Auditors sampling document control are not grading how good your documents are. They are testing whether the paper trail matches reality — whether the revision on the shop floor matches the register, whether the register matches an actual approval, and whether you can prove it in under a minute when asked. That traceability test is the whole audit, and it applies the same way to a paper register as to an online document control system: most fail it quietly, long before anyone opens a nonconformity.
This matters because a lot of QMRs prepare for the wrong thing. They polish document formatting and review SOP wording, when the auditor's actual method is closer to a spot check: pull a document off the floor, pull its register entry, and see if the two stories agree.
What "document control" means to an auditor, not to you
To the person who owns the QMS, document control is a process. To an auditor, it's a claim you're making that needs evidence. Every controlled document implicitly asserts: this is the current approved revision, it was approved by the right person, on this date, and everyone who needed a copy has this version and not an older one.
An auditor's job is to pick a handful of documents — often the ones most recently revised, because that's where drift shows up fastest — and check whether that claim holds. Whether your registers live in a folder of paper forms, a shared drive, or a purpose-built system, the test doesn't change: can you produce the chain from "document in use" back to "person who approved it," without gaps.
The five things an auditor actually samples
In practice, auditors work through a short, repeatable list. It rarely changes across sectors because clause 7.5 doesn't change across sectors.
- Revision number on the floor matches the register. They'll grab a working copy from a production line or a workstation and check its revision letter or number against what the master document list says is current.
- Effective date is real and traceable. Not just present — traceable to an actual approval event, not backdated or estimated after the fact.
- Master document list and distribution matrix agree with what's actually issued. If ten departments are supposed to hold a document, the auditor may ask to see evidence that all ten got the current revision, not just that a list says they should have.
- Retention and disposal dates are being honored, not just calculated. A retention date sitting unused in a spreadsheet column isn't evidence of anything. Auditors look for whether disposal actually happens on schedule.
- Obsolete copies are marked and can't be mistaken for current. This is the one that catches people out most often — a superseded revision left in circulation, still readable, with nothing on it to say it's dead.
None of these five checks are about document content. They're about whether your control system tells the truth about its own state.
Where the Audit Trail Lives in an Online Document Control System
Auditors don't care what software or format holds your register. A spreadsheet, a bound register book, or a purpose-built system are all acceptable in principle. What they care about is whether the register is complete, current, and consistent with itself across every place the same information appears — because in most document control setups, the same fact (a revision number, an effective date) gets written in three or four places by hand: the amendment record, the master document list, the change register, and sometimes a physical stamp on the document itself.
Every one of those manual re-entries is a place drift can start. An auditor who finds one register disagreeing with another isn't finding a paperwork error — they're finding evidence that your control system's core claim, "this is current and everyone knows it," might not be true.
Google Sheets as your register: where it holds up, and where it doesn't
Google Sheets was the register and master-list backend in a document-control system we built for a Thai manufacturer, ISO 9001:2015 certified across two sites — so this isn't a hypothetical, it's a real design decision made against a real operation. Being honest about where it works and where it stops working is more useful than a blanket recommendation either way.
Where Sheets genuinely holds up:
- It's human-readable. An auditor can look directly at the register without needing you to explain a proprietary interface.
- It's easy to export as evidence, and it doesn't lock your data behind a vendor.
- For a single facility with a modest document count, one well-structured sheet per register (amendment record, master list, change register) is entirely sufficient to pass an audit, provided the entries are accurate.
Where it stops scaling:
- Sheets has no enforced schema. A cell that should hold a date can hold text, a formula can get overtyped, and nothing stops it.
- There's no per-field log of who changed what and when. Google's version history helps, but it's not built as an audit log, and reconstructing "who wrote this entry and why" from it is slow.
- Nothing keeps the amendment record, master list, change register, and distribution matrix consistent with each other automatically. If a person updates one and forgets another, the sheets disagree and nobody notices until an auditor does.
- There's no idempotency protection. If the same approval gets processed twice — a common slip when a document controller is working through a backlog — nothing stops a duplicate entry from being written.
- Multi-department distribution matrices and multi-facility retention schedules get genuinely hard to keep correct by hand once you're past a handful of departments.
The honest conclusion isn't "replace Sheets." It's that Sheets is a fine place to store a register and a poor place to maintain one by hand once volume grows. In our build, Sheets stayed as the backend — the manual retyping in front of it is what got removed, with an automation layer writing to it only after a human approval event, logged individually, with duplicate-write protection built in.
| Register task | Manual Sheets entry | Automated write to Sheets |
|---|---|---|
| Revision number | Typed by DCC, can be mistyped or skipped | Written once, from the approval event |
| Cross-register consistency | Depends on DCC remembering every sheet | Enforced — one event writes all related fields |
| Duplicate approval processed twice | Can create a duplicate row | Idempotency-keyed — no duplicate entry |
| Change history | Google's built-in version history | Individually logged activity trail per field |
The human decision gates still have to hold
None of this changes what an auditor actually wants to see at the front of the process, which is that a human made the call. A document control workflow — automated or not — has to preserve the human decision gates that ISO 9001 requires: someone reviewing the proposed change, someone else confirming content adequacy, and a final sign-off before anything becomes effective. Automation's job starts after that chain closes, not before it.
What changes when a trigger fires isn't the judgment — it's the eight fields a document controller usually retypes by hand after that judgment is made: revision number, effective date, amendment-record entry, distribution matrix row, change-register entry, request number, page count, and retention date. Those are exactly the fields an auditor samples. Writing them automatically, from the same approval event, individually logged, is what closes the gap between "the register says X" and "X is actually true."
For the fuller picture of where the line between human judgment and automated execution sits, see what ISO automation actually means — it's the same boundary auditors are implicitly testing when they sample a document.
FAQ
Do auditors need a digital system to pass an audit?
No. A well-maintained paper or spreadsheet register can pass. What matters is consistency and traceability, not the tool.
What's the single most common finding in document control audits?
A register that disagrees with itself — a revision number, effective date, or distribution record that doesn't match across the amendment record, master list, and change register.
Can Google Sheets alone pass an ISO 9001 audit?
Yes, for a single facility with a modest document count and disciplined manual entry. It stops being reliable once entries are written by hand across multiple sheets by multiple people under time pressure.
Do auditors check retention and disposal dates directly?
They typically check whether calculated dates are being acted on, not just present in a column. A retention date with no corresponding disposal action is a common gap.
Is an automated register more audit-friendly than a manual one?
An activity log that ties every register write to a specific human approval event, with no duplicate entries possible, generally gives an auditor a cleaner trail than a hand-maintained equivalent — because it removes the chance of a register entry that doesn't match what was actually approved.
Auditors are testing whether your document control system tells the truth about itself. If you want to see how that holds up against your own registers, book a workflow walkthrough with 1% EVO and bring your current document control process.