How to organise document workflow in a company: map, rules, permissions and archiving step by step

Take a hypothetical trading and services company with 140 employees. Customer contracts are partly in the sales department’s folder and partly in salespeople’s emails, while signed scans sit on the front office drive. When the CFO asks about the payment terms in a contract with a large customer, three people spend half a day looking and find two different versions.

Situations like this repeat in every department, and they are rarely counted. The list below will help you judge whether the problem affects your company. If you recognise three or more symptoms, organising your documents will bring noticeable relief.

The first step is a simple table. For each important type of document, write down where it comes from, who is responsible for it, whose hands it passes through and where it should end up. A dozen or so rows are usually enough, and the work can be done in a few meetings with department managers.

For each document type, also note the number per month and the most common problem. This determines the order of work. You start with documents that are numerous and most often get stuck or lost. The table below shows sample rows from such a map.

The rule is: each document type has one location, and everyone works on the same file instead of on copies. In Microsoft 365, that location is SharePoint, the company service for storing documents. Files from Teams channels are also stored in SharePoint, so employees do not need to change their habits.

Instead of building a multi-level folder tree, add a few description fields to documents, for example the customer, contract type, effective date and status. SharePoint calls them columns. With them, you find a contract with a filter rather than by wandering through folders, and you can see at once which contracts expire next quarter.

SharePoint saves successive versions of a file automatically. So there is no need to name files “contract_v3_final_corrected”. A simple naming rule the team will remember is enough, along with a ban on sending documents as attachments inside the company – you send a link instead.

Order in documents also means order in who can access them. In many companies, sharing has grown over years, link by link, and today nobody knows who can see contracts or payroll lists. As long as files had to be found by hand, the risk seemed small.

AI tools change this. Microsoft Copilot searches all the documents a user has read access to. If the salaries folder is open to the whole company, Copilot will show it to anyone who asks about pay. That is why it is worth reviewing permissions before implementing AI, not after the first incident.

The simplest model is permissions granted to groups, not to individuals. The list below shows the rules worth starting with.

Once documents are in one place and have descriptions, their handover can be automated. Power Automate, Microsoft’s tool for building simple automated flows, sends a document to the right person based on its fields. It also tracks the deadline and, once it passes, sends a reminder or passes the matter to a deputy.

Domestic invoices now usually arrive through KSeF as structured data: the seller’s tax ID (NIP), amounts and line items are in separate fields. The workflow can therefore start automatically once the invoice is downloaded from KSeF. Reading data from scans (OCR) remains for foreign invoices, receipts and documents that are not invoices. Until the end of 2026, it will also be useful for invoices from small sellers who may still issue them outside KSeF.

Most time is usually lost waiting for approval, not working on the document itself. We describe approval rules, amount thresholds and deputies in detail in a separate guide on document approval workflows.

Order also covers the end of a document’s life. Without rules, a company either keeps everything for ever or deletes documents it should still have. The table below lists the most common periods set by Polish law – confirm them with your chief accountant or lawyer before you set up automatic deletion.

In Microsoft 365, retention periods are set in Microsoft Purview, the module for data protection and regulatory compliance. There you can specify, for example, that contracts are kept for a chosen period after they expire and then go for review before deletion.

The most common mistake is trying to organise everything at once. It is better to go all the way with one document type, show the result and only then move on to the next. The order below works well in mid-sized companies.

For each stage, allow time from department managers, not just IT staff. The rules on description, permissions and retention are set by the people who know the documents. The IT department then configures them.

A frequent cause of failed projects is moving the old mess into the new tool. Folders from the network drive go into SharePoint one to one, and the problems remain. Other typical mistakes are: