eTMF compliance with SharePoint; what inspectors expect and what you must own

Many CTUs are turning to SharePoint to shift from paper to electronic Trial Master Files - after all, it's accessible, familiar, and already part of their toolkit. But what are the major compliance challenges they will face along the way?

Talking with the TMF experts

I recently spoke at a CTU forum about the reality of running an electronic Trial Master File (eTMF) using Microsoft SharePoint.

The message from the CTU managers I spoke to afterwards. was clear.

eTMF compliance with SharePoint is not simple.

The MHRA want evidence - of exactly where your data is located, how you will restore it in the event of an emergency, and that your configuration actually works as intended.

But too many CTUs who embark on building their own eTMF overlook the resource they need in place to keep their eTMF compliant within a shifting technical stack.

With this is mind - we’ve put together a short, practical guide to SharePoint eTMF compliance.

Why SharePoint is an attractive choice - and where it gets hard

SharePoint is already in your Microsoft 365 stack. It’s got a familiar UI, comes with Office integration and quick collaboration tools. The tools for building a structured TMF may already be accessible to your team.

But it’s important to remember a compliant eTMF/eISF isn’t a document library - it’s a validated system with defined controls. And that’s where a lot of your extra work will come in for those using SharePoint..

With SharePoint, you own:

• Information architecture and permissions
• Validation of the configuration and any automations
• Backup and disaster recovery (DR)
• Documented data locations and security governance

And if those foundations are weak, going “paperless” can increase risk and rework rather than reduce it.

Regulatory expectations are changing

If you’ve got an in-house manager or outside consultant working on building your eTMF solution with SharePoint - they need to give extra thought to proving it’s ‘fit for purpose’ from a regulatory point of view.

Don’t forget, from April 2026, the new MHRA clinical trial guidelines will fully adopt ICH GCP E6 (R3) - bringing a major step up in data governance requirements.

Your team will need to demonstrate how you:

• Take a risk‑based validation approach proportionate to patient and data integrity risk.
• Meet data integrity principles (ALCOA+) across your information capture, storage, and retrieval process.
• Retain Supplier/IT oversight across your systems: you have ultimate responsibility - even when using standard Microsoft components or third‑party add‑ons.

These new guidelines are intended to make the compliance process more straightforward, but they’ve also been updated to reflect real concerns about security and data protection in an age of dangerous cyber-threats.

What MHRA inspectors expect (in plain English)

Because of this, when an MHRA inspector asks about your digital TMF, you will need to be ready to show:

1. Data residency documentation – physical data locations, jurisdictions, who has access, and how the data is secured and recovered.
2. A tested DR plan – defined RTO/RPO and recent proof you can restore the eTMF to a known‑good, compliant state.
3. Validation evidence – IQ/OQ/PQ appropriate to your build, covering standard functions and your specific configuration, flows and integrations.
4. Long‑term integrity – tamper‑evident audit trails and retention that align to policy (which now need to be kept for 25 years).

If you can’t produce these on request, you are not inspection‑ready.

eTMF managers: 3 SharePoint compliance areas you must own

So, talking to our team (and those who’ve tried using SharePoint to manage their eTMF) I’ve focused on a few areas where developers may need to spend more time and resources on compliance with the platform:

1. Data residency: your responsibility

Be prepared to replace vague “cloud” statements with a one‑page, auditable summary. Include:

• Data processors/services used and the physical locations
• Applicable jurisdictions (UK/EU/US) and transfer mechanisms
• Access controls (internal and third‑party)
• Security and recovery measures

The advice: Create a controlled Data Residency Register and update it whenever providers, tenants or sites change.

2. Backup & Disaster Recovery: shared platform means shared responsibility

Microsoft keeps the platform running, but you own your data. 

So, what does a credible pland for disaster recovery look like?

• Defines RTO/RPO and acceptable data loss
• Covers ransomware, misconfiguration and accidental deletion
• Proves a full eTMF restore to a compliant, known‑good state
• Is tested, documented, and reviewed on a schedule

The advice: deploy a third‑party backup, perform quarterly restores into a test tenant, and file the reports inside the TMF.

3. Validation on SharePoint: what “good” looks like

You must validate both the standard features you rely on (versioning, permissions, audit trails, e‑signatures if used) and your configuration (sites/libraries/metadata), plus any flows/integrations. In practice that means:

• A Validation Master Plan with user requirements traceable to design
• Risk assessment focused on data integrity
• IQ/OQ/PQ evidence for native and custom pieces
• Part 11/Annex 11 e‑signature controls (or a documented justification)
• Change control defining what triggers re‑testing (tenant updates, new flow versions, permission model changes)

The advice: Microsoft updates frequently. Assess impact and re‑test affected controls—don’t let your validated state drift.

There is another way

If you recognise any of these gaps - or you simply don’t have the bandwidth to maintain the required level of security testing and validation on a shifting SharePoint stack – you should definitely consider using a flexible platform like Cognidox to build out your TMF.

For a growing company, ploughing time and energy into maintaining a complex validation and security testing regime to satisfy MHRA inspectors could be a serious waste of resources.

On the other hand, platforms like Cognidox are developed and maintained to meet these standards - so you can concentrate your efforts on managing clinical trials rather than software.

• Validation support is part of your package mapped to GxP expectations
• Audit‑ready trails, retention and e‑signatures as standard capabilities
• Inspection‑ready reporting (who did what, when; completeness by section; overdue training/CAPA linking)
• Proven backup/restore patterns and clear supplier responsibilities
• Full data residency transparency and documentation

Building an eTMF with SharePoint can save costs for small units, but the burden of compliance is a constant nagging presence.

For example, every time Microsoft updates SharePoint - or you change a flow, plugin, or permission model - your validated state is broken. You will need to re-test and re-document it all.

Most development teams don’t have the time or regulatory expertise to manage that. And most businesses don’t realise how far short their setup falls - until they’re in front of an inspector.