What is a document management system?

Most organisations do not decide to buy a document management system. They arrive at it after an event: an audit finding they could not close, a contract that auto-renewed because nobody saw the notice period, a regulator asking who accessed a record, or a week spent assembling evidence that should have taken an afternoon.

This guide sets out what the category actually is, what distinguishes it from the tools you almost certainly already have, and how to tell whether the problem you have is the problem it solves.

The short definition#

A document management system is software that manages documents as records rather than as files. That means five things, and a product that does fewer than five is doing something adjacent.

It stores documents in one repository with a version history and an unambiguous current version. It requires metadata that makes documents findable and reportable. It routes documents through a configured approval path before they can be relied on. It attaches a retention rule that determines how long each record is kept and what happens at the end. And it records every action taken on every document in a log nobody can edit.

What it is not#

It is not file storage. Dropbox, Google Drive, OneDrive and SharePoint document libraries all store files competently, version them, and share them. What they do not do by default is enforce metadata, require approval, apply a retention rule with a disposition decision, or record who read a document.

That is not a criticism — they are not sold as records systems. The mistake organisations make is not choosing them; it is assuming that because documents are stored somewhere organised, the documents are under control.

It is also not enterprise content management, which is a broader discipline covering archiving, production capture, web content and records across many systems. For most organisations that breadth is scope they will not use.

The five capabilities, in more detail#

A versioned repository#

Every document is a record with a history. Uploading a revision creates a new version and leaves the previous one intact, labelled as superseded. The current version is marked unambiguously, which matters more than the history itself — a history nobody can navigate has not helped anyone.

Check-out and check-in prevent two people editing simultaneously and producing two documents that both look authoritative.

Metadata that is actually enforced#

Fields that cannot be left blank at upload. This is the capability organisations most often under-implement, because enforcement is mildly annoying and the cost of not enforcing it appears two years later as a repository nobody can report from.

The rule is that optional fields decay to blanks. Three to six mandatory fields per document type is usually right; more than that and people work around the system.

Search that covers contents and metadata#

Text search finds documents that mention a word. Metadata search finds documents that are a thing — every contract expiring next quarter, every certificate lapsing next month. The useful question is almost never purely one or the other, which is why they belong in one query.

For any archive that began on paper, search quality depends on recognition quality, which is why OCR is a search feature rather than a scanning one.

Configured approval#

A defined path a document type must clear before it is in force, with the approver, the date and the specific version recorded. The alternative — approval by email — cannot be evidenced afterwards, which is the failure most audits actually find.

Thresholds belong in the workflow rather than in a policy. A rule that says invoices above a value need two approvals is a hope; a workflow that reads the value and adds the second approver is a control.

Retention and an audit trail#

A retention rule attached to the record class, with an explicit trigger event, that raises a review rather than deleting silently. And an append-only log recording views and downloads as well as changes — because a change log cannot tell you who read a record before it leaked.

How to tell whether you need one#

Four questions, and a yes to two or more usually settles it.

Are you audited, inspected or regulated in a way that requires you to evidence document control? Would a superseded version reaching a customer, an operator or a regulator cause material harm? Do you hold records with legal retention obligations that differ by record type? Does anyone ever need to know who read a document?

If the answer to all four is no, a well-organised shared drive with a naming convention may be entirely sufficient, and we would say so on a call.

What it costs#

Licensing is typically per user per month. The more significant cost is the work that has to happen regardless of product: agreeing a taxonomy, deciding which metadata is mandatory, settling approval thresholds, and writing a retention schedule with trigger events.

That work is why implementations run long, and it is also why it is worth doing before selecting a product rather than after — an organisation that knows its own answers evaluates vendors far more effectively.

Where to go next#

If you are building an internal case, model what the current process costs before looking at products. If you are evaluating, the checklist of requirements is more useful than a feature comparison. And if you have already bought something, the retention policy guide is the one that prevents decisions that are painful to reverse.

The categories you will encounter while evaluating#

Vendors describe themselves inconsistently, and the labels matter less than what a product actually does. Four broad groups show up in most shortlists.

File sync and share. Dropbox, Box, Google Drive, OneDrive. Excellent at storage, sharing and recovery. Governance features exist at higher tiers or as add-ons, aimed at eDiscovery and oversight rather than at a records programme. Box is the most governance-capable of the group and deserves separate consideration.

Collaboration platforms. SharePoint most obviously. Ships the components of document control — required columns, retention labels, approval flows, audit logging — as separate capabilities across separate administration surfaces, often under separate licences. Configuring them into a coherent programme is a project rather than a setting.

Dedicated document management. Products built around control from the outset. Metadata, approval, retention and audit are the default state of a document type rather than features you assemble. Narrower than the alternatives and deeper on the things this guide describes.

Enterprise content management. OpenText, Alfresco, Laserfiche and similar. Substantially broader — archiving, production capture, formal record series, industry modules — and implemented accordingly. The right answer when you genuinely have several of those problems, and disproportionate when you have one.

Three questions that separate products quickly#

Vendor demonstrations are optimised to look similar. These three questions are not, and each takes under a minute to ask.

Can an administrator edit or delete audit trail entries? Anything other than a flat no means the log cannot evidence administrator behaviour, which is the behaviour an investigation is most interested in.

Is retention attached to a record class or to a folder? Folder-scoped retention changes when a document is moved, which is a defect rather than a configuration choice.

Can we export everything — documents, metadata, version history and audit trail? A repository you cannot fully export is a future migration problem you have already bought.

What implementation actually involves#

The software configuration is usually days. The work is the decisions, and they are decisions only the organisation can make.

Someone has to agree the folder taxonomy, which is the hardest thing to change later. Someone has to decide which metadata fields are mandatory, and defend those choices when people complain that filing takes longer. Someone has to settle where approval thresholds sit, which frequently exposes that authority levels were never clearly defined. And someone has to write a retention schedule with a trigger event for every record class.

Organisations that make those decisions before selecting a product evaluate vendors far better, because they are testing against real requirements rather than being shown features.

What changes afterwards#

The effects customers report most consistently are unglamorous. Retrieval stops being a task and becomes a query. Renewals surface before the notice window closes rather than after. Audit preparation shifts from assembling evidence to exporting it. And the question "which version was in force in March" acquires an answer.

None of that is transformative in a way that demonstrates well. All of it compounds, and the organisations that value it most are the ones that have recently been unable to answer one of those questions under pressure.