{"id":5614,"date":"2026-11-05T09:45:23","date_gmt":"2026-11-05T08:45:23","guid":{"rendered":"https:\/\/docuply.io\/?page_id=5614"},"modified":"2026-11-05T09:45:26","modified_gmt":"2026-11-05T08:45:26","slug":"sharepoint-or-etmf","status":"publish","type":"page","link":"https:\/\/docuply.io\/en\/sharepoint-or-etmf\/","title":{"rendered":"SharePoint or eTMF? When general document storage stops being enough for clinical trials"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"SharePoint\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Last updated: 5 November 2026<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

 <\/p>\n

Short answer:<\/b> SharePoint, Google Drive, Box or a file server can be a defensible home for the trial master file (TMF) while the set-up stays small: one early-phase trial, few sites, modest document volume, or a full-service CRO running the whole TMF in its own validated eTMF. The condition is that the sponsor validates the repository on a risk basis. It must also be able to evidence the audit trail, permissions, direct inspector access and archiving for at least 25 years. A specialised eTMF makes sense once several trials, countries or partners are involved. It becomes effectively necessary when completeness, contemporaneous filing and the audit trail must be shown without manual workarounds, typically ahead of an inspection or a marketing authorisation application. Regulators do not mandate a product. What changes the answer is that the configuration, validation and maintenance burden of a general-purpose repository grows with every additional trial.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

How do SharePoint, Google Drive and a specialised eTMF compare for the TMF?<\/h2>\n

General-purpose platforms provide storage, versioning and activity logs. What they lack is a TMF structure, completeness measurement and a document-level audit trail kept for the full retention period. Configuration and validation can close many of these gaps, but the entire effort sits with the sponsor. A specialised eTMF provides these functions as standard, but the user still has to configure and validate it.<\/p>\n

