Document Control Software: Do You Need an eQMS?

Walk any certified shop floor and you can find the finding before the auditor does: a laminated work instruction taped to a machine, two revisions behind the version in the quality manager’s folder. Document control is the discipline that prevents exactly that, and ISO 9001 is blunt about demanding it. What the standard does not tell you is what to buy, and the market’s answer defaults to heavyweight: eQMS platforms built for medical device companies, quoted accordingly.

Here is the decision this page settles: what document control software actually has to do for a certified small or mid-sized manufacturer, what a full eQMS adds on top, and the honest test for whether you need the second or just the first. We sell the first, so read the eQMS section as us arguing against our own expansion instincts.

Four signals document control is your problem now

You’re certified or certifying, with a registrar already in your calendar.
Work instructions live at the machines, and a printed copy has drifted from the approved version.
Your proof that a document was approved exists as someone’s memory, not a record.
Document and headcount have crossed the point, usually well under 100 people, where tracking versions by hand stops holding.

Key takeaways

Document control means the right version of the right document at the point of use, obsolete versions withdrawn, and records proving both. That is the whole discipline.
ISO 9001 requires controlled documents and retained records. It does not require an eQMS, a module count, or any particular software.
The eQMS test is your process load, not your certificate: CAPA volume, nonconformance workflows, design history, validation requirements. High load, buy the platform. Low load, control your documents and keep the difference.
The most common failure is the stale copy still in circulation, not the missing procedure.

What is document control?

Document control is the discipline of making sure the current, approved version of every governed document is the one in use, everywhere, and that superseded versions are out of circulation, with records proving both. The objects are familiar: the quality manual, procedures, work instructions, forms, the policies that surround them.

The definition sounds administrative until you meet its failure modes: the technician following last year’s tolerance, the approval that exists as a memory, the auditor holding your v4 while the floor runs v2. Document control software exists because those failures are systematic at exactly the moment headcount and document count cross a threshold, usually well below 100 people.

What does ISO 9001 actually require?

In plain language, the standard requires two things about documented information. First, control of the documents themselves: they are identified, reviewed, approved for adequacy before use, available where work is performed, and protected from unintended edits, and obsolete versions are prevented from unintended use. Second, retained records as evidence: that people are competent and aware of what applies to them, that the system runs.

Notice what is absent: no required software category, no mandated module list. Registrars audit outcomes, and they sample: show me this instruction’s approval, show me the revision history, show me that the operators saw the change. The clause-by-clause walkthrough of what the registrar checks is its own post, linked below. What matters here is that the requirement is capability, not tooling.

Do you need an eQMS?

An eQMS (electronic quality management system) is a platform that runs quality processes: CAPA workflows, nonconformance reports, design controls, supplier quality, equipment and calibration management, risk files, validation documentation. MasterControl, Greenlight Guru, Arena, and their peers are serious products, built and priced for companies whose quality process load is a full-time department’s work.

The honest test. You likely need an eQMS if:

You are in a regulated medical device or pharma context, where electronic records carry their own validation rules (FDA 21 CFR Part 11) and customers audit your tooling itself
CAPA and nonconformance volume is a workflow, not an occasional spreadsheet row
You maintain design history files or device master records
A major customer contractually requires an eQMS by name

If none of those hold, and for most certified machine shops, fabricators, food producers, and contract manufacturers under a few hundred people none do, then what the certificate actually demands of software is document control: versions, approvals, distribution, awareness records, and proof. Buying an eQMS for that job means paying for modules you will not open, and worse, running your policies through a system sized for a department you do not have.

Both answers are respectable. The failure mode is buying by category prestige instead of by process load.

What must document control software actually do?

The capability list, phrased as the registrar will test it:

One current version, structurally. Only approved versions can reach the floor; drafts and superseded versions cannot be mistaken for current.
Approval before release, on the record. Who approved, in what role, on what date, for every revision.
Version history with a diff. Every prior version retained, and what changed between any two versions visible without archaeology.
Distribution that matches the org. The right teams see the right documents, and a new operator inherits the right set automatically on day one.
Awareness records. Per-person, per-version acknowledgment with identity, the text confirmed, and a timestamp: the evidence half of “trained and aware.”
Review cycles that run. Owners, review dates, reminders before staleness, and a renewal path that re-approves and re-distributes.
Exports an auditor accepts. The trail as a file, on demand, without a project.

