Managing Documents in Workday Core HCM: Best Practices

Good document management in Workday Core HCM comes down to four things: a clear category structure, consistent upload habits, security that matches who should see what, and a retention process you actually run. Get those right and offer letters, certifications and compliance records are easy to find and safely locked down. Skip them and you end up with a flat pile of files nobody trusts.

This guide is for Workday administrators and HR operations teams who set up or inherit a tenant and want document handling that still works a few years later.

Key takeaways

• Design document categories before bulk uploads. Two levels of nesting is usually plenty.
• Upload final records as PDFs and add a short comment explaining why each one is there.
• Document visibility follows Workday's configurable security, so test manager, employee and HR partner access before changes go live.
• Retention rules come from law and your records policy. Don't assume the system will delete anything for you.
• Generated documents built from templates remove a whole class of typing errors.

Why does document management in Workday matter?

Ask someone outside HR what Workday is for and they'll mention payroll, headcount or benefits. Documents rarely come up. Yet offer letters, compliance records, termination paperwork, performance documentation and licenses all need to live somewhere, reach the right people and stay away from everyone else.

Workday has the tools to do this well, but the defaults weren't designed around any one organization. The best setups are deliberate. The worst usually come from someone configuring things once, under deadline, without thinking about how they'd be used two years later. When an auditor or a lawyer asks for a specific record, that's when the difference shows.

How are documents organized in Workday?

Worker documents are attached to worker records, so the starting question for any document is: which worker does this belong to, and who should be able to see it?

There are two broad kinds of documents:

Type	Examples	How it behaves
Uploaded	Scanned forms, signed PDFs, certificates	Flexible, but organization depends on the person uploading it
Generated	Offer letters, contracts produced in a business process	Tied to the business process event that created it, with that history attached

Document categories (for example Benefits, Performance, Compliance, Credentials) do two jobs. They decide how documents show up in security-filtered views, and they make targeted retrieval possible. Organizations that skip a thoughtful category design early tend to regret it.

How should you set up document categories?

Before uploading anything at scale, review the categories you have. Search the Workday task bar for "document category" to find the maintenance tasks in your tenant. Many organizations inherit a default set, and it's worth checking whether it matches how your HR team actually thinks.

1. List the document types you hold today, including those living in shared drives that should move into Workday.
2. Group them into a small number of parent categories that make sense to HR staff and managers alike.
3. Add subcategories only where they help, such as Compliance with subcategories for specific regulatory forms.
4. Use plain names without internal abbreviations, and fill in descriptions so future admins understand the intent.
5. Decide security for each category before anyone uploads into it.

Keep nesting shallow. Past two levels, users start picking the wrong category when they upload, which defeats the point.

What are the best practices for uploading worker documents?

Documents are usually added from the worker's profile through the documents area or related actions. When you upload, you'll pick a category, set a date and can add a comment.

• Use the effective date of the document, not the upload date, so timelines make sense later.
• Write a one-line comment. "Signed policy acknowledgment after March handbook update" is far more useful than a file name six months later, when someone is reconstructing a personnel decision.
• Prefer PDF for final records. Editable formats can be changed after the fact, which creates audit headaches.
• Agree on a file naming convention, such as employee ID, document type and date, so files are recognizable without opening them.
• Check upload limits. If large files fail, a Workday administrator may need to look at tenant settings rather than the user retrying.

Some documents carry their own handling rules. Form I-9 is the clearest example. If you're digitizing those, read our guide to Form I-9 remote document examination before deciding where they're stored and who can see them.

How do security and access work for Workday documents?

This is the part that usually needs the most attention. Workday's configurable security framework groups system items into domains, and domain security policies decide which security groups can view or modify them. Security groups can be user-based (assigned directly to a person, typically admins), role-based (tied to a role on a position and usually limited to specific organizations), or Workday-assigned, like Employee As Self. Changes to security policies stay pending until someone activates them.