General storage vs. specialised eTMF: TMF requirements at a glance (as of November 2026)<\/h3>\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Requirement<\/th>\nSharePoint\/Drive out of the box<\/th>\nSharePoint\/Drive with configuration and validation<\/th>\nSpecialised eTMF<\/th>\n<\/tr>\n<\/thead>\n
TMF structure\/index per Reference Model<\/strong><\/td>\nNot available. Folders are built by hand, and consistency depends on team discipline.<\/td>\nA Reference Model folder template is possible. Keeping it current with new model versions and trial-specific artefacts stays manual.<\/td>\nUsually preconfigured. Trial-specific tailoring and a TMF plan are still needed.<\/td>\n<\/tr>\n
Metadata per document<\/strong><\/td>\nSystem fields only, such as author and modified date. TMF metadata such as artefact, country, site or document date are missing.<\/td>\nAchievable in SharePoint through columns and content types, more limited in Drive. Mandatory fields and consistency take considerable configuration.<\/td>\nStandard feature with mandatory metadata. The sponsor must still formally define the metadata scheme.<\/td>\n<\/tr>\n
Completeness measurement (expected vs. filed)<\/strong><\/td>\nNot available.<\/td>\nOnly via a separate expected-document list or an in-house build. This is manual, error-prone and needs its own validation.<\/td>\nDashboards and metrics are typically standard. The expected-document list for each trial must be maintained.<\/td>\n<\/tr>\n
Audit trail (who\/what\/when\/why, cannot be disabled)<\/strong><\/td>\nActivity logs exist but expire (vendor information: Microsoft Purview Audit (Standard) 180 days, Google Workspace Drive log events 6 months). No reason for change is captured.<\/td>\nLonger retention via Audit (Premium), the 10-year add-on (vendor information) or a regular validated export. Reasons for change can only be captured through workflows, and admin rights remain a risk.<\/td>\nDocument-level audit trail as a core function. Availability for the full retention period should be secured in the contract.<\/td>\n<\/tr>\n
Electronic signatures under Part 11<\/strong><\/td>\nNot native. Signatures run through separate tools.<\/td>\nA signature service can be connected. Signature manifestation and record linking must be demonstrated through validation.<\/td>\nOften built in. Validation in your own context and the non-repudiation letter to FDA remain sponsor duties.<\/td>\n<\/tr>\n
Validation (responsibility, effort)<\/strong><\/td>\nNot validated for TMF use. EMA treats use outside a system’s intended purpose as inherently higher risk.<\/td>\nEntirely with the sponsor: requirements, risk assessment, testing and change control for every platform update. The effort is substantial and ongoing.<\/td>\nA vendor validation package is common. The sponsor must assess and supplement it and remains accountable.<\/td>\n<\/tr>\n
Read-only inspector access<\/strong><\/td>\nGuest or read access is technically possible. Complete, unaccompanied and logged access to the whole TMF is hard to control.<\/td>\nA dedicated read-only role with an individual account and logging can be set up. Test it before every inspection.<\/td>\nAn inspector or auditor role is usually provided. Account set-up and a short briefing remain process tasks.<\/td>\n<\/tr>\n
Collaboration with sites\/CROs<\/strong><\/td>\nExternal sharing is easy, but permissions sprawl quickly. Shared accounts and link sharing undermine attributability.<\/td>\nSeparate areas per partner, individual accounts and periodic access reviews are possible, but manual.<\/td>\nRoles for CROs and sites, upload functions and sometimes an eISF link. Site control over their own records must be secured in the contract.<\/td>\n<\/tr>\n
Quality control\/QC workflows<\/strong><\/td>\nNot available. QC runs on email and spreadsheets.<\/td>\nApproval workflows via automation tools are possible, but must themselves be validated and maintained.<\/td>\nQC status and workflows are standard. The risk-based QC plan remains the sponsor’s job.<\/td>\n<\/tr>\n
Archiving for 25 years<\/strong><\/td>\nStorage is possible. Locking, legibility, format preservation and retention of the audit trail over 25 years are not assured.<\/td>\nAchievable with retention features, a format strategy, a named archivist and an export routine. Plan for platform changes over 25 years.<\/td>\nAn archive mode is often available. Exit, insolvency and format provisions must be in the contract.<\/td>\n<\/tr>\n
Export\/migration<\/strong><\/td>\nFiles can be exported. Metadata and audit logs are available only separately and for a limited time.<\/td>\nRequires a validated export routine with a metadata manifest, log export and checksums.<\/td>\nExport formats differ. Ask specifically about support for the eTMF Exchange Mechanism Standard.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Statements about SharePoint and Google Drive are based on vendor documentation: Microsoft Learn on Purview Audit<\/a>, Microsoft Learn on version history limits<\/a> and Google Workspace Admin Help on data retention<\/a>. Licence tiers and features change, so check your own tenant before deciding.<\/p>\n\n

What do regulators require of a TMF?<\/h2>\n

A TMF must contain a trial’s essential documents at all times and be directly accessible to regulators. In the EU, it must also be archived for at least 25 years after the end of the trial in a complete, legible and traceable form. For electronic TMFs, EMA and FDA additionally expect validation, a protected audit trail, role-based access and direct read-only access for inspectors. No regulation prescribes a product. What is assessed is whether the system in use can demonstrably deliver these properties.<\/p>\n

EU Regulation 536\/2014: Articles 57 and 58<\/h3>\n

Under Article 57 of Regulation (EU) No 536\/2014<\/a>, the TMF must at all times contain the trial’s essential documents and be readily available and directly accessible to the authorities on request. Article 58 requires sponsor and investigator to archive its content for at least 25 years after the end of the trial unless other Union law requires longer. Archive media must keep the content complete and legible throughout, and any alteration must be traceable. Any transfer of ownership must be documented. The sponsor must appoint named individuals responsible for the archives, and only they may have access.<\/p>\n

EMA guideline on the TMF (EMA\/INS\/GCP\/856758\/2018)<\/h3>\n

The EMA guideline on the content, management and archiving of the TMF<\/a> applies the same basic requirements to paper and electronic TMFs. For the primary eTMF it lists specific controls:<\/p>\n