actually makes, fix whatever is slow to answer, train the owners, and stay on for 30 days of hypercare while the habits set.
A quality management system on SharePoint is a set of linked registers — documents, nonconformances, corrective actions, audits, suppliers, training — built from lists, libraries and Power Automate inside the Microsoft 365 tenant you already pay for. This engagement scopes which of those you need, decides honestly whether SharePoint or a licensed product is the right host, and builds the version you chose. Work is performed remotely by senior US-based engineers from our Orange County, CA base, serving every US state, at one fixed price agreed after your free consultation.
It is worth being equally clear about what it is not. We are not a quality consultancy and not a certification body: we do not write your quality manual, decide what your processes should be, run gap analyses against a standard, or certify anything. We also do not perform computer-system validation. What we do is turn the quality process you have already committed to into configuration that holds up when somebody tests it — and tell you plainly when the honest answer is a product rather than a build.
There are four realistic ways to run a quality system in a Microsoft shop, and the choice is usually made badly — either by defaulting to whatever a vendor demonstrated first, or by assuming native SharePoint is free because the licenses are already paid for. The table below is the comparison we walk clients through in the first session. None of these rows is wrong; they fit different companies.
| Approach | What you actually get | Where it strains | Who it usually fits |
|---|---|---|---|
| Native SharePoint and Power Automate | Lists, libraries, content types, views and approval flows configured to your process, inside licenses you already hold. You own the configuration outright and can change a field without a support ticket. | Nothing arrives pre-built, so scope discipline matters; high-volume registers need indexing designed in; somebody internal has to own the configuration after handover. | Companies of roughly 20–500 people with a defined quality process, an owner who wants control, and no appetite for another per-user subscription. |
| A licensed QMS product that runs inside SharePoint | The modules pre-built and supported by a vendor, with the familiar SharePoint shell around them and the content staying in your tenant. | A per-user or per-site fee on top of Microsoft 365, configuration that bends only as far as the product allows, and an upgrade path that belongs to the vendor. | Teams that want the modules to exist on day one, have budget for a subscription, and have nobody who wants to own a configuration. |
| A dedicated eQMS outside SharePoint | A purpose-built system with validated releases, built-in electronic signatures, audit trails and a vendor who answers for regulatory questions. | The highest recurring cost, a second place documents live, integration work to stop the two diverging, and migration effort if you ever leave. | Regulated manufacturers and life-science suppliers whose customers or regulators expect a validated system rather than a configured one. |
| A custom build on SharePoint plus Dataverse | Relational records, row-level security and model-driven apps where the volume or the relationships outgrow what lists do comfortably. | Premium Power Platform licensing, a longer build, and a system that needs a developer rather than a power user to change later. | Organizations with genuinely complex relationships between records, or volumes that make a list-based design fragile. |
Two honest notes about that table. First, the choice is not permanent for every module: it is common and sensible to build document control and nonconformance natively, run them for a year, and only then decide whether supplier management justifies a product. Second, the deciding factor is rarely features — every option on that list can hold a CAPA record. It is ownership, recurring cost and regulatory expectation that actually separate them.
Each register has one design decision that, if left until later, is expensive to reverse. We settle these in the first session rather than discovering them in week three. The middle column is what we configure; the right-hand column is the question that has to be answered before we do.
| Module | How it is built on SharePoint | The constraint to settle first |
|---|---|---|
| Controlled documents | A document library with a controlled-document content type, content approval, an approval route per document type, draft and published visibility, and version or retention settings for superseded issues | Your revision numbering and who the named approver and deputy are per document type — the system hardens whatever you decide, so it has to be decided |
| Nonconformance | A list with agreed fields, a mobile-friendly intake form, containment and disposition captured with the decision-maker, and photo attachments from the point of detection | Expected annual volume. A register that will pass a few thousand items a year needs indexed columns and filtered views designed in, not retrofitted |
| Corrective action (CAPA) | A linked list carrying root cause, action, owner, due date, evidence and a separate effectiveness-check date, with scheduled flows that chase the owner and escalate | What is allowed to close a CAPA, and who may close it. Without that rule the register fills with actions marked complete and never verified |
| Internal audit | An audit schedule list, a checklist per audit, findings graded and assigned, and a route that raises a CAPA record from a finding without re-keying it | Your grading scale and which grades automatically become CAPAs — otherwise every observation becomes a corrective action and the register stops meaning anything |
| Supplier and vendor management | An approved-vendor list with qualification status and scope, certificate and insurance expiry dates, incoming inspection results, and supplier corrective action requests | Who is allowed to approve a vendor, and what happens to open orders when an approval lapses. The flow can warn anybody; the decision rule has to be yours |
| Training and competence | Assignment by role through existing groups, read-and-acknowledge capture per person and revision, and expiry warnings for qualifications with a shelf life | Whether acknowledgement is enough, or whether you need assessed training with scores — the second is a training platform rather than a quality register |
SharePoint is a good host for a quality system, and it has three specific ceilings worth knowing before you commit rather than after. None of them is a reason to walk away; all three are reasons to design deliberately.