In practice, three access patterns come up again and again:

• Managers. You might want managers to see performance documents but never medical accommodation records. That split has to be configured explicitly at the category and policy level.
• Employees. Letting workers view and upload their own documents cuts routine HR requests, but decide which categories they can see.
• HR partners. They usually need broad access within the populations they support, so the role assignments must match who they actually support.

Errors show up in two ways: people can't reach documents they need (support tickets) or they can see documents they shouldn't (a compliance problem). Test both with real test users in a sandbox before activating changes. For a deeper walkthrough, see designing role-based access with Workday security groups.

How should you handle retention and expiring documents?

Expiring documents. Certifications, licenses and similar records have renewal dates. Capture the expiration date when you upload, then set up a scheduled report of upcoming expirations delivered to whoever owns renewals. That's far more reliable than someone remembering to check.

Retention. How long you must keep a record is set by law and your own records policy, not by Workday. Some U.S. federal baselines:

• The EEOC requires employers to keep personnel or employment records for one year (from the termination date for involuntary terminations), and longer if a charge is filed.
• Under the ADEA, payroll records must be kept for three years.
• The IRS says to keep employment tax records for at least four years after filing the fourth quarter return for the year.

State laws and industry rules can require longer periods, so have legal confirm your schedule. Then build a recurring review: identify records past their retention date, confirm nothing is on legal hold, and purge using your approved process. Leaving everything forever isn't "safe." It expands what a breach exposes and what discovery can reach. A periodic Workday HCM data audit and cleanup is a natural place to fold this in.

When should you generate documents instead of uploading them?

Whenever the same kind of document is produced repeatedly. Offer letters, contracts and standard HR letters can be built from templates that pull worker data such as name, position, compensation and start date into the document during a business process step. That removes retyping errors and produces consistent formatting every time.

Build templates with HR and legal together. HR knows which data belongs in the document; legal knows which language is required. Agreeing up front saves rounds of revision later. If offer letters are your starting point, our guide to Workday Recruiting setup from requisition to offer shows where they fit in the hiring flow.

What habits keep Workday documents under control?

• Assign an owner to each category who keeps it current and removes outdated records.
• Add a document check to offboarding so a leaver's file is complete and correctly categorized. Our article on onboarding and offboarding automation covers how to build that step in.
• Audit coverage quarterly. Run a report showing active workers missing required documents in key categories.
• Re-test security after every major org or role change.

None of this is technically hard. The challenge is consistency. Teams that do well treat documents as an ongoing operational responsibility with review dates on the calendar, not a one-time setup task.

FAQ

Can managers see all worker documents in Workday?

Not unless your security configuration allows it. Access to documents follows domain security policies and security group membership, so managers see only the categories their groups are permitted to view. Many organizations let managers see performance documents but block medical or accommodation records. Test with a manager test account in a sandbox before activating any policy change.

What file format should we use for Workday documents?

Use PDF for anything that must be preserved as a fixed record, such as signed agreements, policy acknowledgments and compliance forms. Editable formats like Word can be changed after upload, which weakens their value as evidence. Keep editable versions elsewhere if people need to work on them, and upload only the final version to the worker record.

Does Workday automatically delete documents after the retention period?

Don't rely on it. Your retention periods come from law and your records policy, and you need a defined process to find records past retention, check for legal holds and remove them. Work with your Workday administrator to see which purge options your tenant supports, and document every purge so you can show the process was followed.

What to do next

1. Export a list of current document categories and how many documents sit in each, then merge or rename confusing ones.
2. Write a one-page upload standard covering format, naming, dates and comments.
3. Test document visibility for a manager, an employee and an HR partner in a sandbox.
4. Agree on a retention schedule with legal and set a recurring review date.

Sources

• Workday Documentation: Configurable Security Framework
• U.S. EEOC: Recordkeeping Requirements
• IRS: Employment Tax Recordkeeping

Last reviewed: October 2026.