Book a demo
All guides How-to · 3 min read

Moving quality records off SharePoint and Excel

Most quality systems start as spreadsheets and SharePoint lists. They work until an audit asks who approved a change, what the value was before, or why a record was edited after it was signed. Here's how to move without a big-bang project.

Updated October 7, 2026 · Not legal or regulatory advice: check the current regulation and your own procedures.

Why teams outgrow them

  • Approvals live in email. The record and the evidence that it was approved are in different places, and the link between them is a person's memory.
  • History is thin. Spreadsheets keep no reliable history of who changed a cell. SharePoint keeps versions and an audit log, but the standard audit log retention is limited (180 days by default in Microsoft Purview), and electronic signatures with meaning aren't built in.
  • Anyone with edit rights can change anything. Including records that should be locked once approved.
  • Validation is all yours. Microsoft's own GxP guidance leaves validation of your use to you.

A plan that works

  1. Inventory. List the spreadsheets and lists that hold GMP or quality records, who owns them and how often they change.
  2. Pick one process first. Choose one that's painful and frequent (deviations, CAPA, calibration or training), not the biggest.
  3. Design the table from the spreadsheet. Each column becomes a column with a type (dates, people, choices), required fields and a status, and approvals become signature steps.
  4. Clean the data. Fix free-text values that should be choices, split merged columns, and remove duplicates before importing.
  5. Import with checks. Import into the new table and fix every row the import rejects, rather than cleaning up afterwards.
  6. Decide what happens to the history. Usually: keep the old file as a read-only archive (exported to PDF, with its location recorded), and start the audit trail fresh in the new system from the import.
  7. Verify and switch. Assess and test the new process to its risk, train the users, then make the old file read-only on a set date.

Pitfalls

  • Moving everything at once. One process done well convinces people faster than ten half-done.
  • Copying the spreadsheet's flaws: a free-text "Status" column becomes a status with fixed stages.
  • Running both systems in parallel for months. Pick a cut-over date.

Sources

Templates for this

Start from a working process.

Quality

Deviations and CAPA

Record deviations, assess their impact, and open a corrective and preventive action when one is needed. CAPAs are reviewed and approved, with reminders before they fall due.

  • Deviations 15 columns · IDs like DEV-0001 · signed: QA approval
  • CAPA 13 columns · IDs like CAPA-0001 · signed: Reviewed by, Approved by
  • Reminder: Deviation due in 3 days
  • Reminder: Deviation overdue
  • Reminder: CAPA due in 3 days
  • Reminder: CAPA overdue

21 CFR 211.192 · FDA QMSR (21 CFR 820) · ISO 13485 §8.5.2 · ISO 9001 §10.2 · EU GMP Ch. 1

Operations

Equipment and calibration

An equipment register with calibration records reviewed by Quality, and reminders two weeks before calibration falls due.

  • Equipment 8 columns · IDs like EQ-0001
  • Calibrations 9 columns · IDs like CAL-0001 · signed: Reviewed by
  • Reminder: Calibration due in 14 days
  • Reminder: Calibration overdue

21 CFR 211.68 · FDA QMSR (21 CFR 820) · ISO 9001 §7.1.5 · ISO/IEC 17025 §6.4 · ISO 13485 §7.6

Quality

Training records

Who was trained on what, when, and by whom, with trainee and trainer sign-off and reminders when training falls due.

  • Training records 10 columns · IDs like TRN-0001 · signed: Trainer sign-off
  • Reminder: Training due in 7 days
  • Reminder: Training overdue

21 CFR 211.25 · FDA QMSR (21 CFR 820) · ISO 9001 §7.2 · ISO 13485 §6.2 · ISO/IEC 17025 §6.2

See it with your own process

Bring your own process to a demo.

Book a demo More guides