How document management works, and how to set it up in 90 days

A new employee needs the signed offer letter, an auditor asks for last year's invoices, and a customer disputes a clause in a contract nobody can locate. Three requests, one underlying problem: nobody set up document management before the documents arrived.

Document management is the set of rules and software that decides where a document lives, who may change it, which copy counts as the real one, and when it gets destroyed. AIIM, the information management association, calls it the use of a computer system and software to store, manage and track electronic documents and electronic images of paper records. That definition is accurate as far as it goes, and it stops before the parts that hurt: permissions, retention, proof and the moment of deletion. Type "what is document management" into a search box and most of what comes back is a vendor describing its own product.

Two neighboring terms get used loosely. Records management is the governance discipline behind ISO 15489, and it sorts documents by evidential value and legal obligation rather than by convenience. Enterprise content management, or ECM, is the software category that absorbed document management as file volumes grew.

Contracts are the sub-case most companies feel first, and they carry their own contract management process on top.

The first cost is time, and it's the one nobody books. McKinsey Global Institute's 2012 study The social economy measured how interaction workers spend a week and put searching for and gathering information at 19% of it. In a 35-hour week that is a little over an hour a day.

You will see the same research quoted as "1.8 hours a day searching for documents". That number is not in the report. It surfaced in a vendor blog a year later and has traveled on McKinsey's name ever since. The real figure is smaller and still expensive: about an hour a day, per person, spent looking for things.

Cost number two arrives in bursts. An auditor, a lawyer or a regulator asks for one specific document inside a deadline, and the answer depends on whether anyone captured it in the first place. Our guide to audit trails covers what that evidence has to contain.

Paper itself is fading. Office paper in the American waste stream fell from 7.42 million tons in 2000 to 3.97 million in 2018, according to the EPA. The filing cabinet simply moved onto a shared drive, keeping its worst habit: nobody labels anything.

Every document walks the road in the table above. Most setups handle the middle and fall over at both ends.

Creation and review is where document version control earns its keep. Real version control keeps one file with a history behind it, so there is always a current version and a record of who changed what. A naming convention is not a substitute for that; it is the symptom of not having it.

Signature is the hinge. From that moment the file is a record, and editing it stops being a correction and becomes a problem. Running it through electronic signature instead of print, scan and email keeps the signer's identity and the timestamp attached to the document itself.

The two ends carry the cost. Storage rules only work if you set them before the files arrive, and destruction has a legal deadline on both sides of it.

Federal law settled the basic question long ago. Under the ESIGN Act, 15 U.S.C. § 7001(a), a record cannot be denied legal effect only because it is electronic.

The retention rule is the part people miss. Section 7001(d) says an electronic record satisfies a legal retention requirement on two conditions: it accurately reflects the information in the original, and it remains accessible to everyone entitled to see it, for the whole period the law requires, in a form capable of accurate reproduction. UETA § 12, adopted in 49 states, applies the same test and expressly allows a third party to hold the records for you. New York runs its own equivalent instead.

Read that as an engineering requirement. A folder of unindexed scans on a drive nobody backs up satisfies neither condition, whatever the file extension says.

Retention periods themselves come from whichever agency regulates the record. IRS Publication 583 asks three years for ordinary supporting records, six if income was underreported by more than 25%, and seven only for a worthless-securities or bad-debt claim, with no limit if a return was fraudulent or never filed. FLSA payroll records run three years under 29 CFR § 516.5 and their supporting records two under § 516.6. OSHA is the outlier: 29 CFR § 1910.1020 sets thirty years for employee exposure records, and employment plus thirty for medical ones.

You'll find the full table, with the citation behind every period, in document retention periods. State privacy law pushes the other way. California's CCPA lets residents ask a business to delete personal information it collected, with exemptions for records the law requires you to keep. Keeping everything forever collides with that the first time somebody asks.

Which agreements must be in writing at all is a separate question, and it turns on the type of contract.

Systems come in four tiers, and most companies climb them in order rather than choosing once.

Folders on a laptop or a shared drive cost nothing and work until the second person joins. A cloud drive such as Google Drive, SharePoint or Dropbox adds version history, full-text search and sharing links, which is honestly enough for a lot of small companies. A dedicated document management system, a DMS in the trade, adds metadata fields, retention rules, check-in and check-out, and an audit trail per file. A document platform goes further and keeps the signature, the identity check and the evidence inside the same record as the file.

Searching for document management software for small business turns up ranked lists written by the vendors being ranked, so treat the order as advertising and the criteria as the useful part. Five things decide whether a system holds up: full-text search that reaches inside PDFs, version control users can't bypass, permissions by role, an audit trail you can export, and a retention field on every document type.

If contracts are the reason you started shopping, contract management is the narrower and cheaper place to begin.

Seven patterns account for most of the damage.

• A folder per person instead of a folder per document type. Personal folders are private filing systems, and they leave with the person.
• Versions in the filename. That's how proposal_v4_final_FINAL2.docx ends up in circulation, with nobody able to say which copy went to the customer.
• Everyone can see everything. Convenient on day one, awkward the first time you handle a salary review or a term sheet.
• Email doing duty as the archive. An inbox is searchable by exactly one person, and it walks out of the building with them.
• Scanning without indexing. A scan no search can reach fails the accessibility half of § 7001(d), even though the file plainly exists.
• A blanket seven-year rule. Wrong in both directions, and expensive in one of them.
• No destruction step. Keeping everything forever is a data-protection problem and a discovery problem at once, and it is the default whenever nobody owns the calendar.

By day 30 you should be able to name every place a document currently lives, which one of them wins, and the ten to fifteen document types you actually produce. For each type, note who creates it, who approves it, who may read it, and how long it has to survive. That table is the whole project. Everything after it is execution.

By day 60 the active documents have moved. Migrate them under the new naming rules, and set permissions by role before the migration rather than after it, because retrofitting access rules to a populated drive is where these projects stall. Turn the old locations read-only on a published date, and announce that date twice, since nobody reads the first announcement.

By day 90 the automation is running and you have tested it. Signing goes through one channel, retention dates sit against each document type, and you have run the drill: ask a colleague to produce one named invoice, one signed contract and one personnel record inside ten minutes, with no help from you. Whatever they cannot find is your remaining backlog, and it is a much shorter list than the one you started with.

Under ten people, a cloud drive with a written naming rule and a retention table in a spreadsheet is genuinely enough. Spend the effort on one decision rather than on software: everything signed goes to one place, named the same way, every time. Add electronic signature so executed copies stop living in an inbox. That's the whole program at this size.

Between ten and fifty, personal folders stop working and permissions start to matter. Move to role-based access, put a named person in charge of the document rules, and give three sets a narrower circle than the rest: payroll, contracts, and anything holding customers' personal data. A dedicated document management system starts paying for itself around here, though plenty of companies get another year out of a cloud drive plus a signing tool.

Fifty to two hundred people is where retention turns into a scheduling problem rather than a filing one. You need retention rules attached to document types, an audit trail you can export on request, and somebody who runs an annual destruction cycle against a written protocol. Check what your regulator or your largest customer's security questionnaire will ask for, then build to that instead of to general advice.

At any size the sequence holds: decide the document management rules, move the files, then buy the software.