"According to which work instruction was this product manufactured in January – and who approved it at that time?" Questions like these are a standard part of every ISO audit. Anyone who can't provide the answer within a few minutes quickly finds themselves in a difficult position – not because the instruction was wrong, but because the traceability is lacking. For quality management managers and auditors, this is precisely the crucial point: it's not the existence of a document that counts, but the complete and uninterrupted documentation of its history.
This article shows how automatic versioning and integrated traceability in SmartStash solve precisely this problem – and why this makes a fundamental difference compared to unstructured storage such as file servers or email distribution lists.
What auditors really want to see
ISO 9001, in section 7.5 ("Documented Information"), requires that documents be created, released, distributed, and archived in a controlled manner. Comparable traceability requirements can be found in ISO 27001, in industry-specific standards such as ISO 13485, and in regulatory requirements such as the GxP guidelines. Despite the differences in detail, the core principles always boil down to the same three questions that an auditor will ask:
- Which version of a document was valid at a given time?
- Who released this version and when?
- Is it ensured that no one could have modified a valid version without authorization?
Anyone who has to answer these questions from an email inbox or a folder structure on a file server loses valuable time – and in the worst case, even their credibility with the auditor. This is precisely where SmartStash comes in.
Automatic versioning: Nothing gets lost.
SmartStash isn't reinventing versioning, but rather consistently leveraging the native SharePoint Online versioning on which the platform is built. Every change to a knowledge article is therefore automatically saved as a separate version – without editors having to actively manage it. Specifically, this means:
- No overwritten content. Previous versions are retained and can be accessed at any time via the version history.
- Automatic timestamps. Each version includes the date and time of the change.
- Verifiable authorship. For each version, it is possible to see who created or edited it.
- Protection against unauthorized modification. In combination with the granular rights and roles system (see our article on rights and roles in SmartStash), it is always clear who actually had modification rights to a piece of content.
An important configuration point: the number of saved versions
Because versioning is technically based on SharePoint Online, its central setting also applies: the number of versions stored per library. By default, the tenant standard of your Microsoft 365 environment is used for this – usually sufficient for everyday collaboration, but often too limited for reliable audit evidence over several years.
For companies seeking or maintaining certification (ISO 9001, ISO 27001 & Co.), it is therefore worthwhile to take a conscious look at this attitude:
- The number of versions can be controlled centrally via the SharePoint Admin Center for the entire environment, or individually for each site collection on which a SmartStash area is located.
- Especially in areas with a high frequency of changes or particularly long legal or regulatory retention requirements, it may be necessary to deliberately deviate from the tenant standard and configure a higher (or in individual cases unlimited) number of versions.
- This setting should not be left to chance: As part of your audit preparation, specifically check whether the configured number of versions matches your retention periods – ideally together with your IT administration, as this setting is made directly in SharePoint outside of SmartStash.
This point is easily overlooked in practice because it's not located in the SmartStash interface itself, but one level below in the SharePoint configuration. However, it's a crucial component for a complete version history across the entire required retention period.
This versioning happens in the background, as a natural part of the work – not as an additional maintenance effort that editors would have to initiate manually.
Traceability across the entire life cycle
Versioning alone doesn't answer why a version was released or whether the content reached the right people. Therefore, SmartStash links the pure version history with other verification elements throughout the entire document lifecycle:
Release processes with timestamps. The one- or two-stage approval process automatically logs who released a version and when – including the distinction between technical and formal approval.
Read receipts. Has a new version not only been published, but also acknowledged by the affected employees? The read receipt function allows you to evaluate this for each version individually.
Updating processes. A frequently underestimated audit point: How do you know that a document has not only been approved once, but also regularly checked for updates? SmartStash supports structured updates, so this proof doesn't have to be painstakingly reconstructed after the fact.
Notifications for important changes. When a version is changed, the relevant target groups are automatically informed – this is also evidence that auditors want to review regularly.
Practical example: The auditor question in practice
Returning to the initial example: An auditor wants to know which version of a work instruction was used in production in January. In SmartStash, this works as follows:
- The responsible quality management manager opens the relevant knowledge article.
- The version history displays the version valid at the time in question – including the creation date, responsible person, and release status.
- One click reveals the full content of this historical version, not just metadata.
- The linked release history also provides proof of who released this version and when.
What often means searching for hours through email attachments or file server folders in an unstructured filing system is reduced to just a few clicks – live during the audit meeting, not delivered afterwards.
The evaluation center as an audit early warning system
Traceability is valuable not only during the audit itself, but also in the preparation phase. In the SmartStash evaluation center, quality management managers can see at any time,
- which content is now outdated,
- which contributions are stuck in the approval process, e.g., waiting for a pending QM approval,
- and what the status of read receipts is for individual knowledge areas.
Since each area of knowledge can be evaluated individually and those responsible only have access to their own area, audit preparation becomes decentralized: Each area manager can check whether "their" area is audit-ready, instead of a central QM department having to painstakingly gather all the information.
One system for all management systems
For companies that operate multiple management systems in parallel – such as quality, environmental, and risk management – SmartStash offers a further advantage: Additional modules for audits and audit reports, corrective actions, and management reviews access the same structures and data as the knowledge articles themselves. This means that audit evidence does not need to be maintained twice in a separate system – it is generated where documentation is already taking place.
Conclusion
The true value of versioning and traceability doesn't become apparent on the day of implementation, but rather the moment an auditor asks a specific question about a document's history. With automatic versioning, linked release and read receipts, and an evaluation center that proactively identifies gaps, SmartStash transforms this moment from a nerve-wracking ordeal into a routine process – and audit preparation into a continuous part of daily work, rather than a separate, last-minute task.
