A document management SOP settles where every client and company file lives, what it is called, who can open it and when it is deleted. Get it wrong and a senior consultant spends twenty minutes hunting for a signed engagement letter while the client waits on the phone. This article answers a specific question: how should a growing firm organise its working files so that anyone with the right access can find any document in under a minute, and nothing is kept longer than it should be?
Document management is not document control
These two get confused constantly, and the confusion produces bad SOPs. Document control governs the procedures and policies that tell staff how to work, and it is mostly about versions. Document management governs everything else the business produces and receives: proposals, contracts, client uploads, invoices, reports, ID checks, property particulars, mortgage case files. It is mostly about location, naming, access and retention.
If you are trying to stop people following old versions of your own procedures, you want document control instead, and the sample standard operating procedure shows the header, version and review date that handle it. This article is about the files.
Decide the home for each kind of file first
The most useful decision in the whole SOP is a short table that says which system holds which kind of file. Most firms of 10 to 250 people have three or four places files can live: a shared drive, the CRM, an accounting system, and email. Each kind of file gets exactly one home.
A sensible split for a service firm looks like this:
- Anything about one client relationship lives on that client's contact or company record in the CRM, or is linked from it.
- Internal company files, such as board papers, HR documents and supplier agreements, live in the shared drive under a department folder.
- Financial records live in the accounting system, with the invoice also visible on the client record.
- Email is never a filing system. Attachments that matter are saved to their home and the email is left as correspondence.
On the levelpartner.ai platform, documents that clients sign or upload through forms, and invoices raised through payments, attach to the contact automatically. That removes the most common gap, which is the signed document that only exists in one salesperson's inbox.
Imagine client documents spread across personal inboxes, a shared drive, two cloud folders set up by individual advisers, and the CRM. Say pulling a full case file for a compliance check takes an administrator 40 minutes. If one home per file type cut that to five minutes, 30 checks a month would save 35 minutes each: about 17 hours of administrator time a month.
A naming convention people will actually follow
Naming conventions fail when they are clever. Six-part codes with department prefixes and status suffixes get ignored within a fortnight. Use three parts at most, in an order that sorts well:
Date in year-month-day form, then client or subject, then document type. For example: 2026-10-14 Harper Lettings proposal. The date first means folders sort chronologically without anyone thinking about it. The client name means search works. The document type means you can tell a proposal from a contract without opening it.
Version numbers belong only on documents that go through drafts with a client. Once a document is final, the word final is not part of the name; the signed copy replaces the drafts.
Folder structure: shallow beats tidy
Every level of folder you add is another decision someone has to make correctly when they save a file. Three levels is the practical maximum: department, then client or project, then nothing. If a client folder needs subfolders to stay navigable, that client probably needs a CRM record with attachments instead.
The mistake most document management guides make is designing the folder tree around the organisation chart. Organisation charts change every year. Clients and projects last longer. Structure by what the file is about, not by who in the company produced it.
Access rights: by role, reviewed when people move
Access should follow role, not individual. Sales sees pipeline and proposals. Delivery sees the clients they serve. Finance sees invoices and contracts. Directors see everything. HR documents are restricted to HR and directors.
The failure to watch for is accumulated access. Someone moves from sales to account management, keeps their old permissions and gains new ones, and after three role changes can see everything. The SOP should say that access is reviewed at every role change and every leaver, not just once a year. For the wider set of tasks that land on whoever runs the office, see how operational intelligence turns overdue tasks into alerts before they pile up.
Retention and deletion
Keeping everything forever feels safe and is not. Under UK and EU data protection law, and increasingly under US state privacy laws, holding personal data longer than you need it is a liability in itself. Your SOP needs a retention schedule: a list of file types, how long each is kept after the relationship ends, and who deletes it.
You should take advice on the specific periods for your sector. Mortgage brokers and real estate firms have regulatory record-keeping duties that set minimum periods. What the SOP adds is the mechanism: a named person, a recurring date and a record that the deletion happened.
Suppose the agency sets three retention groups: client project files kept for a fixed period after the final invoice, HR files kept for a fixed period after a person leaves, and silent marketing leads removed after a set gap. A quarterly review might take the operations manager a few hours. A first review in a firm that has never deleted anything could easily clear thousands of stale lead records, and every record removed is one less exposed in a breach.
How to set up the SOP
- List every kind of file the business creates or receives in a normal month.
- Assign each file type one home system and write the list as a two-column table.
- Agree the three-part naming convention and write two real examples for each department.
- Build the folder structure to a maximum of three levels, organised by department then client or project.
- Map access by role and remove any individual permissions that do not match a role.
- Create a File Upload custom field so client documents are stored on their contact record.
- Write the retention schedule, with your adviser, listing each file type and its retention period.
- Create a recurring task for the named owner to run the retention review each quarter.
- Move the most recent year of files into the new structure and leave older files in an archive.
- Train each team in a 30-minute session using their own files as the examples.
Do not try to migrate ten years of history. Move the current year, archive the rest read-only, and pull older files into the new structure only when someone needs them. A full migration is the reason most document management projects stall in month two.
The trade-off you are making
A single home for each file type means some people lose a habit they liked. The adviser who kept their own folder of templates now has to use the shared ones. The account manager who filed by month now files by client. You give up individual convenience to gain findability for everyone else, and in a company past 30 people that is the right exchange. Expect two to three weeks of grumbling and an occasional misfiled document while people adjust.
This SOP pairs well with a broader look at operational intelligence, because file chaos is usually a symptom of a handover between teams that nobody owns. Contracts need more than a home and a name, because they carry dates and obligations; the contract management SOP covers that part.
When not to use a heavy version
If you have under 15 staff and everyone sits in one room, a single shared drive with the naming convention is enough. Add access by role and a retention schedule once you hold sensitive client data or employ people who should not see each other's files.
Frequently asked questions
Should client documents live in the CRM or a shared drive?
Wherever your client-facing staff already work all day. For most service firms that is the CRM, because the document then sits next to every call, email and invoice for that client. Large working files such as design source files can stay on the drive, linked from the client record.
How do we stop people saving files to their desktop?
Make the right place faster than the wrong one. Default save locations, templates that open in the shared library and attachments that file themselves on the contact record do more than any policy. Then check during the quarterly review and raise it with the individual.
Who should own the document management SOP?
The operations lead or office manager, with input from whoever handles data protection. Department heads own their own folder structure within it. One owner for the whole SOP stops each department inventing its own rules.
How often should access rights be reviewed?
At every role change, every leaver and once a year for everyone. The event-based reviews catch most problems; the annual one catches what slipped through. A workflow that creates a task for the operations lead whenever HR records a role change makes the event-based review reliable.