Why Google Drive Fails FDA Audits: Document Control Gaps

Why Google Drive Fails FDA Audits: Document Control Gaps

A lot of regulated companies start their quality system the same way: a shared drive, a folder structure that made sense to whoever built it, and a promise that everyone will "just be careful" about version control. I understand the appeal. Google Drive is free or nearly free, everyone already knows how to use it, and it feels like progress compared to a filing cabinet. In my view, that's exactly the trap. Google Drive solves the problem of storing files. FDA document control is a different problem entirely, and the gap between the two doesn't show up until an investigator asks a question the folder structure was never built to answer.

This article walks through what FDA actually requires from document control, the specific ways general-purpose file storage breaks down against those requirements, and what a system needs to actually hold up during an inspection.

What FDA Actually Requires From Document Control

Document control isn't really about where files live. It's about proving that the right version of a document was in effect at the right time, that changes went through review and approval, that people were trained on the current version before they used it, and that none of this can be quietly altered after the fact.

Three regulatory anchors define the bar:

21 CFR Part 11 has governed electronic records and electronic signatures in FDA-regulated industries since 1997. It requires that systems generate secure, computer-generated, time-stamped audit trails that independently record the date, time, and identity of the person who created, modified, or deleted an electronic record — and that this audit trail persist independently of the user's ability to edit it.

21 CFR 820.40, the device quality system regulation's document control section, requires that changes to a document be reviewed and approved by an individual in the same function or organization that performed the original review and approval, with that approval authority documented and traceable.

21 CFR 211.180 sets retention expectations for drug manufacturing records, generally requiring batch production and control records be kept for at least one year past the expiration date of the batch, and in many cases considerably longer.

None of these rules care what software you use. They care whether the record of who did what, and when, is trustworthy and cannot be quietly rewritten. That's the actual test, and it's the test a shared drive was never designed to pass.

Where Google Drive Actually Breaks Down

Google Drive is a genuinely good product for what it's built to do: collaborative file editing and storage for general business use. The failure isn't a flaw in Google's engineering. It's a mismatch between what the product promises and what a regulated quality system has to prove.

Audit Trails That Aren't Independent

Google Workspace does keep version history, but the people editing the documents are often the same people who can alter or clear that history. A user or organizer with content-manager permissions on a shared drive can permanently delete files and their revision history, bypassing the trash entirely. An audit trail that the document owner can edit or erase isn't independent in the way Part 11 requires. It's a log, not a control.

No Real Approval Workflow

Google Drive has comment threads and suggestion mode, but it has no native concept of a document being "in draft," "in review," "approved," or "effective," each gated by a defined approver role. Teams build this with folder-naming conventions ("v3_FINAL_reviewed") or a spreadsheet tracker sitting next to the drive. Both are manual workarounds layered on top of a tool that has no idea a formal approval process is supposed to be happening.

Access Control Without Segregation of Duties

Drive permissions answer "who can see or edit this file." They don't answer "did the person who approved this change have the authority to approve it, separate from the person who drafted it." Segregation of duties is a named requirement in 820.40(b). Folder-level sharing settings don't express organizational roles, and there's no enforced link between a person's job function and what they're allowed to approve.

Training Records Live Somewhere Else Entirely

An SOP revision in Drive doesn't automatically know who has read and been trained on the new version, or whether someone is still working from the version before it. That link between "document changed" and "people retrained" is often tracked in a completely separate spreadsheet, if it's tracked at all. Investigators ask for this connection directly, and a shared drive has no mechanism to produce it.

Retention and Legal Hold Aren't Built In

Retention schedules under 211.180 aren't a "keep it forever" instruction. They require specific, defensible retention periods tied to product lifecycle, plus the ability to place records on legal hold when needed. Google Workspace has retention policies available at the enterprise tier, but they're generic records-management tools, not built around GxP document lifecycle states, and they require deliberate configuration most small and mid-size regulated companies never do.

