4 October 2026 Oussama Belakhdar 3 min read

Testing a document management system: documents, permissions, search and evidential value

A document management system stores contracts, invoices and HR files. Users trust it to find the right document, in the right version, and to hide it from those who must not see it.

Key takeaways

Permissions are the first risk: a document visible to the wrong person is a data leak.
Search must find the right document, including after scanning and text recognition.
Versions are never lost: history, restore, locking.
Document management is not evidential archiving: the latter follows specific standards (NF Z42-013 in France).

Oussama Belakhdar, QA architect and founder of AutomationDataCamp, has worked on software testing projects in this industry. This page sums up what we check first. Our clients are not named.

Industry figures

55% Organisations engaged in or planning retention-period rules for their documents and data (2024). Serda Conseil (2024)

59% Organisations engaged in an electronic archiving system project, versus 51% in 2022. Serda, via Archimag (2024)

€27M and €15M Fines imposed by the CNIL on Free Mobile and Free (January 2026); the CNIL notably found that Free Mobile kept data for an excessive period. CNIL — Free sanctions (2026)

Figures published by the organisations cited, not results of our own engagements.

What makes testing hard

Permissions combine users, groups, folders and metadata: the combinations are numerous.
Documents come from everywhere: scanning, email, bulk import, API.
Volumes grow over time: a search that is fast on 1,000 documents can become slow on millions.

The scenarios we test first

Import: accepted formats, large files, corrupted files, duplicates.
Permissions: read, edit and delete by role, inheritance between folders, direct access by link.
Search: by metadata, full text, after text recognition, with accents.
Versions: creation, comparison, restore, locking during editing.
Archiving and deletion: retention periods, legal hold, logged destruction.

The framework to know

NF Z42-013. The French standard for electronic archiving with evidential value (international equivalent: ISO 14641). It sets the requirements for an electronic archiving system; a standard document management system does not have that value by nature.

NF Z42-026. Governs the faithful digitisation of paper documents. Since French decree no. 2016-1673, a reliable copy has the same evidential force as the original (Article 1379 of the French Civil Code).

GDPR. Documents contain personal data: retention periods, right of access and deletion are tested too.

Our method

Start from the risks. We rank features by the impact and likelihood of a defect, then test first what would cost the most.
Automate what comes back in every release. API tests for rules and integrations, Playwright for user journeys, k6 for load, all wired into your CI.
Controlled test data. Fictitious data sets, created for each run, never copied from production.
AI with a review. An assistant speeds up writing scenarios and tests; every generated test is reviewed against our 7-question checklist. See our case study: from a PDF specification to Playwright tests.

Start with an audit

A QA audit reviews your application: a written assessment, a test strategy adapted to your industry and a costed action plan, in 5 days, for €1,000 excl. VAT as a fixed fee. Delivered remotely, in English or French, for companies in the US, the UK, Canada, Australia, Europe, the Gulf and the Nordics. The first scoping session is free.

See the QA audit at €1,000 excl. VAT

Frequently asked questions

Does a document management system have evidential value?

Not by nature. Evidential value comes from an electronic archiving system compliant with NF Z42-013 (ISO 14641). A document management system can feed such a system, and that link is tested.

What should be tested first in a document management system?

Access permissions (including direct access by link), search, version management, and retention and deletion rules. Permissions lend themselves well to automated API tests, role by role.

How much does a QA audit cost at AutomationDataCamp?

The QA audit and diagnosis costs €1,000 excl. VAT as a fixed fee, over 5 days: a written assessment, a test strategy and a costed action plan. The first scoping session is free.

Other industries: Healthcare · E-invoicing · Finance · Blockchain · Logistics · E-commerce. All industries.

Page signed by Oussama Belakhdar, written with the help of AI. Regulatory references link to the official sources above; they are not legal advice.