List volume. A view that tries to enumerate too much of a large list is throttled. Microsoft’s guidance on the list view threshold in SharePoint (opens in new tab) states that the threshold is configured at 5,000 items by default and that exceeding it produces an error on views that cross it. For a document register this never comes up; for a nonconformance log at a busy plant it comes up in year two. The fix is unglamorous and has to be designed in: indexed columns, views filtered to an indexed field, and an archive rule for closed records.
Approval duration. Routing is handled by the Start and wait for an approval action, and Microsoft’s approval workflow documentation (opens in new tab) covers single, sequential and parallel approvals along with writing the decision, approver and comments back to the record. The same documentation notes that a flow which might run for more than 30 days should store its approvals in Microsoft Dataverse instead — which matters for CAPAs, because a corrective action with a 90-day effectiveness check is exactly that kind of long-running item.
Retention of evidence. Version limits on a library are a ceiling rather than an archive, and where a superseded record must survive regardless, retention comes from Microsoft Purview. Its overview of retention policies and retention labels (opens in new tab) describes the mechanics, including labels that mark an item as a record and block deletion. Purview is licensed separately in most plans, so this is a cost conversation as well as a design one, and we have it during scoping rather than after.
Companies arrive here carrying very different regulatory weight, and the right answer differs with it. An ISO 9001 manufacturer, a contract producer answering customer audits, and a medical device supplier under FDA rules are not the same buyer. For the first two, a well-built SharePoint system is usually more than adequate and materially cheaper than a subscription. For the third, the calculation changes.
The FDA’s guidance on Part 11, electronic records and electronic signatures — scope and application (opens in new tab) explains that Part 11 applies to records required under a predicate rule that are kept electronically in place of paper, and sets out the agency’s position on validation, computer-generated audit trails, record retention and copying. Reading that, and deciding what it means for your operation, is work for your quality and regulatory leads. Meeting it is a validation exercise with documented protocols and testing evidence — a discipline in its own right, and not something a configuration project quietly delivers as a by-product.
So our position is simple. We build and document the system, and the documentation is written to be useful to whoever validates it. We do not perform computer-system validation, we do not certify anything, and where the honest answer is a validated eQMS with built-in electronic signatures, we will say so in the consultation instead of selling you a library. Plenty of regulated companies still run the unvalidated half of their quality process — supplier qualification, internal audits, training records — on SharePoint, and keep the validated half where it belongs. That split is often the cheapest correct answer.
This page is the parent decision; several of our engagements are the specific builds underneath it. The deepest is document control: if you already know that controlled procedures are the problem and the rest can wait, our SharePoint ISO 9001 document control engagement covers that single module against the documented-information requirements of clause 7.5 — revision schemes, approval before issue, review dates, superseded revisions and the evidence a registrar asks for. Most quality systems start there and add nonconformance and CAPA second.
Below all of it is the general build. SharePoint intranet and document management consulting is the right purchase when the underlying problem is that files are everywhere and there is no information architecture to hang a quality system on; a controlled register inside a chaotic tenant is a tidy room in a condemned building. One level up, SharePoint governance consulting services handles tenant-wide policy: the permissions model, who may create a site, lifecycle and external sharing. Companies with both problems usually scope governance first, because quality records carry access rules that an ungoverned tenant cannot honour. After go-live, keeping any of it healthy is a third job, and SharePoint support and maintenance covers the broken flow, the permission drift and the storage warning.
Two adjacent builds come up constantly in scoping. Every module here rests on approval routing, and our guide to building an approval workflow in Power Automate walks the same mechanics for spend and requests. And where training has to go beyond acknowledging a revision — a course catalogue, curricula by role, scored knowledge checks, certification expiry — that is a training platform rather than a quality register, which is what our SharePoint learning management system engagement builds. Where the quality question is really a reporting question — scrap, first-pass yield, on-time delivery trended for a management review — our Power BI consultant for manufacturing engagement builds that side instead.