There's No Validation Package

FDA-regulated software used in a quality system generally needs computer system validation: documented evidence that the system does what it's supposed to do, consistently, and that changes to the system itself are controlled. Google doesn't publish a GxP validation package for Workspace, because Workspace isn't marketed as a validated quality system tool. That leaves the burden of proving the system works entirely on the company using it, which is a heavier lift than most teams expect until an auditor asks for it.

Google Drive vs. an FDA-Ready Document Control System

What Investigators Are Actually Testing For

An FDA investigator reviewing document control usually isn't asking "do you have a document control procedure." Nearly every company does. The question underneath is narrower and harder: can you show me, right now, that the SOP in front of this operator today is the current approved version, that the previous version was formally superseded and retained rather than deleted, and that this specific person was trained on the change before they used it.

A shared drive answers the first half of that question reasonably well. It struggles badly with the second half, because "formally superseded" is a controlled state, not a file that got moved to an old folder. And it doesn't answer the third half at all, because training records and document records were never designed to talk to each other in the first place. That gap, more than any single missing feature, is where a Google Drive-based system tends to come apart during an audit.

The Pattern Behind the Failure

Here's what I've come to think is the real issue: teams often adopt Google Drive not because they evaluated it against 21 CFR Part 11 and decided it qualified, but because nobody evaluated it against anything. It was already there, everyone already had an account, and the decision to use it for quality records was never really a decision at all. That's the pattern worth naming. The system wasn't chosen to meet the regulation. It was inherited by default, and the regulation showed up later to test a choice nobody consciously made.

This is also why the fix isn't simply "buy better software." A validated, purpose-built document control system solves the technical gaps in the table above, but the underlying habit, treating record-keeping as an afterthought rather than a designed part of the quality system, can survive a software migration if it isn't addressed directly. The tool matters. So does the decision to treat document control as a control, not a convenience.

What a Real Document Control System Needs

Setting aside any particular product, a document control system built for FDA-regulated environments generally needs to provide five things a general file-storage tool doesn't: an audit trail the document owner cannot alter, an enforced approval workflow with defined states, access controls that map to organizational roles rather than just file permissions, an automatic link between document revisions and training assignments, and a retention and legal-hold framework built around the product lifecycle rather than a generic enterprise policy.

Modern AI-assisted quality platforms are increasingly built to handle these five requirements natively, including using AI to flag when a training assignment hasn't caught up to a document revision, or to surface documents approaching their review cycle before they go stale. That's a meaningfully different starting point than retrofitting compliance onto a tool built for general collaboration.

Frequently Asked Questions

Can Google Drive be used for FDA-regulated document control at all?

Google Drive can store documents, but on its own it does not meet 21 CFR Part 11's requirement for an independent, tamper-evident audit trail, nor does it provide built-in approval workflows or segregation of duties. Companies that use it for regulated records typically need to layer significant manual controls on top, and even then, gaps around training linkage and validation documentation tend to remain.

What does 21 CFR Part 11 actually require from an electronic document system?

Part 11 requires secure, computer-generated, time-stamped audit trails that independently record who created, modified, or deleted a record and when, along with electronic signatures that reliably link to a specific individual and their stated intent (such as approval or review).

Is Google Workspace validated for GxP use?

No. Google does not publish a GxP validation package for Workspace, because the product isn't marketed as a quality system tool. Any company using it for regulated records is responsible for validating the system itself, which is a substantial undertaking most companies underestimate.

What's the real difference between file storage and document control?

File storage answers where a document lives and who can open it. Document control answers whether the document went through a defined review and approval process, whether the current version is provably the one in use, and whether superseded versions are retained and clearly marked obsolete rather than deleted or overwritten.

How long do FDA-regulated companies need to retain quality records?

It depends on the record type and the regulation. Drug manufacturers generally retain batch production and control records for at least one year past the batch's expiration date under 21 CFR 211.180, though many records are kept considerably longer. Device manufacturers have their own retention expectations under 21 CFR 820. The specific period should be defined in a documented retention schedule, not left to informal practice.

Last updated: 2026-08-07