That list is the whole job. Everything past it is the eQMS conversation above.

How AllyMatter handles document control

We built for the list, and for the size of company that lives it.

Obsolete-version control is structural, not procedural. Only approved versions can be distributed. The two-finals problem and the stale-laminate problem are closed at the root rather than patrolled by a person.

Distribution is tags, so the floor is covered by default. Tag the new operator into their line and the relevant instructions, and their acknowledgment obligations, arrive automatically. Viewers and acknowledgers are free and unlimited, so covering all 120 people on the floor costs nothing extra and coverage is never rationed by seat math.

AllyMatter Version Compare screen for the WI-07 CNC Lathe Setup work instruction, comparing v3.1 with the current v3.2, with removed text struck through in red and added text in green under Purpose and Scope and Setup and Clamping. A summary bar reads 27 words added, 18 words removed and 2 sections changed, and a Version History panel lists v3.2, v3.1 and v3.0 with Restore this version buttons on the older versions.

Document control software showing version history and a word-by-word compare between revisions

Awareness is a record, not a sign-in sheet. Each acknowledgment stores identity, the exact attestation text, the version, and the timestamp, and survives staff turnover. When the registrar says “show me the operators saw the change,” that is a filter on a log.

Revisions re-collect awareness, always. Every change re-runs approval and re-collects acknowledgment from the audience, with no minor-edit exception. Version Compare shows each person exactly what changed, so the re-read is minutes.

The proof is a file. Tamper-evident PDF or CSV per document: approvals, versions, acknowledgments, dates. Audit week becomes export week.

And the scope honesty, stated plainly: AllyMatter is not an eQMS. There is no CAPA module, no NCR workflow, no calibration scheduling, no risk register, and there will not be. Companies with real process load should buy the platform built for it and pair it with us where the platform is weakest, which is usually governed policies and awareness records. Companies without that load get document control that their team actually uses. Pricing is public.

Start your 30-day free trial. No credit card to start, and a 30-day money-back guarantee if you convert and change your mind.

Three scenarios

If you are pre-certification and under about 30 people, a disciplined folder tree with a naming convention will hold while you write the system. Spend nothing yet; the certification guide below tells you when that changes.

If you are certified or certifying at 30 to 400 people, with instructions on a floor and a registrar in your calendar, document control software is the right-sized answer, and this is exactly the company we built AllyMatter for.

If you are running regulated device or pharma quality processes with real CAPA volume, buy the eQMS, validate it, and be glad it exists. We’d still handle your policies and awareness records happily, but the quality processes belong in the platform.

Questions people ask about document control software

Is document control software the same as an eQMS? No. Document control is one discipline: current versions, approvals, distribution, awareness, proof. An eQMS runs quality processes on top: CAPA, nonconformance, design controls, validation. Every eQMS includes document control; most companies that need document control do not need the rest.

What does ISO 9001 require for document control? Documents identified, approved before use, available at the point of work, protected from unintended change, with obsolete versions withdrawn, plus retained records proving awareness and operation. Capability is required; no specific software is.

Can we do document control in SharePoint or Google Drive? Storage and version history, yes. What you build by hand is the rest: approval records, distribution by role, per-person awareness evidence, re-collection on change. Our honest guides to both are linked below.

What will the registrar actually sample? Approvals with dates, revision histories, and per-person awareness of current versions, usually by picking specific employees and specific documents. The full walkthrough is in the certification guide below.

Do e-signatures matter for document control? For controlled documents and work instructions, acknowledgment records are the standard evidence. Signature-grade execution matters for a different class of document (NDAs, agreements), covered elsewhere on this blog.

The certificate hangs on a sentence: the right version, at the point of use, with proof. Buy exactly as much software as that sentence requires, and not a module more.