The usual fit is a company of roughly 20 to 500 people already paying for Microsoft 365, holding or pursuing a quality certification, running its quality process across spreadsheets, shared folders and an inbox, with a quality manager who is tired of being the integration layer. Manufacturers, engineering firms, contract producers, laboratories and distributors all arrive with the same three triggers: a finding at audit, a customer demanding evidence, or a quality manager leaving and taking the system with them.
It fits badly in three cases, and we would rather lose the scope than take it. If your quality process exists only as an intention — no agreed procedure, no owner, no defined grading — configuration will harden decisions nobody has made; write the process first. If you need a validated system with vendor-supplied validation evidence, buy the eQMS. And if what you actually want is somebody to interpret a standard, run a gap analysis or represent you in front of a registrar, that is a quality consultancy, and we will tell you so in the consultation.
The table below sets out scope and timeline for a first tranche of modules. The fixed fee is quoted only after we have seen the process, because the honest drivers are how many modules are in scope, how many approval routes genuinely differ, the volume each register will carry, how much legacy history has to be carried across, and whether retention is handled with library limits alone or with Purview labels. Our fixed-fee process explains how the number is set and what is locked before work starts.
| Phase | Scope | Typical timeline |
|---|---|---|
| Phase 1 — decide and scope | A read of your quality manual and current registers, the build decision between native SharePoint, a licensed product, an eQMS and a custom build, module selection and sequencing, volume estimates, approval routes, grading scales, retention rules, and the named owner for each register | About the first week |
| Phase 2 — build and configure | Lists, libraries and content types, the views each role opens, the links between registers, approval routes with write-back, scheduled flows for overdue actions and expiring approvals, indexing and archive rules for high-volume registers, and retention or record labels where evidence must survive | Weeks 2–3 |
| Phase 3 — load, rehearse, hand over | Open records, the current document set and the approved-vendor list loaded at their current state, a dry run of the evidence requests an audit actually makes, owner training, written configuration documentation, then 30 days of hypercare | Week 4 and close-out |
Everything produced is yours from day one: the lists, libraries, flows, labels and the written configuration all live in your own Microsoft tenant, never in ours, and the documentation is written so your quality owner can add a field or change an approver without calling anybody.
Related services
The document-control module in depth — controlled libraries, approval before issue, review dates and clause 7.5 evidence.
The general build: information architecture, libraries, metadata and an intranet designed rather than accumulated.
The tenant-wide control layer: permissions model, site provisioning, ownership, lifecycle and external sharing.
Further reading
Hand-written guides from our article library.
The intake, routing, reminders and write-back that turn an email chase into a queryable decision record.
The backend decision behind a custom build — relationships, delegation limits, row-level security and the licence consequence.
Which system each kind of document belongs in — settled before a quality procedure has to carry the confusion.
FAQ
Usually five working parts rather than one: controlled documents, a nonconformance log, CAPA records, an internal audit programme, and supplier or vendor qualification. Training and competence records are a common sixth. Each is a list or library with agreed fields, views and an approval route, joined so a finding can become a CAPA and a CAPA can force a document revision.
It depends on how much of the system you need and who maintains it. Native SharePoint with Power Automate covers document control, nonconformance, CAPA, audits and supplier qualification well, and you own the result outright. A licensed QMS product is the better buy when you want the modules pre-built, a vendor to answer for them, and no internal owner for the configuration.
Document control is one module of a quality management system. The ISO 9001 document control page covers that module in depth: controlled libraries, approval before issue, review dates, superseded revisions and clause 7.5 evidence. This page is the wider decision about which modules you build, in what order, and on which platform.
Sometimes, and only with eyes open. Part 11 applies to records kept electronically in place of paper under a predicate rule, and it brings expectations about validation, computer-generated audit trails and electronic signatures. Meeting those is a validation exercise, not a configuration task. We build and document the system; we do not perform computer-system validation, and where a validated eQMS is the honest answer we say so.
Three that decide designs. A list view is throttled at 5,000 items by default, so a high-volume nonconformance log needs indexed columns and filtered views from day one. An approval that may run past 30 days has to store its approvals in Dataverse. And record locking, disposition review and longer audit retention come from Microsoft Purview, which is licensed separately in most plans.
Typical delivery is two to four weeks from kickoff for a first tranche of modules, with the date written into your scope. The fixed fee follows how many modules are in scope, how many approval routes genuinely differ, whether supplier and training records are included, how much legacy history is carried in, and whether retention is handled with library limits alone or with Purview labels.
Book a free consultation
Tell us what you’re trying to fix — a report, an approval process, an intranet, a Copilot rollout. We scope it as a fixed-fee project, you approve, and a senior engineer delivers in 2–4 weeks.
The fastest way to reach us is the form — tell us the task and we’ll reply within one business day.