Common Mistakes: Poor Version Control in ISMS Documents and Audit Evidence

Introduction

Every ISMS has documents.

Policies. Procedures. Risk registers. Statement of Applicability. Internal audit reports. Management review minutes. Corrective action records. Vendor reviews. Access review evidence. Backup test results. Screenshots. Exports. Approvals.

The problem is not that these documents exist.

The problem is that many organizations cannot control them properly.

You see files like:

• Access Control Policy Final.docx
• Access Control Policy Final Updated.docx
• Access Control Policy Final Final.docx
• Audit Evidence Q1 Latest.xlsx
• Vendor Review Updated Use This One.pdf

During an audit, this creates instant friction.

The auditor asks:

• Which version is approved?
• Who approved it?
• When was it reviewed?
• What changed?
• Is this evidence from the correct period?
• Was this file replaced after the audit request?
• Can staff access the current version?

If your team cannot answer quickly, the ISMS looks weaker than it may actually be.

Why Version Control Matters in an ISMS

Version control is not just an admin task.

It is part of trust.

Auditors, clients, insurers, and leadership need confidence that documents are current, approved, accurate, and controlled.

For ISO 27001, version control supports documented information control. For SOC 2, it helps prove that policies, procedures, reviews, and evidence were maintained consistently.

Mistake 1: Using “Final” Instead of Real Version Numbers

This is the classic mistake.

Teams use “final” because they want to show the document is done. But “final” becomes meaningless as soon as the file changes.

Mistake 2: Letting Old Policies Stay Active

Old policies can create confusion.

If staff can access outdated policies, they may follow the wrong process. During an audit, this raises questions.

Better SharePoint Setup

• version history enabled
• approval status metadata
• current approved view
• archived view
• draft visibility restricted
• policy owner field
• next review date

Mistake 3: Overwriting Audit Evidence

Audit evidence should not be overwritten casually.

If you replace evidence after it is collected, you may lose the original audit trail.

For example:

• A Q1 access review is uploaded.
• Someone notices a mistake.
• They upload a new file with the same name.
• The old evidence disappears.
• No one records what changed.

Mistake 4: No Approval History

Policies and key ISMS documents need approval evidence.

A file sitting in SharePoint is not automatically approved.

Documents that usually need approval include:

• Information Security Policy
• Access Control Policy
• Supplier Security Policy
• Incident Response Plan
• Risk Management Procedure
• Statement of Applicability
• Internal Audit Report
• Management Review Minutes

Mistake 5: No Review Date or Next Review Date

Documents can become stale quickly.

Policies, risk registers, vendor reviews, and procedures need review cycles.

Mistake 6: Evidence Does Not Show the Audit Period

Audit evidence must match the period being tested.

A file named MFA_Report.pdf is weak.

A file named AccessControl-EntraID-MFAReport-2026-Q1.pdf is much better.

Mistake 7: No Metadata for Version Control

File names help.

Metadata makes SharePoint stronger.

A proper ISMS library should include fields that show status, owner, date, and control mapping.

Mistake 8: Everyone Can Edit Approved Documents

Document control fails when too many people can edit approved documents.

Mistake 9: Risk Register Versions Are Not Controlled

Risk registers change often. That is normal.

But the organization should still know what changed and when.

Risk register version problems include:

• risk ratings change with no explanation
• accepted risks disappear
• treatment actions are edited without history
• owners change without record
• management review cannot trace decisions

Use SharePoint Lists with version history enabled. Track risk owner, risk rating, treatment decision, accepted by, acceptance expiry date, last review date, management review flag, evidence link, and status changes.

Mistake 10: Corrective Action Evidence Is Not Linked to Findings

Corrective actions need traceability.

If an internal audit finding is raised, the closure evidence should link directly to that finding.

Mistake 11: Management Review Packs Are Rebuilt From Scratch

Management review is often rushed.

Teams rebuild the pack manually each time. That creates version control problems.

Common issues include:

• old risk charts reused
• outdated audit findings included
• wrong version of the risk register used
• actions from last meeting missing
• decisions not recorded

Mistake 12: Auditor Evidence Copies Are Not Controlled

During audits, teams often create separate auditor folders.

That can help. But it can also create duplicate evidence.

What goes wrong?

• evidence copied out of source folders
• copies renamed inconsistently
• updates happen in one place but not another
• auditor reviews stale files
• teams lose track of final evidence

Use an audit workspace that links to controlled evidence where possible. If copies are needed, label them clearly with audit period, auditor request ID, source location, copy date, evidence owner, review status, sensitivity, and final submission status.

SharePoint Version Control Settings to Use

SharePoint can support strong document control if configured properly.

Version Control Checklist

Use this before your next audit.

What Good Looks Like

A well-controlled ISMS document system has:

• clear naming rules
• version numbers
• approval status
• policy owners
• review dates
• metadata
• archived old versions
• protected approved documents
• audit-period evidence naming
• corrective action traceability
• controlled auditor access
• Power Automate approval workflows

Canadian Cyber’s Take

At Canadian Cyber, we often see organizations with good security work hidden inside poor document control.

The policy was reviewed. The access review happened. The vendor was assessed. The restore test was completed. The corrective action was closed.

But the evidence is named badly, stored inconsistently, overwritten, or missing approval history.

That creates unnecessary audit pain.

Version control is not glamorous. But it is one of the easiest ways to make an ISMS look mature, organized, and trustworthy.

Takeaway

Poor version control can make a strong ISMS look weak.

Fix the basics:

• Stop using “final.”
• Use version numbers.
• Enable SharePoint version history.
• Add owners and approval status.
• Use review dates.
• Archive old versions.
• Protect approved documents.
• Name evidence by control, system, type, and period.
• Link corrective actions to findings.
• Control auditor evidence folders.

The goal is simple. Auditors should know what is current. Owners should know what to review. Leadership should know what was approved. Your team should stop wasting time hunting for “the real final version.”

Stay Connected With Canadian Cyber

Follow Canadian Cyber for practical guidance on SharePoint ISMS, ISO 27001, SOC 2, document control, audit evidence, version history, Power Automate workflows, and vCISO governance.